Privacy policy
Merrylet is an app for sending a little something to someone: a card that opens, unfolds and plays. To do that we need to know a few things about you and about the people you send to. This page says what those things are, in plain words.
Who we are
Merrylet is made by Greetings Island Ltd, Hanagar 24, Hod Hasharon, Israel (“we”). For anything about your data, write to hello@merrylet.com.
What we collect
- Your account. Your email address, and the name you want your cards signed with. If you sign in with Apple or Google, we receive the email (or Apple's private relay address) and, the first time, your name. We never see a password: sign-in is by email link, Apple or Google.
- Your people. The names, email addresses and occasion dates you add. You add people one at a time, by hand or by picking one from your phone's contacts. We never read or upload your whole address book.
- Your cards. The words you write on a card, who it is for, when you scheduled it, and how it was sent (email, link, WhatsApp, Facebook).
- Opens. Every card has its own link. When a link is opened we record the time and the browser type, so we can tell you your card was opened. Previews you open from your Sent list are not counted. We do not store the recipient's IP address.
- Notifications. If you allow notifications, we keep your phone's push address (a token from Apple or Google, through Expo) so we can tell you a card was opened or a birthday is coming. We also keep your time zone, so reminders arrive at 9am where you are. Turn notifications off on the Me screen or in your phone's settings, and signing out or deleting your account removes the token.
- Purchases. If you buy Unlimited, the purchase is handled by Apple, Google or Paddle. We receive a confirmation and a subscription status, never your card number.
- Usage. Which screens are used and which cards are sent, so we can make the app better. Once you sign in, these events carry your account number, never your name, your email or anything you write on a card. This is analytics about the product, not a profile of you for advertising. We do not sell data and we do not show ads.
What we do with it
- Send your cards, and tell you when they were opened.
- Remind you about the dates you asked to be reminded about.
- Keep your account working across your devices.
- Answer you when you write to us.
- Keep the service safe: rate limits, abuse prevention, and the law when it applies.
We only ever email you what you asked for: sign-in links, the cards you send, receipts, reminders you turned on, and replies to your messages. There is no newsletter unless you sign up for one separately.
The people you send to
When you send a card by email, we send one email to that address on your behalf, from a Merrylet address, with your name and words in it. Your email address goes in as the reply-to so they can answer you. We keep the recipient's address in your people so you can send to them again; they can ask us to remove it at any time. Please only send cards to people you know.
Who else sees it
Only the companies that run the service for us, each bound to use the data only to provide it:
- Google Firebase for sign-in.
- Neon and Vercel for the database and the servers.
- Postmark (and Resend as a backup) for sending email.
- Apple, Google and Paddle for purchases.
- Heap for product analytics.
- Anthropic, only when you tap Help me write this: the words on the card and the occasion, to suggest a message. Anthropic does not use them to train its models.
- AppsFlyer to measure which campaign brought the app to your phone (install attribution). It receives the install, a few milestones (signing up, a first card, starting a subscription) and your account number - never your name, email or what you write. On iPhone it gets an app-specific device ID, not the advertising ID: the app never asks to track you, and attribution relies on Apple's privacy-preserving SKAdNetwork. On Android it also receives Google's advertising ID, which you can reset or delete at any time in your phone's settings (Privacy, then Ads).
- RevenueCat for subscription status.
- Replicate, only when you make a photo card: the photo you choose is sent to Replicate, our image service, to paint the character; the painted character is stored so the card can show it.
If you share a card by WhatsApp or Facebook, that share happens in their app under their terms; we only give you the link.
How long we keep it
For as long as you have an account. Delete your account and we delete your people, your cards and your sends within 30 days; card links stop working. We keep your email address on a list of addresses that have had their free card, so it can only be claimed once. Receipts stay as long as tax law requires. Analytics linked to your account number are deleted on request.
Your rights
You can see, correct, export or delete everything we hold about you. Most of it is right there in the app. For the rest, write to hello@merrylet.com and we answer within 30 days. If you live in the EU or UK you also have the right to complain to your data protection authority; we would rather you wrote to us first.
Children
Merrylet is for people aged 13 and over. We do not knowingly collect data from children. If you think a child has an account, tell us and we will remove it.
Changes
If this page changes in a way that matters, we tell you in the app before it takes effect. The date at the top is always the date of the current version.
Governing law: Israel.