Privacy &
sharing.
A letter can feel personal. Here's how access to your words works in the Unfold beta, and what to keep in mind before sharing.
Your letters
When you create a card link on the website, Unfold stores the names, occasion, message, and selected opening effect so the letter can be opened again. The recipient doesn't need an account.
Links don't appear in a public gallery. This is not a confidential messaging service: share only what you are comfortable making accessible to anyone who receives the link. Some older links carry the letter content inside the URL itself.
Signing in does not add a password to a letter or give your account control over letters you already shared. A published link keeps its original contents; sending an edited version creates a new link.
Your optional account
If you register, Unfold stores your name, email address, password hash, profile identifier, and session information. Session records can include a network address and browser information for authentication and abuse prevention.
An account does not currently provide a saved letter library or draft synchronization. An unsent draft lives in the open editor; refreshing or closing the page can lose it.
Cookies
Unfold uses a session cookie to keep you signed in, with a 30-day session lifetime that can renew during use. A separate account hint can last up to a year and helps the site offer sign-in when a session has ended; it cannot authenticate you by itself. Signing out clears these cookies.
The current website does not include advertising trackers or analytics scripts.
Email and hosting
Railway hosts the website and its databases. Resend sends account verification and password-reset emails, and receives the destination address and email contents, including the account action link. These emails are in English. Open and click tracking are not configured for the sending domain.
The “Email it” option for a letter opens your own email app. Unfold does not send that letter email on your behalf through Resend. Your chosen email or messaging provider handles whatever you share through it.
During the beta
Published cards remain stored so their links can work again. Permanent availability is not guaranteed. Keep another copy of important words and avoid including sensitive personal information.
The beta does not currently offer self-service deletion of published letters or accounts. Email action links expire: verification links after 24 hours and password-reset links after one hour. Successful password resets revoke existing sessions.