Privacy Policy

MagicWritesBack is built for parents and guardians. We collect as little as we can, and we don’t keep your child’s letters. This policy explains what we handle and why. It is written with Singapore’s Personal Data Protection Act (PDPA) in mind.

Who we are

MagicWritesBack ([legal entity name to be confirmed]), based in Singapore. Contact: hello@magicwritesback.com.

Who can use MagicWritesBack

MagicWritesBack is used by a parent or guardian aged 18 or over. Children don’t use the site, have accounts, or type anything into it. You confirm you are the child’s parent or guardian before you start.

What we handle

Your child’s first name and age, and your Santa settings

You enter these so Santa can write a suitable letter. They are kept in your browser on your device, not in a database on our servers, so you can come back later to finish a letter. They are deleted automatically after [retention period to be confirmed], or straight away when you choose “Forget this child on this device”. They are sent to our servers only while a letter is being prepared.

The photo of the letter

When you post a letter, the photo is sent to our servers. Your browser shrinks it and removes hidden information such as location data first. Our servers process it in memory only, send it to our AI provider to read the letter, and then discard it. We do not store the photo.

What the letter says, and Santa’s reply

We show you what we read in the letter and Santa’s draft reply so you can check and approve them. This text is kept in your browser, not on our servers. If you choose to deliver a reply later (for example, the next morning), the approved reply is kept on your device until then.

Your email address (only if you join the waitlist)

If you ask to hear when real mailed letters are available, we keep your email address, the date you joined, and whether you agreed to receive that email. We never ask for your child’s details on the waitlist.

Technical information

To stop misuse, we count how many letters are sent from each internet connection. We keep a scrambled (hashed) form of your IP address for up to [24 hours, to be confirmed] for this. We use privacy-friendly, cookie-free analytics that count events (such as “a letter was approved”) without names, letter text, replies or photos.

What we never ask for

Your child’s surname, address, school, birthday, phone number, or photos of your child. Please don’t include these in a letter. If a photo shows people rather than a letter, we won’t process it.

AI processing

To read the letter and prepare a reply, we send the photo and your child’s first name, age and Santa settings to our AI provider, [provider name to be confirmed before launch]. We use the provider’s paid service, under terms that [do not allow our data to be used to train its models — to be confirmed]. Our provider may process data outside Singapore.

MagicWritesBack never uses your child’s letters for advertising or to train AI models. We would only ever use a letter publicly with your separate, explicit permission for that letter.

Who else handles data for us

• Our AI provider (above), to read letters and prepare replies.
• Vercel, which hosts the website. Our servers run in Singapore, but Vercel is a US company.
• Upstash, which stores the waitlist and the short-lived misuse counters.
• Vercel Web Analytics, for cookie-free page and event counts.

We don’t sell personal data, and we don’t show ads.

How long we keep things

• Letter photos: not stored; discarded once the letter has been read.
• Letter text and replies: not stored on our servers.
• Your child’s first name, age and settings: on your device only, for up to [retention period].
• Waitlist email: until you ask us to remove it, or the waitlist closes.
• Misuse counters: up to [24 hours].

Your choices and rights

You can ask to see, correct or delete personal data we hold about you, or withdraw your consent, by emailing hello@magicwritesback.com. Data on your device can be cleared at any time with “Forget this child on this device” or by clearing your browser’s site data.

Safety

If a letter mentions something that may need a grown-up’s attention, Santa won’t reply, and we show you what the letter said privately. We don’t report letters to anyone automatically. [Reporting obligations for illegal content to be confirmed by legal review.]

Changes

If we change this policy, we’ll update the date at the top. See also our Terms.