Privacy Policy

Who we are

The service is operated by L’Atelier Gege LLC (Лателиэр Гэгэ ХХК), a company registered in Mongolia. For anything in this policy — questions, corrections, or deletion — email hello@gege.mn.

What we collect

The letter you submit. That means the recipient’s first name, the text of your letter, and the design you choose. You are writing this so that it can be published, so please treat everything in a letter as public from the moment you send it.

An email address — only if you choose to receive the review result and, if the letter is published, links to it. It is optional and is not used for marketing.

Technical information needed to run the service safely, and to measure how it is used:

• A one-way, salted hash of your IP address. We never store your raw IP address. The hash is used only to rate-limit submissions and to help prevent abuse.
• A random browser identifier in an essential first-party cookie. Your browser sends it when you submit a letter; we store only a one-way, salted hash with the letter so we can enforce the limit of three submissions per browser in a rolling 24-hour period.
• A one-way hash of the letter’s text, used to catch duplicate or spam resubmissions.
• Ordinary server logs kept by our hosting provider.
• A count of the writing-flow screens people reach — the name of the screen and nothing else, added to that day’s total. It carries no identifier, so it cannot be tied to you or to one visit.
• A running total for each term searched in the public letter feed: how many times it has been looked up, and how many of those found a letter. The total belongs to the term, not to the person who searched.
• A running total for each published letter of how many times its own page has been opened. The total belongs to the letter, not to the person who opened it; nothing in it identifies a browser or a visit.

We do not collect accounts or passwords, your precise location, or advertising identifiers, and we run no advertising. We build no profile of you ourselves. Google Analytics, described in the next section, is Google’s product, and Google handles what it collects under its own privacy policy.

Cookies and analytics

We run no advertising and we set no advertising cookies. The cookies here do two jobs: running the service, and measuring it.

We set one essential, first-party cookie (`last_letter_device`) to apply the browser submission limit. It is not available to page scripts, is not used to follow you across sites, and expires after one year.

We use Cloudflare Web Analytics, which is cookieless and reports only aggregate page-view counts — it sets nothing on your device and does not follow you across other sites.

We also use Google Analytics to understand how many people visit and which pages they use. It is a Google product: it sets its own first-party cookies (`_ga` and `_ga_<id>`) so that it can recognise a returning browser, and what it measures is sent to Google, which handles that data under its own privacy policy. If you would rather not be counted, you can block or delete cookies in your browser settings, or install Google’s opt-out add-on from tools.google.com/dlpage/gaoptout. We deliberately leave Google Analytics off the private page your letter link opens, so that link is never reported to Google.

We count three more things ourselves, on our own servers, with no identifier of any kind. The first is the writing flow: as you move through it, your browser reports the name of the screen it reached — that you got as far as picking a design, for example — and we add one to that day’s total. The report is the screen name and nothing else: no identifier, no page address, no IP address. It tells us how many people reached a step, never which people.

The second is search. When you look up a first name or a hashtag in the public letter feed, we keep a running total for that search term: how many times it has been looked up, how many of those found a letter, and how many the most recent lookup found. The total is stored against the term, not against you, and nothing in it points back to whoever typed it. We keep it because a name people search for and never find tells us that a letter someone wants does not exist yet.

The third is reading. When a letter’s own page is opened, we add one to that letter’s total. Your browser sends the letter’s public id and nothing else — no identifier, no page address, no IP address — and sends it at most once per letter per visit. The total is stored against the letter, not against you. It tells us which letters are read and which never are, never who read them.

The anti-bot check on the submission form (Cloudflare Turnstile) may set a temporary token to confirm you are a person. It is not used to track you.

How we use your information

• To review, edit, adapt, translate, publish, distribute, promote, archive, and otherwise use your letter as described in the Terms of Service, including for lawful editorial, research, commercial, or non-commercial purposes.
• To prevent spam, abuse, and duplicate submissions, and to apply rate limits.
• To email you the review result and, if your letter is published, links to it, when you ask for those updates.
• To operate, secure, and maintain the service.

Automated review (AI)

To help screen letters, the text of a letter may be sent to Google’s Gemini API, and in some cases OpenAI’s API, for automated moderation. They process the text to return a moderation result and do not use it to identify you.

If photos are sent with a private letter, each photo is sent to the same providers for an automated check before the letter is sent. A photo that is refused by that check is not stored by us.

For a FREE letter, a person also reviews it — the AI never publishes anything on its own.

