Privacy

Updated 3 November 2026

Runewing lets you send a letter with a seal, a courier and opening rules. We keep as little as we can and explain everything below. Questions, complaints and data requests: abuse [at] runewing.com.

Who runs Runewing

Runewing is run by a sole trader registered in Poland, who is the controller of the personal data described on this page under the GDPR: Oleh Kosarenko, Polska. Contact: abuse [at] runewing.com.

What we store when you send a letter

• The letter text, encrypted (AES-256-GCM). It is decrypted only to show it to the recipient after the opening rules are met, or when we review a complaint.
• The names you typed in “From” and “To”, the seal, courier, opening rule and riddle question. The riddle answer is stored only as a hash.
• Your IP address and browser identifier (user agent). We keep them for 90 days after you send a letter, rune card, whisper, wall post or comment, only to handle complaints and lawful requests from authorities. Recipients and other users never see them, and we don’t use them for analytics or advertising. If something you posted is reported, we keep them until the report is resolved (up to 90 days after the report). Every time a moderator views an IP address, it is logged.
• A hash of your device identifier from the rw_d cookie (see below), for the same purposes and for spam protection.
• The version of the Rules and Privacy notice you accepted with the consent box, and when you ticked it.
• A log of what happened to the letter (created, courier summoned, opened, reported), without the text.

Letters that burn after reading

After a one-time letter is read, nobody can open it again: not the recipient, not the sender. To be able to act on threats, we keep the encrypted text for 30 days for complaint review only, then erase it.

How long we keep data

• A letter sent without signing in is deleted when it expires: a year after sending, or 30 days after its opening date if that is later.
• From 18 November 2026, a letter sent while signed in is kept as long as your account exists, so it stays in your Letters page. In Settings you can choose “Delete a year after sending” instead; then the rule above applies, also to letters already sent. When you delete your account, the letters sent from it stop opening at once and are deleted within a day.
• From 18 November 2026, an account with no sign-in for 2 years is deleted together with the letters sent from it. 30 days before that we send an email to the account’s address; signing in keeps the account. If the email can’t be sent, we don’t delete the account.
• A sample letter from the home page (“Open an example as the recipient”) is deleted 30 days after it is created.
• A reported letter is sealed at once and deleted 30 days later, unless the review shows it breaks no rules.
• The author’s IP address, browser and device identifiers are deleted 90 days after sending, or earlier together with the letter.
• Spam protection records (below) expire on their own within 30 days.
• An email address left for a reminder is deleted as soon as the reminder is sent; its hash is kept for 30 days.
• A report sent through the report form is deleted 90 days after it is sent.
• A message sent through the contact form is deleted 90 days after it is sent.
• A report about a profile is deleted 90 days after it is sent.

Complaints and authorities

Anyone with the link can report a letter on its page, and anyone can use the report form or write to abuse [at] runewing.com. A reported letter is sealed immediately: by its link, only people who chose to see reported letters in their profile can read it. Only the person reviewing the complaint can see the letter’s and the sender’s data, and every access is logged. We give data to the police only on a lawful request, or on our own initiative when someone’s life or safety is at risk.

The report form stores the letter link, the reason, your text and, if you give it, your email for a reply. The text and the email are encrypted. Your IP address and device are kept only as a one-way hash, to stop spam. We delete the report 90 days after it is sent.

Contact form

The contact form stores the topic, your text, your language and, if you give it, your email for a reply. The text and the email are encrypted. For a bug report we also attach the page you came from (without the letter link), your screen size and browser, and the form shows exactly what is sent. Your IP address and device are kept only as a one-way hash, to stop spam. We don’t accept files. We use the message only to answer you and improve the site, and delete it 90 days after it is sent. You can also write to info [at] runewing.com.

Notifications to the owner

When there is a new report, a contact form message, a blog comment or an error on the site, the owner gets a short notification in Telegram (Telegram Messenger Inc.). A notification about a report or a message contains only its type, reason or topic and language, never your text, email, IP address or the text of letters and whispers. A notification about a comment contains its text and the author’s nickname, which are public anyway. A notification about an error contains the error description, the page (without the letter link), and the browser and system without version. The site does not store the notifications; in Telegram they stay in the owner’s chat.

