Last updated October 3, 2026.
This policy covers letterwp.com, buying LetterWP, and the LetterWP plugin. It’s run by Owldraft (“we”, “us”). Questions go to [email protected].
The short version
- The LetterWP plugin doesn’t send us your subscribers, your posts or your Resend key. Your list stays in your WordPress database.
- When you buy, Lemon Squeezy handles your payment. We see your name, email, country and order, never your card.
- This website uses Google Analytics to count visits. We don’t sell any data.
The LetterWP plugin
LetterWP runs on your WordPress site. Your subscribers, their topic choices and your email results are stored in your own database. Emails are sent through your own Resend account, which gets a copy of each active subscriber’s email address and name so it can deliver. Your Resend API key is stored on your site and sent only to Resend.
That makes you the controller of your readers’ data, and Resend your processor. We’re neither: we don’t receive it. If you collect subscribers, your own site’s privacy policy should say so, and name Resend.
LetterWP doesn’t track opens or clicks. Its subscriber sign-in sets a cookie on your site only after a reader signs in by email.
Buying LetterWP
Checkout is run by Lemon Squeezy, the merchant of record. They collect your payment details, billing address and tax information under their privacy policy. We receive your name, email address, country, what you bought and your order history, and use them to deliver the plugin, give support, handle refunds and email you about your plan.
This website
- Analytics. We use Google Analytics to see which pages people read and where they come from. It sets cookies and is loaded only after you interact with the page. Google’s use of this data is covered by Google’s privacy policy.
- Hosting and security. The site is hosted on Hetzner in the United States (Virginia) and served through Cloudflare. Like any web server, they log IP addresses and browser details to keep the site running and safe.
- Comments. If you comment on a post, we keep your name, email address, website, IP address and browser details, to show the comment and fight spam. Your email address is never shown. WordPress may check it against Gravatar to show your picture. If you tick the box, a cookie remembers your details for a year.
- Email. When you write to us, we keep the conversation so we can help you.
How long we keep it
Order records are kept as long as tax law requires. Support emails and comments are kept until you ask us to delete them. Analytics data is deleted on Google Analytics’ own schedule, after 14 months at most.
Your rights
You can ask for a copy of the data we hold about you, ask us to correct it, or ask us to delete it, unless we have to keep it by law. Email [email protected] and we’ll answer within 30 days. If you’re in the EU or UK, you can also complain to your data protection authority.
Changes
If this policy changes, the date at the top changes too.