Privacy Policy — Pen-A-Pal

Last updated: May 2026

At Pen-A-Pal, I take your privacy seriously. This policy explains exactly what information I collect, why I collect it, and how I use it. I've kept it as simple and honest as possible. 🌸

🐝 The short version: I only collect what we need to send you letters. I don't sell your data. I don't share it with anyone except the services that help us run Pen-A-Pal. Your home address is only ever used to mail your letters.

1. Who I Am

Pen-A-Pal is a handwritten letter subscription service operated by Bee, based in Colorado, USA. If you have any questions about this privacy policy, you can contact me at penapalletters@gmail.com.

2. What Information I Collect

When you subscribe to Pen-A-Pal, we collect the following information:

Your name ; so I know who to address your letter to.
Your email address ; to send you order confirmations and important account updates.
Your mailing address ; so I can send your handwritten letter to you each month.
Payment information ; collected and stored securely by Stripe. Pen-A-Pal never sees or stores your full card number.

I may also collect information you voluntarily share with us, such as your interests or hobbies when filling out a subscriber profile, so I can personalise your letters.

3. How I Use Your Information

I use the information we collect only to run Pen-A-Pal. Specifically:

To write and send your monthly handwritten letter to your mailing address.
To process your subscription payment through Stripe.
To send you email confirmations, receipts, and important service updates.
To personalise your letters based on interests you've shared with us.
To respond to any questions or requests you send us.

I do not use your information for advertising. We do not sell your data. Ever.

4. Who I Share Your Information With

I only share your information with third-party services that are essential to running Pen-A-Pal:

Stripe ; my payment processor. Stripe securely handles all payment information. You can read Stripe's privacy policy at stripe.com/privacy.
Firebase (Google) ; my website hosting and database provider. Your blog interactions and account data may be stored here. You can read Google's privacy policy at policies.google.com/privacy.
Postal services ; your mailing address is printed on your envelope so it can be delivered to you. This is shared with the postal service (USPS or equivalent) in the normal course of mailing.

I do not share your information with any other third parties, advertisers, or data brokers.

5. Your Mailing Address

I take special care with your home address. Here's exactly how it's used:

Your address is used solely to mail your monthly letter.
It is never shared publicly or with anyone other than the postal service needed to deliver it.
If you cancel your subscription, I will no longer use your address.
You can request that we delete your address at any time by emailing us.

6. Cookies & Website Data

My website may use basic cookies and browser storage to help it function correctly. I do not use tracking cookies or third-party advertising cookies. Firebase, my hosting provider, may collect basic analytics data such as page views. This data is anonymous and not linked to your personal information.

7. Children's Privacy

Pen-A-Pal is a service designed for all ages, including children and teens. I am especially mindful of the privacy of younger subscribers. I:

Only collect information that is necessary to provide the service.
Never share children's personal information with third parties beyond those listed in Section 4.
Encourage parents and guardians to subscribe on behalf of children under 13.
Never use children's information for marketing or advertising purposes.

8. Your Rights

You have the right to:

Ask me what personal information we hold about you.
Ask me to correct any inaccurate information.
Ask me to delete your personal information at any time.
Unsubscribe from any emails I send you.
Cancel your subscription at any time.

To exercise any of these rights, simply email me at penapalletters@gmail.com and I'll take care of it promptly.

9. Data Security

I take reasonable steps to protect your personal information. Payments are handled entirely by Stripe, which is PCI-DSS compliant — the gold standard for payment security. My website is hosted on Firebase, which uses industry-standard security practices. I do not store payment card details ourselves.

10. Changes to This Policy

I may update this Privacy Policy from time to time. When I do, we'll update the "Last updated" date at the top of this page. I'll also notify active subscribers of any significant changes by email.

Questions about your privacy? Please reach out — I'm happy to answer anything. Email me at penapalletters@gmail.com and I'll get back to you as soon as we can. 🐝🌸