Privacy Policy

Cartalma — last updated November 2026

Cartalma is a slow correspondence and dating app: two people write letters to each other that arrive after a delay, get to know each other through words first, and can later choose to reveal a photo. This policy explains what information we collect to run that experience, why, and what choices you have.

Information we collect

• Account information: Cartalma accounts sign in with Apple or Google (next item). We keep the email address the provider shares with us, your pen name, birth date, gender, dating intention, and who you're seeking. Birth date is used solely to confirm you're 18 or older; Cartalma is not directed at or available to minors.
• Sign in with Apple or Google: when you sign up or log in with your Apple ID or your Google account, the provider shares your name and email address with us to create or match your account (with Sign in with Apple you may choose to hide your email, in which case we receive a private relay address). We never see your Apple or Google password.
• Email and password (restricted access): signing up with an email address and password is not offered to the public. It exists only for a few accounts we create ourselves — for our own testing and for the app stores' review (a demo account). For those accounts the password is stored only as a one-way cryptographic hash — we never see or store the plain text.
• Profile information: the interests, categories, and short phrases you choose to add to your profile, your "signature" line, and — if you choose to add one — a single profile photo.
• Correspondence content: the letters you write and receive. Because a letter belongs to a conversation between two people, if you delete your account your own identifying details are removed and your letters can no longer be opened in your correspondents' mailboxes; they stay only in a correspondent's Memory Vault, if they keep one, signed "A departed soul" (see "Deleting your account" below).
• Approximate location: at sign-up we derive an approximate geographic origin (city/region level, never a precise address) from your device's IP address, so your letters can carry a "posted from" origin. You can edit this yourself afterwards.
• Purchase information: if you subscribe or buy stamps/unlocks, the purchase is processed entirely by the Apple App Store or Google Play and our payments partner, RevenueCat. We never see or store your card number or other payment details — only confirmation of what was purchased, so we can grant the corresponding access.
• Basic technical data: standard server logs (timestamps, error traces, IP address at the time of a request) kept for security and debugging.

How we use this information

• To create your account, verify you're an adult, and operate the core letter-writing experience (pairing, transit-time delays, replies, mutual photo reveal).
• To grant subscription and purchase entitlements, and to detect fraudulent purchase attempts.
• To keep the service secure and to diagnose technical problems.
• We do not use your data for advertising, and we do not sell your data to third parties.

Who we share information with

We use a small number of service providers to run Cartalma. Each receives only what it needs for its task:

• Render — hosts our servers; every request the app makes, and the data in it, passes through them.
• Neon — hosts our database, where your account, profile and letters are stored.
• Cloudflare R2 — stores your uploaded profile photo, if any, as a file in object storage.
• ipwho.is — at sign-up, receives your device's IP address once and returns its approximate location (country and city), which is what we keep; we do not store the IP address for this purpose.
• RevenueCat — processes subscription and purchase events on our behalf (see RevenueCat's own privacy policy).
• Apple and Google — handle billing for all purchases made through the App Store and Google Play, and Sign in with Apple and Google Sign-In.
• Discord — when someone files a report, we receive an alert in a private Discord channel so it can be reviewed quickly. The alert carries no personal data: only the report's reference number, its category and a link to our own moderation tool.
• We do not share your data with advertisers or data brokers.

Data security

Passwords are stored as salted one-way hashes (bcrypt), never in plain text. Traffic between the app and our servers is encrypted in transit (HTTPS/TLS). Access to production systems is limited to the people operating the service.

Deleting your account

You can delete your account from within the app at any time (Studio → Dissolve my account), or by email. When you do, your account is deactivated immediately (you can no longer log in), and we permanently erase or anonymize your email address, name and pen name, password, birth date, photo (the file is deleted from our storage), approximate location, pairing answers, profile answers, signature line, and the list of people you blocked; we also ask RevenueCat to delete its record of you. Letters you already sent can no longer be opened in your correspondents' mailboxes, including any still on their way. If a correspondent keeps a Memory Vault, the letters you exchanged stay there, signed "A departed soul" instead of your name. A letter's text is never edited, so anything you wrote in it — including the "posted from" line at its head — stays as you wrote it. Purchase records (linked only to an anonymous account number) and safety reports are kept, as tax, refund and safety obligations require. The full list is on our Delete Your Account page.

Your rights

Depending on where you live (including under the EU/UK GDPR and Brazil's LGPD), you may have the right to access, correct, or request deletion of your personal data, and to object to certain processing. Contact us using the details below to exercise these rights.

Children

Cartalma is restricted to adults 18 and older. We do not knowingly collect information from anyone under 18.

Changes to this policy

If we make material changes to this policy, we'll update the date at the top of this page.

Contact us