Letterback
Privacy summary

Pilot privacy / plain English

The less we know, the safer the signal.

Letterback is designed so the response service never needs the recipient’s name or written address. Data minimisation is not a policy layer here—it is the product architecture.

Recorded

Only what makes the signal work

A random envelope code, the answer selected, timestamps, a coarse device category and a short-lived keyed hash for abuse prevention.
Minimal event data

Never collected

Identity stays out of reach

No recipient name, scanner name, written address, email, telephone number, account or raw IP address.
No personal-data form

How it is used

Evidence—not an automatic instruction

Letterback looks for corroboration across separate mailings before reporting a confident address-quality signal.
Corroboration first

The pilot rule

Keep identity with the sender. Keep evidence with Letterback.

No namesNo written addressesNo scanner accountsNo raw IP storageNo tracking cookies