valo.to is a place for letters, public walls and shared yearbooks. This policy explains how information is used across the website and its Android app.
Account information
When you sign in with Google, Google provides your account identifier, email address and basic profile information, such as your name and profile picture. Supabase processes this information to create your account and maintain your login session. Google sign-in does not request access to your Gmail messages, Google Drive files or contacts.
We also store the username, profile details and preferences you choose, along with your stamp collection and activity needed to operate the service.
Letters and yearbooks
We store submitted letters, replies, moderation results and yearbook entries, including uploaded photos. Public profiles and published wall messages can be viewed and copied by other people. Private messages and yearbooks use access controls; yearbook invitations should be shared only with intended participants.
Anonymous messages hide the sender's identity from the recipient. They are not a promise of anonymity from the service operator: technical records and a signed-in sender's account identifier may be stored for operation and abuse prevention. Do not put secrets or sensitive personal information in a message.
Account-delivered letters are linked to your account so you can read replies in My replies. Recipients do not see that account connection. If you move a conversation to a secret link, we remove it from your account list and replace its access key. Anyone holding the new link can access that conversation. This does not remove the recipient’s copy, published content, or technical records and backups. A lost secret link cannot be recovered. Guest senders can choose secret-link delivery from the start.
If you choose to sign in after writing, your browser saves the draft in session storage so you can return to it. Drafts older than 30 minutes are discarded when you revisit the writing page. It is cleared after a successful send.
Moderation and service providers
Messages may be sent to Google's Gemini service for automated safety checks. These requests include the message text and its selected writing prompt. AI decisions can be wrong. Flagged messages can be retained in the recipient's private area for review or deletion.
Vercel hosts the application. Supabase provides authentication, database and photo storage. Google provides sign-in and AI moderation. These providers process information to deliver their services, and processing may occur outside Bangladesh. Their own applicable terms and privacy policies also govern their handling of information.
Technical information
The service uses login cookies and preference storage. Network and browser information is used to create a hashed identifier for abuse prevention and sending limits. Hosting providers may also process request logs. The hash is not displayed to message recipients.
Sharing and deletion
When you export a story or share a message to another app, the content you choose leaves valo.to and is subject to that app's controls. Other people may retain screenshots or copies even after the original is deleted.
Available delete controls remove the corresponding records from the active database. Backups may retain information according to the provider's retention settings. Previously issued yearbook photo links may work for up to five minutes; removing an entry does not immediately erase every stored image copy. Stored uploads require separate cleanup.
For account deletion, access or correction requests, contact rajatraja1731@gmail.com from your account email. We may need to verify ownership before acting. You can revoke Google access in your Google Account settings; revoking access does not itself delete your valo.to account.
Contact and changes
Contact rajatraja1731@gmail.com with privacy questions. When this policy changes, we will update the published page and its revision date.