Privacy Policy

Who we are

The service is operated by L’Atelier Gege LLC (Лателиэр Гэгэ ХХК), a company registered in Mongolia. For anything in this policy — questions, corrections, or deletion — email hello@gege.mn.

What we collect

The letter you submit. That means the recipient’s first name, the text of your letter, and the design you choose. You are writing this so that it can be published, so please treat everything in a letter as public from the moment you send it.

An email address — only if you choose to receive the review result and, if the letter is published, links to it. It is optional and is not used for marketing.

For a paid private letter we also store the name you sign it with, the number of pages, and any photos you attach (one to three). Before a photo is stored we strip the information a camera or phone embeds in the file, such as where and when it was taken. We keep a record of each payment made towards a letter: the invoice reference from our payment provider and the amount, including a payment that did not cover the letter’s price, which is recorded and resolved with the writer. We never see or store card or bank details.

Technical information needed to run the service safely, and to measure how it is used:

• A one-way, salted hash of your IP address. We never store your raw IP address. The hash is used only to rate-limit submissions and to help prevent abuse.
• A random browser identifier in an essential first-party cookie. Your browser sends it when you submit a letter; we store only a one-way, salted hash with the letter so we can enforce the limit of three submissions per browser in a rolling 24-hour period.
• A one-way hash of the letter’s text, used to catch duplicate or spam resubmissions.
• Ordinary server logs kept by our hosting provider.
• A count of the writing-flow screens people reach — the name of the screen and nothing else, added to that day’s total. It carries no identifier, so it cannot be tied to you or to one visit. Where Google Analytics is loaded, the same screen name is also sent to it as an event.
• A running total for each term searched in the public letter feed: how many times it has been looked up, and how many of those found a letter. The total belongs to the term, not to the person who searched.
• A running total for each published letter of how many times its own page has been opened. The total belongs to the letter, not to the person who opened it; nothing in it identifies a browser or a visit.

We do not collect accounts or passwords, your precise location, or advertising identifiers, and we run no advertising. We build no profile of you ourselves. Google Analytics, described in the next section, is Google’s product, and Google handles what it collects under its own privacy policy.

Cookies and analytics

We run no advertising and we set no advertising cookies. The cookies here do two jobs: running the service, and measuring it.

We set a small number of essential first-party cookies: `last_letter_device` (submission limit, one year), `seal_draft` (lets your browser return to a private letter you are writing or paying for, seven days), `last_letter_donation` (returns you to a payment in progress, thirty minutes) and `seal_invite_author` (on an invitation link, up to seven days). `last_letter_device` and `seal_invite_author` are not available to page scripts. `seal_draft` and `last_letter_donation` can be read by this site’s own page scripts, which is how the page finds its way back. None of them is used to follow you across sites.

We use Cloudflare Web Analytics, which is cookieless and reports only aggregate page-view counts — it sets nothing on your device and does not follow you across other sites.

We also use Google Analytics to understand how many people visit and which pages they use. It is a Google product: it sets its own first-party cookies (`_ga` and `_ga_<id>`) so that it can recognise a returning browser, and what it measures is sent to Google, which handles that data under its own privacy policy. If you would rather not be counted, you can block or delete cookies in your browser settings, or install Google’s opt-out add-on from tools.google.com/dlpage/gaoptout. We deliberately leave Google Analytics off the private page your letter link opens, so that link is never reported to Google.

We count three more things ourselves, on our own servers, with no identifier of any kind. The first is the writing flow: as you move through it, your browser reports the name of the screen it reached — that you got as far as picking a design, for example — and we add one to that day’s total. The report is the screen name and nothing else: no identifier, no page address, no IP address. It tells us how many people reached a step, never which people. Where Google Analytics is loaded, the same screen name is also sent to it as an event.

The second is search. When you look up a first name or a hashtag in the public letter feed, we keep a running total for that search term: how many times it has been looked up, how many of those found a letter, and how many the most recent lookup found. The total is stored against the term, not against you, and nothing in it points back to whoever typed it. We keep it because a name people search for and never find tells us that a letter someone wants does not exist yet.

