WE COLLECT WHAT WE NEED. NOTHING ELSE.

What we collect

Your email. Your shipping address. The handwriting image or typed message you uploaded for your slab. If it is a gift, the recipient email and gift message.

That is the list. We do not ask for your phone, your birthday, or anything else.

What we do not collect

Card numbers. Those go straight to Stripe. We never see them. We never store them. We get a Stripe customer ID and an order amount, and that is enough.

Analytics

We use PostHog to see which pages people land on and which steps of the buy flow are working. Pure usage signals. We mask all form inputs in session recordings so we never replay your email or your handwriting.

Analytics is opt-in. On your first visit we ask. If you click "No thanks" we never load PostHog on your browser.

We do not sell your data

Not to advertisers. Not to data brokers. Not to anyone. The only third parties that touch your order data are Stripe (payment), Supabase (database), Cloudflare (hosting), USPS (shipping), and Resend (transactional email). Each of them sees only the slice they need.

Email handling

We email you about the order you bought. Order confirmation, "your label was printed", "your slab shipped", "your slab was delivered". That is it. No newsletter, no upsell drip.

If you opted into the recipient gift email, the recipient gets one email letting them know a Thudletter is on the way.

Cookies

We use a small handful of cookies and localStorage entries. Session cookie so checkout works. A "consent" flag so we know whether to load analytics. A "saved recipients" list so power users do not retype the same address every time. No tracking cookies for advertising.

How to delete your data

Email hello@thudletter.com from the address you bought with. We delete your order history, uploaded handwriting, and any saved address within 7 days. Some records (tax, payment) we keep for as long as required by applicable tax and financial recordkeeping law.

Your rights (California and other states)

Depending on where you live, privacy laws like the CCPA give you specific rights over your personal information. Wherever you are, we extend these to everyone:

The right to know and access: ask us what personal information we hold about you and get a copy of it.

The right to delete: ask us to delete your personal information, subject to the recordkeeping law noted above.

The right to opt out of sale or sharing: there is nothing to opt out of, because we do not sell your personal information. Not to advertisers, not to data brokers, not to anyone.

To exercise any of these, email hello@thudletter.com from the address you bought with. The data controller responsible for your information is J&J Dynamic Holdings, LLC.

Contact

Questions about this policy: hello@thudletter.com. Real human reply within 24 hours weekdays. /support works too.

Last updated: May 22, 2026.