Browser, email and Telegram notifications

Notifications turn on only when you press the button: “Notify me when it arrives” on a letter page (no sign-in needed) or “Notifications on this device” in your profile. We store the subscription address your browser gives us (through the push service of Google, Mozilla, Apple or Microsoft), the language and, if you are signed in, which account it belongs to and what to send. The push service only carries an empty signal with no text, and your browser then fetches the notification text from us. A notification has only fixed text and the sender’s nickname, never the text of letters or whispers. Notifications (including waiting for a letter) are deleted 7 days after they are sent, and a subscription without an account after 7 days of no use. You can turn it off with the same button, in your profile or in your browser settings.

If you signed in with Google, we may send short notifications to that address: about a letter from a friend in your Tribe and about becoming Tribe (on by default), and about Whispers (only if you turn it on). They are sent through Resend (Resend Inc., USA) or, if it is unavailable, Postmark (ActiveCampaign, USA); both have a data processing agreement and EU Standard Contractual Clauses. An email has only fixed text, the sender’s nickname and a link, never the text of letters or whispers. The email queue is deleted after 7 days. You can unsubscribe with the link in every email (no sign-in needed) or with the checkboxes in your profile.

If you connected Telegram in your profile, our bot (Telegram Messenger Inc.) sends you the same short notifications. We store only the chat number with the bot and what to send. You can turn it off with the button in your profile or by sending /stop to the bot.

Spam protection

To protect recipients, we limit how many letters can be sent from one IP address, network and device, and how often the same text can be sent. If the limits keep being broken or letters get reported, sending slows down, your browser is asked to solve a short “not a bot” check, and then sending is blocked for a day, a week or up to 30 days. For this we store only hashes of the IP address, network, device identifier and letter text, never the text itself, and delete them within 30 days. The “not a bot” check runs in your browser and sends nothing about you.

Analytics

We count events such as “letter created”, “letter opened” or a click on a “coming soon” button, in our own database and in PostHog (servers in the EU). These events never include the letter text, names, email addresses or IP addresses. To the letter “created” and “opened” events, to rune card creation and views and to clicks on price and “coming soon” buttons we add only the country and city (for example, PL, Warsaw), looked up from the IP address at the time of the request, and for letters and cards also the device type, browser without version and operating system (for example, phone, Safari, iOS) read from the browser’s user agent, and, only if you pressed “Accept” in the cookie banner, the screen size (for example, 390×844); the IP and the full user agent are not stored for this. The country and city lookup uses the IP Geolocation by DB-IP database on our own server. To count how many different people clicked a price or “coming soon” button, we add an anonymised key to such a click: a hash made with a secret and today’s date that changes every day, so it cannot reveal your IP, device or account and cannot link your visits on different days.

Only if you press “Accept” in the cookie banner, we also use Google Analytics (Google Ireland Limited) to count visits, pages viewed, the site you came from, your country and device type. Advertising features and Google signals are off, and Google Analytics doesn’t store IP addresses. Google may process this data in the USA under the EU-US Data Privacy Framework. We keep it for 14 months. You can withdraw consent at any time in “Cookie settings”; the site works the same without it.

“Notify me” emails (Runewing+)

If you leave your email in a “coming soon” window and tick the consent box, we store the email, your language and the item you chose, only to send you one email when payments launch. We delete it after that email or within 12 months, whichever comes first. We don’t sell or share it. To delete it earlier, write to abuse [at] runewing.com.

Opening reminders

While a letter is still locked, its page offers a reminder. If you leave your email, we use it for one email only, at the moment the letter can be opened, and delete the address right after sending. If by then the letter is hidden, burned or deleted, we send nothing and delete the address too. The email contains only a fixed text and a link to the letter, never the letter text or names. To protect against abuse, we keep a hash of the address (the address can’t be read from it) and a hash of your IP address for 30 days. “Add to calendar” puts the letter link into your calendar app (Google, Apple, Outlook and others), so anyone who can see your calendar can see the link.

Voice input

The microphone button next to the letter text, wall posts and whispers, and in the rune translator uses speech recognition built into your browser. Only after you press it and allow the microphone, your browser sends the audio to its own provider (for example, Google for Chrome, Apple for Safari, Microsoft for Edge) under that provider’s privacy terms. Runewing never receives or stores the audio: only the recognised text appears in the field, as if you had typed it, and it is handled like any other text you type. If you don’t press the button, nothing is recorded. The voice input language you pick is remembered only in your browser (local storage).

