Privacy Policy

Version 2026-09-28. Effective 2026-09-28. Supersedes version 2026-09-14.

Clarified 2026-11-03: sections 1, 10 and 11 now describe the age and residence checks at signup and checkout, and section 3 describes the letter counts we keep. No change to your rights or obligations.

Your letters are the most personal thing we hold. This policy says plainly what we collect, who touches it, how long we keep it, and how to make us delete it.

1. What we collect

• Account information — the name you give us, your email address, your time zone, and the interests you tell us about so we can match you with a persona.
• Your correspondence — the full text of every letter you send and every letter a persona sends you, and the dates they were sent.
• A persona's memory of you — a running summary the service keeps so your pen pal remembers what you've talked about. It is derived from your letters and is treated as part of them.
• Billing information — your plan, billing period, and payment history. We never see or store your card number. Our payment processor handles card details directly; we hold only a token, the last four digits, the country of your billing address, and the country your card was issued in. We keep only the country from your billing address, not the address.
• Operational records — sign-in times, the IP address used at signup, email delivery and bounce events, and error logs.

2. Sensitive information, including health

People write to pen pals about their health, their families, their faith, their grief, and their politics. We do not ask you for any of it, and you should not feel you have to share it — but when you do, it lives in your letters, and some of it is legally sensitive information.

We treat anything you disclose in a letter as sensitive. We use it only to generate your persona's replies and to operate your account. We do not sell it, we do not use it for advertising, we do not profile you with it, and we do not share it with anyone except the providers listed in section 5.

Some states require your specific consent before we process sensitive information — consumer health data under Washington's My Health My Data Act, and sensitive-category data under the Texas, Nebraska, and other state privacy laws. Today that consent is part of accepting this Privacy Policy at signup: there is no separate checkbox for it yet. We record which version you accepted and when. We are telling you this plainly rather than describing a separate step we have not built, and a separate, specific consent is something we intend to add.

You can withdraw your consent at any time by emailing us. Withdrawing it means we close your account, because we cannot generate letters without processing what you write.

3. How we use it

To generate persona replies; to deliver and receive your mail; to run your subscription and bill you; to answer your support requests; to detect abuse and fraud; to keep the service working; and to tell whether it is working for the people who use it. That is the complete list.

For that last purpose we keep counts about each letter — when it was sent, how many words it has, and how long the reply took. The counts are computed automatically, contain no text from your letters, and no one reads your letters to produce them. We look at them in aggregate, and they are not used to profile you.

We do not sell your personal information, and we do not share it for cross-context behavioural advertising — under any state privacy law's definition of those terms. We have never done so.

4. AI processing

Persona letters are generated by a large language model operated by Anthropic. To write a reply, we send Anthropic the persona's description, your recent correspondence, and the persona's memory of you.

Anthropic does not train its models on your letters. We use Anthropic's commercial API, under terms that prohibit training on customer data. We do not train any model on your letters either, and we do not use them to build or tune personas for other users.

5. Who else touches your data

We use a small number of service providers, each bound by contract to protect your data and use it only to provide their service to us:

• Anthropic — generates persona letters (United States).
• Postmark — sends and receives email (United States).
• Fly.io — hosts the application and database (United States).
• Cloudflare — DNS, and encrypted storage of database backups (United States).
• Stripe — processes payments and holds card details (United States).

We will also disclose information if the law compels us to — a subpoena, a court order, a valid legal process. Where we are permitted to tell you first, we will.

If Thinking Pen is ever sold or merged, your data may transfer with it. We will email you before that happens, and you will be able to delete your account first.

6. How long we keep it

• While your account is open — we keep your correspondence, because a pen pal who remembers is the point of the service.
• After you cancel or close your account — we keep your letters and the persona's memory of you for 90 days, so you can come back or ask for a copy, and then we delete them permanently.
• If you ask us to delete sooner — we do it within 30 days, and usually within a few days.
• Billing records — we keep invoices and payment records for 7 years because tax law requires it. These contain what you paid and when, not what you wrote.
• Backups — deleted data persists in encrypted backups for up to 30 days after deletion, then ages out.

7. Your rights

Wherever you live in the United States, and regardless of whether your state has a privacy law, you can ask us to:

• Show you what we hold about you.
• Give you a copy of your correspondence in a portable format.
• Correct anything inaccurate.
• Delete your account and your correspondence.
• Withdraw your consent to sensitive-data processing.

Email support@thinking-pen.com from your account's email address. We respond within 45 days, and normally much sooner. We will not charge you, and we will not treat you differently for asking.

When you ask us to delete, we delete the persona's memory of you as well as the raw letters. We mention this because it is the part people don't expect: a summary distilled from your letters is still your data, and deleting one without the other would not be real deletion.

If we refuse a request, we will tell you why, and you may appeal by replying to that message. If we deny your appeal you may complain to your state Attorney General.

8. Sensitive disclosures in letters

If you write something that suggests you are in danger, an operator — a human being — may read that letter in order to respond appropriately. Our Safety Policy describes when this happens and what we do. We keep an aggregate count of such events, without identifying anyone, to meet state reporting obligations.

Aside from that, and from investigating abuse or a support request you send us, we do not read your letters.

9. Security

Your correspondence is encrypted in transit and at rest. Backups are encrypted. Access is limited to the operator of the service. Sign-in is by emailed link or one-time code, so there is no password of yours for anyone to steal.

No system is perfectly secure. If your data is involved in a breach, we will notify you and the applicable authorities within the time your state requires — 45 days or fewer in most states, and sooner where required.

10. Where we operate

Thinking Pen is a United States service for people who live in the United States, and your data is stored in the United States. We are not set up to meet the GDPR, the UK GDPR, or other countries' privacy laws. At signup we ask you to confirm that you live in the United States. At checkout we check the country of your billing address; if it is outside the United States, no subscription starts and the charge is refunded in full. We do not use your IP address or location for this — the billing country is the only check. If you live outside the United States and have an account, tell us and we will close it and refund what you paid.

11. Children

Thinking Pen is for adults 18 and over. At signup we ask you to confirm that you are, and we record that you did. We do not knowingly collect information from anyone under 18. If you believe a minor has an account, email us and we will close it and delete the data.

12. Changes

If we change this policy materially, we will email you at least 30 days beforehand and ask you to accept the new version. The version date at the top always tells you which one is current.

13. Contact

Thinking Pen LLC
support@thinking-pen.com