For a PAID PRIVATE LETTER, the automated check is the only review. No member of our staff reads your letter in the ordinary course of running the service. We think that is the right way to treat private correspondence, and it is why the automated check exists at all.

There is one exception, and we would rather state it than let you assume otherwise: if someone reports a paid letter — because it targets them, or breaks the rules — we may read that letter in order to decide what to do about it.

Who processes your data

We do not sell your data, and we do not share it for advertising. We rely on a small number of service providers to run the service:

• Cloudflare — hosting, content delivery, database, file storage, the anti-bot check, and analytics.
• Google — the Gemini AI used to help moderate letter text and photos sent with a private letter, and Google Analytics for website measurement.
• OpenAI — used for the same automated moderation, as a fallback and, for free letters, as the primary check; and as an additional automated check of photos sent with a private letter.
• Meta — accepted letters may be published publicly on our Instagram, Threads, and Facebook accounts. This never applies to a paid private letter.
• QPay and your bank — donations and payments for private letters. We never see or store card or bank details.
• Amazon Web Services (through Ray) — delivering the emails we send you about a letter.

These providers operate globally, so your data may be processed on servers outside Mongolia.

Publication and visibility

Accepted letters are intentionally public. They may appear on this website’s letter feed — which can be searched by the recipient’s first name — on our social accounts, and in other editorial, research, promotional, print, commercial, or non-commercial material described in the Terms of Service.

This website asks search engines not to index it, so letters should not turn up in ordinary search results. Social platforms, however, are public, and anything public can be screenshotted or reshared by other people in ways we cannot control.

Your private link

After you submit a free letter, you receive a private link. It is the only way to check your letter’s status or to delete it. Anyone who has the link can delete the letter, so keep it to yourself. We cannot recover a lost link.

A paid private letter

A paid letter is not published anywhere. It has an unguessable address, and anyone holding that address can read it — that is how you give it to the person it is for. It is not listed in the archive, not posted to any social account, and search engines are asked not to index it.

We record when a paid letter was first opened and how many times it has been opened. We do not record who opened it, where from, or anything else about the reader.

A paid letter requires your email address. We store it encrypted, we never show it to anyone, and we use it only to send you the letter’s link and its deletion link. That deletion link is sent by email and shown nowhere else; if the address you gave was wrong, or you lose the email, we cannot send it again and cannot delete the letter on your behalf.

We keep that email address even after a letter is deleted. The name signed on a paid letter is not verified by anything, so the address and the payment behind a letter are the only record of who sent it — which is exactly what we need if someone later reports it.

Deleting your letter

You can delete your letter at any time using your private link. Deletion removes it from this website immediately.

If your letter had already been posted to a social account we control, we will remove that post on a best-effort basis — email hello@gege.mn if you need help. Deletion does not undo uses already made or committed to, or recall material already published, printed, distributed, cached, screenshotted, or reshared.

How long we keep it

We keep submitted letters indefinitely so that the archive keeps working and to help prevent abuse — unless you delete the service copy using your private link. A paid private letter is kept until you delete it with your deletion link, or we remove it; a paid letter you start and never pay for is deleted automatically after seven days. Photos sent with a private letter are kept with it; when that letter is deleted or removed its photos stop being shown immediately, and we may keep them afterwards in case the letter is reported. The browser cookie expires after one year. Salted IP and browser-identifier hashes associated with a submission may be retained after deletion to enforce limits and prevent abuse; we do not store either raw identifier in our database. The daily screen counts, the per-term search totals and the per-letter read totals are aggregates and are kept indefinitely.

Age

This service is not intended for anyone under 16. Please do not submit a letter if you are under 16. If we learn that a letter came from someone under 16, we will remove it on request.

Security

Letters are sent over an encrypted (HTTPS) connection, IP addresses and browser identifiers are stored in our database only as hashes, and access tokens for social platforms are encrypted at rest. No method of storage or transmission is ever perfectly secure, but we take reasonable measures to protect your information.

Your choices and requests

Because letters are anonymous and we hold no account tied to your identity, your private link is the fastest way to manage or delete your own letter. You can also email hello@gege.mn to ask what we hold about a letter, to correct it, or to have it removed.

Changes to this policy

We may update this policy from time to time. When we do, we change the date at the top, and we note any significant change on the site.

Contact

L’Atelier Gege LLC (Лателиэр Гэгэ ХХК), Mongolia. Email: hello@gege.mn.