The third is reading. When a letter’s own page is opened, we add one to that letter’s total. Your browser sends the letter’s public id and nothing else — no identifier, no page address, no IP address — and sends it at most once per letter per visit. The total is stored against the letter, not against you. It tells us which letters are read and which never are, never who read them.

The anti-bot check (Cloudflare Turnstile), which runs on the submission form and on the review and photo steps of a private letter, may set a temporary token to confirm you are a person. It is not used to track you.

How we use your information

• To review, edit, adapt, translate, publish, distribute, promote, archive, and otherwise use your letter as described in the Terms of Service, including for lawful editorial, research, commercial, or non-commercial purposes.
• To prevent spam, abuse, and duplicate submissions, and to apply rate limits.
• To email you the review result and, if your letter is published, links to it, when you ask for those updates.
• To operate, secure, and maintain the service.

Automated review (AI)

To help screen letters, their text may be sent to an AI provider for automated moderation. The text of a free letter, when it is checked this way, goes to OpenAI’s API first, with Google’s Gemini API as a fallback if OpenAI does not answer. The text of a paid private letter goes to Google’s Gemini API only. They process the text to return a moderation result and do not use it to identify you.

If you attach photos to a private letter, each photo is sent to Google’s Gemini API and, as a second opinion, to OpenAI’s moderation API, for an automated check at the moment you choose it — always before any payment is asked for. That means a photo you choose is sent to them even if you later remove it or never pay for the letter. The photo check looks at the photo alone; it is not given the words of your letter. A photo that is refused is not stored by us anywhere. What we may keep of a check, passed or refused, is a record of it: the size and dimensions of the file, a one-way hash of it, the result and the reason, which models answered and any score they gave, and for a refused photo the checking model’s own short note on why. That record cannot be turned back into the picture.

For a FREE letter, a person also reviews it — the AI never publishes anything on its own.

For a PAID PRIVATE LETTER, the automated check is the only review. No member of our staff reads your letter or looks at its photos in the ordinary course of running the service. We think that is the right way to treat private correspondence, and it is why the automated check exists at all. A letter written through an invitation link is different: its text is not checked at all, and only its photos are checked automatically.

There is one exception, and we would rather state it than let you assume otherwise: if someone reports a paid letter — because it targets them, shows them in a photo, or breaks the rules — we may read that letter and look at its photos in order to decide what to do about it. Each time an operator opens a letter in our admin panel it is logged.

Who processes your data

We do not sell your data, and we do not share it for advertising. We rely on a small number of service providers to run the service:

• Cloudflare — hosting, content delivery, database, file storage, the anti-bot check, and analytics.
• Google — the Gemini AI used to check the text of a paid private letter and the photos attached to one, including photos chosen for a letter that is never paid for, and as the fallback check of a free letter’s text; and Google Analytics for website measurement.
• OpenAI — the primary automated check of a free letter’s text, and a second-opinion automated check of photos attached to a private letter, paid for or not. The text of a paid private letter is not sent to OpenAI.
• Meta — accepted letters may be published publicly on our Instagram, Threads, and Facebook accounts. This never applies to a paid private letter.
• Bogts, QPay and your bank — donations and payments for private letters. Payments are created through our payment gateway (Bogts), which passes the amount and a short description of the purchase to QPay. Neither receives your letter, the names on it or your photos. We never see or store card or bank details.
• Amazon Web Services (through Ray) — delivering the emails we send you about a letter. The email for a private letter carries your email address, the recipient’s name as you typed it, the letter’s link and its deletion link.

These providers operate globally, so your data — including the text of a letter and any photos attached to it, and so the image of anyone pictured in them — may be processed on servers outside Mongolia. By attaching a photo you agree to it being sent to the providers named above for that check.

Publication and visibility

Accepted letters are intentionally public. They may appear on this website’s letter feed — which can be searched by the recipient’s first name — on our social accounts, and in other editorial, research, promotional, print, commercial, or non-commercial material described in the Terms of Service.

