Home · Pricing · Help centre · Terms · Privacy · Time capsule promise · Cookies · Acceptable use · Sign in
Privacy Policy
What Lekamail collects, why, and for how long. No ads, no selling data, tracking pixels stripped, and your mail stored in the US or the EU, your choice.
Who we are
This Privacy Policy explains how Lekamail, Inc. (“Lekamail”, “we”, “us”), 1050 Bishop Street, Suite 400, Honolulu, HI 96813, United States, handles personal information when you visit lekamail.com or use the Lekamail apps and email service.
Lekamail, Inc. is the controller of the personal information described here. For the contents of your mailbox, we act on your instructions: we store and deliver your mail for you, and nothing more.
You can reach our privacy team at privacy@lekamail.com.
What you give us
Account details: your name, your chosen @lekamail.com address, a recovery email address, your password (stored only as a salted hash) or passkey public keys, your chosen data region and your preferences, such as your favourite stamp.
Billing details for Letter and Parcel: your name, billing address, country and payment method. Card numbers are handled by our payment processor and never touch our servers; we only see the card type, last four digits and expiry date.
Your mailbox: the mail, attachments, photos, voice recordings, transcripts, contacts, labels and time capsules you send, receive and store (“Your Content”). If you import from Gmail, Outlook or iCloud, we copy the mail and contacts you choose to bring over.
Support messages: anything you tell us when you write to hello@lekamail.com or any other Lekamail address.
What we collect automatically
Delivery information that email needs to work, such as sender and recipient addresses, message headers, timestamps, message size and the servers a message passed through.
Security and service logs, such as IP addresses, device and browser type, app version, sign-in times and failed sign-in attempts. We use these to keep your account safe, stop abuse and fix problems.
We do not use analytics trackers, advertising pixels, fingerprinting or social media plugins on lekamail.com or in our apps.
How we spot letters
Lekamail separates letters written by people from receipts, updates and newsletters. We do this using sender and header signals only, for example whether a message was sent through a bulk-mail system, whether it carries an unsubscribe header, and whether you have written to the sender before.
We do not use the content of your letters to sort them. When you tap “Not a letter” or “This is a letter”, we remember that choice for that sender in your account only.
How we use your information
To provide the Service: creating your account, storing, sending and delivering mail, postcards, voice letters and time capsules, creating transcripts you ask for, importing mail and running search.
To keep people safe: filtering spam, phishing and malware, detecting account takeovers, enforcing sending limits and our Acceptable Use Policy.
To bill you, send receipts and renewal reminders, and answer support requests.
To tell you about important things, such as security alerts, changes to our terms or a capsule that could not be delivered. We only send product news if you ask for it, and you can stop it with one click.
To meet legal obligations, such as tax record-keeping and responding to valid legal requests.
Our legal bases (EEA and UK)
Contract: we process your account details, Your Content, billing and delivery information because we need to in order to provide the Service you signed up for.
Legitimate interests: we process security logs and spam signals to protect you, other users and the Service, and to improve reliability. We have balanced these interests against your rights, and you can object at any time.
Legal obligation: we keep invoices and respond to lawful requests where the law requires it.
Consent: we send optional product news only with your consent, which you can withdraw at any time without affecting anything we did before.
What we never do
We never show ads, never sell or rent your personal information, and never build advertising profiles.
We never scan the content of your mail for marketing, and we never use Your Content to develop products for anyone else.
We strip tracking pixels from incoming mail before it reaches you, so senders can’t see when or where you open their messages.
Where your data lives
When you sign up, you choose a region: the United States (Oregon) or the European Union (Frankfurt). Your mailbox and account data are stored in that region, encrypted in transit and at rest. You can move regions at any time from Settings → Privacy.
Our company and support team are in the United States, so limited account information may be accessed from the US when we help you or keep the Service secure. Where personal information from the EEA, UK or Switzerland is transferred to the United States or another country, we rely on the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum, or an adequacy decision, together with additional safeguards such as encryption and strict access controls.
Who we share it with
Service providers who help us run Lekamail, under written contracts that allow them to use data only on our instructions: our hosting and storage providers in the region you chose, our payment processor, and our transactional email provider for account notices. A current list is available on request from privacy@lekamail.com.
The people you write to: when you send mail, a postcard, a voice letter or a capsule, we deliver it to the recipients you choose, along with the details email normally includes.
Legal requests: we disclose information only when we receive a valid legal request, we review each one carefully, we push back on requests that are too broad, and we tell you unless the law forbids it. We publish a transparency report every year.
Business changes: if Lekamail is involved in a merger or acquisition, your information may transfer to the new owner, who must honour this policy. We will tell you before that happens.
How long we keep things
Your mail and content: for as long as you keep them. When you delete something, it is removed within 30 days, and from backups within a further 60 days.
Account details: for as long as your account is open, then deleted within 30 days of closing it, unless you ask us to keep forwarding your address.
Billing records: seven years, because tax law requires it.
Security and service logs: 90 days, or longer only while we investigate a specific security incident.
Support messages: two years after your last conversation with us.
Sealed time capsules: until they are delivered or cancelled, as described in our Time Capsule Promise.
How we protect it
We encrypt data in transit with TLS and at rest with AES-256. Time capsules are encrypted separately and backed up independently.
Access to production systems is limited to a small number of staff who need it, protected by hardware security keys, and logged. Staff cannot open your mail unless you ask us to for support, or where the law requires it.
We test our systems regularly, and we will notify you and the relevant authorities without undue delay if a breach affects your personal information.
Your rights
Wherever you live, you can see, correct, export or delete your data from Settings → Privacy, or by writing to privacy@lekamail.com. We reply within 30 days, and usually much sooner.
If you are in the EEA, the UK or Switzerland, you also have the right to restrict or object to processing, to data portability, to withdraw consent at any time, and to complain to your local data protection authority. Our representative in the European Union and the United Kingdom can be reached through privacy@lekamail.com.
To protect your account, we may ask you to confirm a request from your signed-in account or recovery email before we act on it.
California and other US states
In the last 12 months we collected these categories of personal information: identifiers (such as your name, address and IP address), commercial information (your plan and payments), internet activity (security and service logs), and the contents of your mail, which we hold only to provide the Service to you.
California residents, and residents of other states with similar laws, have the right to know what we collect, to access, correct and delete it, and not to be discriminated against for using these rights. You can also appoint an authorised agent to act for you.
We do not sell or share personal information for cross-context behavioural advertising, and we do not use sensitive personal information for anything beyond providing the Service, so there is nothing to opt out of. We honour Global Privacy Control signals all the same.
Children
Lekamail is not intended for children under 13, or under the minimum age of digital consent in your country. We do not knowingly collect personal information from younger children.
Parcel lets a parent add family members, and the parent is responsible for any child’s use. If you believe a child has signed up without the required permission, write to privacy@lekamail.com and we will delete the account promptly.
Cookies
We use only two strictly necessary cookies: lk_session keeps you signed in and lk_region remembers the data region you chose. There are no advertising, analytics or social cookies. Our Cookie Policy has the details.
Changes and contact
If we make a significant change to this policy, we will email you and show a notice in the app at least 30 days before it takes effect. The date at the top always shows the latest version.
Questions, requests or concerns? Write to privacy@lekamail.com, or post to Privacy Team, Lekamail, Inc., 1050 Bishop Street, Suite 400, Honolulu, HI 96813, United States.