One cookie, and it works for you.

Cookies we set

When you sign in, our authentication provider (Supabase) sets the session cookies that let the app know it’s you on your next visit. They exist so you don’t have to type your password every time, they carry no tracking, and they go when you sign out. Cookies like these are classed as strictly necessary — which is why there is no cookie banner: there is nothing optional to consent to.

Local storage we do use

The app keeps two small things in your browser’s local storage: a cache of your profile (the names, so the archive opens faster — cleared when you sign out), and any half-written reflection, so navigating away doesn’t lose your words (kept until you save it). Your answers themselves live in your account, not in the browser — see the privacy policyfor how they’re protected.

The letter form

The email box on the public pages posts to our own server. It does not set a cookie and does not load a third-party tracker.

What we don’t have

No Google Analytics. No Meta pixel. No session recording, heat maps, fingerprinting or remarketing of any kind. We make a place to keep a friendship on paper; we don’t need to follow either of you around the internet.

The visit count

Vercel records an anonymous page-view count on every page of the site, including the signed-in archive, so we can see whether anyone found us. It does not set a cookie and is not tied to your account or what you write. See the privacy policy for the same disclosure.

Your choice

If you block cookies for this site, signing in will stop working — that’s all they do. The visit count is not a cookie, so it is not something a banner would need to warn you about. A private browsing window works fine too; you’ll simply be signed out when you close it, and your archive will be waiting in your account next time.