Privacy Policy

Controller

What this is about

Sealed lets you write a letter to your future self, delivered by email at a time you choose — freely through this website or as part of an event (e.g. a workshop or conference). We process as little data as possible: no tracking, no analytics, no advertising, no selling of data.

Hosting & server logs

Sealed runs at domainfactory GmbH (Ismaning, Germany). When you visit the website, the hosting provider processes technically necessary server log data (e.g. IP address, time, page requested) to provide and secure the service (Art. 6(1)(f) GDPR).

Your letters

When you write a letter, we store: the letter’s content, your email address, the delivery date(s) and optional attachments (images, video, audio). The sole purpose is delivering the letter to you at the chosen time (Art. 6(1)(b) GDPR).

• Double opt-in: When writing freely (outside an event), your letter is only sealed after you confirm your email address. Unconfirmed letters are deleted automatically after 72 hours.
• Encryption & retention: Letter contents are stored encrypted and deleted from the server upon delivery. Attachments are deleted 30 days after delivery. After that, only anonymous counts remain (e.g. “1 letter delivered”).
• Unsubscribe: Every email contains an unsubscribe link that deletes all pending letters addressed to you.

Letters written at events

If you write through an event (QR code or event link), the event’s host sees only aggregate figures: number of letters, delivery status and month of scheduled delivery. The content of your letter is never visible to hosts. If delivery fails permanently, the host can see the affected email address in order to fix delivery.

Host accounts

Anyone creating events signs in via a magic link (no password). We store the email address, short-lived sign-in links (valid 15 minutes, single use) and sessions (max. 90 days, at most two devices at a time). Legal basis: Art. 6(1)(b) GDPR.

Email delivery

Confirmation and letter emails are sent through our hosting provider’s mail servers. Your data is not shared with third parties and never used for advertising.

Cookies & local storage

Sealed sets no tracking cookies. There is exactly one functional session cookie (fm_sess), set only after signing in as a host. Your language choice is stored locally in your browser (localStorage) and never transmitted to us.

Your rights

You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR). Simply contact sealed@quaquebeke.de. You may also lodge a complaint with a data protection supervisory authority.

Status & changes

Last updated: 10 November 2026. As the service evolves (e.g. when paid plans launch), this policy will be updated.