Privacy policy
Merrylet is an app for sending a little something to someone: a card that opens, unfolds and plays. To do that we need to know a few things about you and about the people you send to. This page says what those things are, in plain words.
Who we are
Merrylet is made by Greetings Island Ltd, Hanagar 24, Hod Hasharon, Israel (“we”). For anything about your data, write to privacy@merrylet.com.
What we collect
- Your account. Your email address, and the name you want your cards signed with. If you sign in with Apple or Google, we receive the email (or Apple's private relay address) and, the first time, your name. We never see a password: sign-in is by email link, Apple or Google.
- Your people. The names, email addresses and occasion dates you add. You add people one at a time, by hand or by picking one from your phone's contacts. We never read or upload your whole address book.
- Your cards. The words you write on a card, who it is for, when you scheduled it, and how it was sent (email, link, WhatsApp, Facebook).
- Opens. Every card has its own link. When a link is opened we record the time and the browser type, so we can tell you your card was opened. Your own opens are not counted. We do not store the recipient's IP address.
- Purchases. If you buy Unlimited, the purchase is handled by Apple, Google or Paddle. We receive a confirmation and a subscription status, never your card number.
- Usage. Which screens are used and which cards are sent, so we can make the app better. Once you sign in, these events carry your account number, never your name, your email or anything you write on a card. This is analytics about the product, not a profile of you for advertising. We do not sell data and we do not show ads.
What we do with it
- Send your cards, and tell you when they were opened.
- Remind you about the dates you asked to be reminded about.
- Keep your account working across your devices.
- Answer you when you write to us.
- Keep the service safe: rate limits, abuse prevention, and the law when it applies.
We only ever email you what you asked for: sign-in links, the cards you send, receipts, reminders you turned on, and replies to your messages. There is no newsletter unless you sign up for one separately.
The people you send to
When you send a card by email, we send one email to that address on your behalf, from a Merrylet address, with your name and words in it. Your email address goes in as the reply-to so they can answer you. We keep the recipient's address in your people so you can send to them again; they can ask us to remove it at any time. Please only send cards to people you know.
Who else sees it
Only the companies that run the service for us, each bound to use the data only to provide it:
- Google Firebase for sign-in.
- Neon and Vercel for the database and the servers.
- Resend for sending email.
- Apple, Google and Paddle for purchases.
- Heap for product analytics.
- RevenueCat for subscription status.
If you share a card by WhatsApp or Facebook, that share happens in their app under their terms; we only give you the link.
How long we keep it
For as long as you have an account. Delete your account and we delete your people, your cards and your sends within 30 days; card links stop working. Receipts stay as long as tax law requires. Analytics linked to your account number are deleted on request.
Your rights
You can see, correct, export or delete everything we hold about you. Most of it is right there in the app. For the rest, write to privacy@merrylet.com and we answer within 30 days. If you live in the EU or UK you also have the right to complain to your data protection authority; we would rather you wrote to us first.
Children
Merrylet is for people aged 13 and over. We do not knowingly collect data from children. If you think a child has an account, tell us and we will remove it.
Changes
If this page changes in a way that matters, we tell you in the app before it takes effect. The date at the top is always the date of the current version.
Governing law: Israel.