Privacy

Last updated: 14 October 2026.

Who we are

tostranger.com is operated by Andriichuk OÜ, Estonia (the data controller). Questions and requests: hello@tostranger.com.

What we collect and why

• Your letter and the country and city you choose. We need them to deliver your letter to a stranger and draw it on the map. Letters are anonymous: no name or account is needed, and letters with contact details are rejected.
• Your approximate location. We look up a country from your IP address on our own server to preselect it in the form. Only the city-level point is stored, never your exact location.
• A salted hash of your IP address, stored with letters and reports, to enforce rate limits and stop abuse. We do not store raw IP addresses.
• Two cookies. ts_device is a random identifier used for rate limits and abuse protection. ts_env remembers the secret link to your envelope so you can come back to it. Both are strictly necessary for the service and are not used for advertising.
• Your consent choice for the public archive and the Edition 2026 book. The box is unchecked by default; only letters whose authors checked it may be included.

The legal basis is our legitimate interest in running the service and keeping it safe (GDPR Art. 6(1)(f)), and your consent for the book (Art. 6(1)(a)), which you can withdraw at any time.

Who else processes data

• Anthropic (USA) checks the text of new letters for abuse. Only the letter text is sent, without your IP address or identifiers.
• Cloudflare Turnstile (USA) checks that a letter is sent by a person, not a bot. Cloudflare sees your IP address and browser data during the check.
• Matomo analytics, self-hosted by us, counts page views without cookies. Your secret envelope link is masked before it is recorded.

Transfers to the USA rely on the EU Standard Contractual Clauses or the EU–US Data Privacy Framework.

How long we keep it

Letters are kept for the life of the capsule and its archive. You can withdraw your letter at any time from your envelope page; its text is erased immediately. Letters rejected by moderation are not published.

Your rights

You can ask for access to, correction or erasure of your data, restrict or object to processing, and withdraw consent. Because letters are anonymous, include your envelope link so we can find your data. You can also complain to the Estonian Data Protection Inspectorate (aki.ee) or the authority in your country.