This website asks search engines not to index it, so letters should not turn up in ordinary search results. Social platforms, however, are public, and anything public can be screenshotted or reshared by other people in ways we cannot control.

Your private link

After you submit a free letter, you receive a private link. It is the only way to check your letter’s status or to delete it. Anyone who has the link can delete the letter, so keep it to yourself. We cannot recover a lost link.

A paid private letter

A paid letter is not published anywhere. It has an unguessable address, and anyone holding that address can read it — that is how you give it to the person it is for. It is not listed in the archive, not posted to any social account, and search engines are asked not to index it.

We record when a paid letter was first opened and how many times it has been opened. We do not record who opened it, where from, or anything else about the reader. The sender can see, on the deletion page, when the letter was first opened.

Photos attached to a paid letter are exactly as private as the letter. They are shown only from under the letter’s own address, to whoever holds it, to the browser that wrote the letter, and to an operator handling a report. Whoever holds that address can save or screenshot them, and we cannot control what happens to a copy after that.

A paid letter requires your email address. We store it encrypted, we never show it to anyone, and we use it to send you the letter’s link and its deletion link; we also keep it so that the sender can be identified if the letter is reported. That deletion link is sent by email and shown nowhere else. If you lose the email, we can send the links again only to the address you first gave, never to another one; if that address was wrong, we cannot send them anywhere else. You can email hello@gege.mn to have the letter taken down.

We keep that email address even after a letter is deleted. The name signed on a paid letter is not verified by anything, so the address and the payment behind a letter are the only record of who sent it — which is exactly what we need if someone later reports it.

Deleting your letter

You can delete your letter at any time using your private link. Deletion removes it from this website immediately.

If your letter had already been posted to a social account we control, we will remove that post on a best-effort basis — email hello@gege.mn if you need help. Deletion does not undo uses already made or committed to, or recall material already published, printed, distributed, cached, screenshotted, or reshared.

How long we keep it

We keep submitted letters indefinitely so that the archive keeps working and to help prevent abuse — unless you delete the service copy using your private link. A paid private letter and its photos are shown until you delete the letter with your deletion link, or we remove it. From that moment neither the letter nor its photos can be opened by anyone holding the link, and we may keep both afterwards in case the letter is reported. A private letter you start and never pay for is deleted automatically once it has gone seven days untouched, together with any photos you added to it. A letter that any payment was made towards is not deleted automatically, even if the payment was short of its price. The `last_letter_device` cookie expires after one year. Salted IP and browser-identifier hashes associated with a submission may be retained after deletion to enforce limits and prevent abuse; we do not store either raw identifier in our database. The daily screen counts, the per-term search totals and the per-letter read totals are aggregates and are kept indefinitely.

Age

This service is not intended for anyone under 16. Please do not submit a letter if you are under 16. If we learn that a letter came from someone under 16, we will remove it on request. A photo attached to a private letter may show a child; the person sending it must be 16 or older. If you are the parent or guardian of a child shown in a photo sent through this service and want it removed, email hello@gege.mn.

Security

Letters are sent over an encrypted (HTTPS) connection, IP addresses and browser identifiers are stored in our database only as hashes, and access tokens for social platforms are encrypted at rest. No method of storage or transmission is ever perfectly secure, but we take reasonable measures to protect your information.

Your choices and requests

Because letters are anonymous and we hold no account tied to your identity, your private link is the fastest way to manage or delete your own letter. You can also email hello@gege.mn to ask what we hold about a letter, to correct it, or to have it removed. If you appear in a photo sent with a private letter and did not agree to it, use the report link on the letter’s page or email us; you do not need to be the sender or the recipient.

Changes to this policy

We may update this policy from time to time. When we do, we change the date at the top, and we note any significant change on the site.

Contact

L’Atelier Gege LLC (Лателиэр Гэгэ ХХК), Mongolia. Email: hello@gege.mn.