Privacy notice

SealedIn is a trading name of Rabblepop Ltd, a company registered in England and Wales (company no. 17361712), registered office 320 Firecrest Court, Centre Park, Warrington, WA1 1RG. Rabblepop Ltd is the controller of the personal information described here.

Contact: support@sealedin.app

You need to give us your email address to have an account; without it we cannot provide the service.

Paying by card. When you pay for a Premium envelope by card, you pay on Stripe's payment page. We send Stripe your email address, a reference for your account and for the envelope, and what you are buying (a SealedIn Premium envelope, £4.99). We do not send the envelope's title or anything in it. Stripe collects your card details and any billing details its payment page asks for, such as the name on the card; we never see your card number. Stripe tells us whether the payment went through, the amount and currency, and its reference for the payment, and we keep those with the envelope's upgrade.

We do not look inside your envelopes. Letters, photos and videos are opened only by you and your recipients. Our own support tools show envelope details such as titles, dates, recipients, file names and sizes, never the contents. We do not analyse your content and we make no decisions about you by automated means.

You must be 18 or over to have a SealedIn account, which is what you need to send envelopes. When you join, we ask your date of birth to check this. If you are under 18, we do not open an account for you, and we delete the one you started. If an account already held envelopes, contacts, files or payments from before we began checking ages, we lock it instead, so that nothing in it is lost without warning, and close it when you ask us. If you are 18 or over, we keep only the fact that you confirmed it, and when, never your date of birth.

Anyone, of any age, can open an envelope sent to them. Children may receive envelopes, for example from a parent or grandparent. Opening one needs no account, and we never ask a recipient to make one or to tell us their age.

If someone has sent you an envelope, they gave us your email address and, if they chose, your name. We use them only to tell you about envelopes addressed to you and to let you open them, on the basis of legitimate interests: delivering what someone chose to send you. We record when an envelope was delivered and when you opened it, but we do not show the sender whether or when you opened it.

You do not need an account to open an envelope, and you do not have one with us unless you choose to make one (the sections above then apply to you too). To check it is you, we email a 6-digit code to the address the envelope was sent to. We keep the code only in a scrambled form that cannot be read back; it works for 10 minutes and we delete it within a day. To stop anyone flooding an inbox with codes, we count requests for codes for one hour, using a scrambled form of the requester's IP address and of the email address, and delete the count within a day; and we keep a note that a code was sent for an envelope (never the code itself) for up to two days, so that no more than 10 are sent for it in a day. Once you have entered the code, your browser keeps one cookie, sealedin_open, for 30 days, so that you can open that envelope again on the same device without a new code. If you are signed in to SealedIn with the address the envelope was sent to, it opens without a code.

We hold nothing else about you as a recipient: no profile, no age and no tracking. The page where you open an envelope has no analytics or advertising.

Once an envelope has been delivered to you, it stays yours to open even if the sender later closes their account, just as an email stays in your mailbox when its sender closes theirs. It shows the sender's name or email address as it did when it arrived. If you want an envelope you received deleted, email us at support@sealedin.app.

You can ask us to stop emailing you, or to delete your address, at any time. Every email we send a recipient says:

You're receiving this because [sender's name] sent you an envelope through SealedIn. How we use your email address: sealedin.app/privacy.

These providers process data for us under written terms. They may not use it for their own purposes, except that Stripe also uses payment information as a controller in its own right, for example to prevent fraud and to meet its legal duties, under its own privacy policy (stripe.com/privacy).

We also share information with our accountant and our accounting software (FreeAgent), which records the name on the card and the amount of each card payment, and, if needed, our insurers or legal advisers. We do not sell personal information.

Where your data goes. We use the providers listed above. Most store data in the UK or EU. Some, including Stripe, are based in the United States. Where your data leaves the UK, we rely on the safeguards the law allows: the UK–US data bridge where the provider is certified, or otherwise the UK's approved contract terms for international transfers.

To close your account, email us. We delete your account, your drafts, envelopes not yet delivered, and any files that are not part of an envelope you have delivered. Envelopes you have already delivered stay with the people you sent them to, with your name or email address as their sender, as described above: like an email, which stays in the recipient's mailbox when you close your email account. The only other things we keep are the records of your Premium purchases and credits described above (dates, amounts or credits, how you paid and Stripe's reference, with the account they belong to), until their 6 years are up. Stripe keeps its own record of a card payment under its own privacy policy.

We use only the cookies needed to sign you in, or to let you open an envelope sent to you: access_token and refresh_token, which keep you signed in for up to 400 days; auth_flow, which lasts five minutes while you sign in; and sealedin_open, which a recipient's browser keeps for 30 days after they enter a code, so that device can open that one envelope again without a new code. No analytics cookies.

You can ask us for a copy of your personal information, and ask us to correct it, delete it, restrict how we use it, or send it to you in a portable form. You can object at any time to anything we do on legitimate interests. Where we rely on consent, you can withdraw it at any time.

If you are a sender and ask us to delete your information, we delete it as described under How long we keep it, but we do not take back envelopes you have already delivered: your recipients' interest in keeping what you chose to send them outweighs it, as with a letter or an email. If you have a particular reason for wanting a delivered envelope withdrawn, tell us and we will consider it.

Email us at the address above. We reply within one month, and there is no charge.

If you are unhappy with how we have handled your information, please tell us first. You can also complain to the Information Commissioner's Office: ico.org.uk, or 0303 123 1113.

We will update the date at the top when this notice changes, and email account holders first if a change affects them significantly.