Account and sign-in with Google

An account is optional: you can open letters without one, and send two letters a day. If you sign in with Google, Google tells us only your account ID and email address; we don’t ask for your name, photo or contacts. With the account we store your Google account ID, email, when you signed up and last signed in, when you accepted the Rules and which version (sign-in counts as acceptance), and the list from your Letters page: letter links, the To and From names, seal, courier and date. The texts of your letters are never stored in the account; they stay only in the browser you wrote them in. We use the account to show this list on your devices and for the profile and friends described below; we don’t send newsletters or show your email to anyone. For letters you send while signed in, we also store which account sent them, to keep them as long as the account exists (see “How long we keep data”). We email you only about your account: before deleting an inactive account and about significant changes to these rules.

Each signed-in device keeps a sign-in for 90 days, and we delete expired sign-ins daily. “Sign out” ends the sign-in on that device. “Delete account” in Settings deletes the account, the saved list, the profile, follows, blocks and all sign-ins at once; the list in your browser stays until you remove it. Google’s handling of the sign-in is covered by Google’s privacy policy.

Profile, friends and direct letters

A profile is optional too. If you choose a nickname, your page runewing.com/u/nickname is public by default: anyone with the link sees the nickname, the name and short bio you entered, the avatar you built and how many followers and follows you have. We don’t ask for a photo: the avatar is a face drawn from ready-made parts, and we store only which parts you picked, including the gender option in the avatar builder if you chose one. Until you build an avatar, a hooded figure is shown. Profile pages are hidden from search engines. Signed-in people can find you by nickname or name. In Settings you can make the page visible only to your tribe or only to you: others then see just the nickname and a placeholder at that link and won’t find you in people search. Posts you left on other people’s walls stay visible there with your name and avatar.

If you add your birthday, we store the full date but show only the day and month, and only to the people you choose: everyone, your tribe or no one. The year is used only to check that you are 16 or older and is never shown. You can clear the date in your profile at any time.

We store whom you follow and whom you have blocked. The lists of your followers, follows and blocks are visible only to you. A person you block isn’t told about it, but can no longer see your profile or write to you.

A letter you send to a friend from their profile is an ordinary letter, stored and deleted as described above. We also store that it was sent from your account to theirs, so it shows up in their Received tab; this record is deleted together with the letter or with either account.

Whispers between friends are stored as one shared record. In Settings, each participant can choose to delete all sent and received whispers after 1 week, 1 month, 1 year or never; the shared whisper is deleted for both people when either participant’s chosen period expires.

Posts on profile walls are public, like the bio: we store the text, what it is written on, the author and the time, until the post is removed or the wall owner’s or author’s account is deleted. Runes drawn in the earth or sand disappear from the wall after 7 or 3 days; the record itself is kept like other posts until it is deleted.

A rune card is public too: we store its text, style, author and the country and city it was created from until you delete the card or your account. Anyone can report a card, even without signing in; for that we keep the reporting account or a one-way hash of the IP address.

A report about a wall post, whisper or rune card is stored with the reason and who sent it, for a whisper also with a copy of its text, and deleted after 90 days.

If you report a profile, we store the reason, a copy of the profile at that moment and which account reported it. Reports about profiles are deleted after 90 days. A banned account’s profile is hidden and it can no longer sign in.

What we store on your device

Everything below is needed for a feature you use, except Google Analytics: it is turned on only if you press “Accept” in the cookie banner. We don’t use advertising or ad tracking. Local storage counts the same as cookies, so it is listed too.

Fonts and scripts come from our own server, and the share buttons are plain links, so no other company sees your visit unless you accept Google Analytics. Sign-in with Google happens on Google’s site. If you buy Runewing+, the payment window of Paddle (our reseller) loads only after you press “Buy” and may set its own cookies under Paddle’s privacy policy. Our own analytics events are sent from our server, without cookies and without anything read from your browser.

Cookie settings

Changes to this notice

We may update this notice, for example when we add a feature or the law changes. The date at the top shows the current version. If a change affects how we use your data, we will tell you in advance with a notice on the site and, if you have an account, by email. If we ever want to use your data for a new purpose that needs your consent, we will ask for it first: continuing to use the site doesn’t count as consent.

Your rights

You can ask us what we store about a letter, ask us to delete it, or object to processing: write to abuse [at] runewing.com and include the letter link. You can also complain to the data protection authority in your country (in Poland, the President of the Personal Data Protection Office, UODO).