Policy version 2026-08-27. These documents are implementation-ready templates, not legal advice. Qualified Illinois counsel should review them before launch.

Privacy Policy

Who we are

This service is operated by [Operator name — configure in Pen Pals settings]. You can reach us by mail at [Mailing address — configure in Pen Pals settings] or by e-mail at [Contact e-mail — configure in Pen Pals settings].

Account and profile information

When you register we collect your display name, account e-mail address, and a five-digit U.S. ZIP Code. Your ZIP Code is stored privately and is never shown to other members; they see only your city, state, and an approximate distance. Your biography and interests are shown to other members as you configure them.

ZIP centroid lookup

When you save a ZIP Code we look up its geographic centroid from the public zippopotam.us service (the only external service this software calls, over HTTPS) and cache that public centroid for 30 days. The cache stores the centroid coordinates, city, state abbreviation, and country — enough to show other members a general location and an approximate distance. Only your full ZIP stays private to you.

Birth dates

You are asked for a date of birth during registration solely to confirm you were at least 18 years old on the registration date. We do not store your birth date anywhere — not in the database, logs, e-mails, or account metadata. We record only the date your adult status was verified and your adult certification.

Verification and legal records

We record: an e-mail verification timestamp (the verification token itself is stored only as an HMAC-SHA-256 hash and is deleted after successful verification), your adult certification, and the version of each legal document you accepted together with the acceptance timestamps (current version: 2026-08-27).

Letters

Letters you send and receive are stored on our servers — subject, body, sender, recipient, distance, and delivery timestamps — so the mailbox works. Letter bodies are not exposed to the recipient before their simulated delivery time. Administrators do not have a general interface for browsing all private letters; letter content is visible in the moderation queue only when a letter is reported or held for first-letter moderation.

Transactional e-mail

We send you only transactional e-mail: verification links, arrival notices for your mailbox, and administrative messages about your account. These messages are not promotional. You can ask [Contact e-mail — configure in Pen Pals settings] to stop non-essential transactional mail at any time.

Retention and deletion

Registrations that never complete e-mail verification are removed automatically after the retention window configured by the operator. You may export or erase your personal data at any time through the standard WordPress privacy tools (Tools → Export / Erase Personal Data, or by contacting [Contact e-mail — configure in Pen Pals settings]). Erasure removes your profile, connections, blocks, letters, and all plug-in metadata. By default, plug-in data is preserved on uninstall; the operator must explicitly enable "erase data on uninstall."

Security limitations

Letters are stored on our servers and are protected by WordPress access controls and moderation. Letters are not end-to-end encrypted. No identity check or background check of any member has been performed. E-mail verification confirms control of an inbox, not identity.

Sale of personal information

We do not sell personal information. This statement reflects how the software actually behaves today; it would change only if the implementation changed.

Your rights and how to contact us

You can access, correct, export, or erase your personal data through your profile and the WordPress privacy tools, or by contacting [Contact e-mail — configure in Pen Pals settings]. We respond to verified requests within the timeframes required by applicable law (including the Illinois Personal Information Protection Act). We do not sell your personal information.