Privacy Policy

TimedMail ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your information when you use our service.

We believe privacy is a fundamental right. Our service is designed from the ground up to minimize data collection while providing a secure way to store and deliver your letters.

TimedMail is operated from Reykjavik, Iceland, and your data is processed under Icelandic and European Economic Area (EEA) data protection law.

We deliberately chose Iceland as our jurisdiction because it offers some of the strongest privacy protections in the world:

• Iceland's Act No. 90/2018 fully implements the EU General Data Protection Regulation (GDPR)
• As an EEA member, Iceland provides the same data protection standards as the European Union
• Iceland is outside US jurisdiction — not subject to NSA surveillance programs or the US DMCA
• The Icelandic Data Protection Authority (Persónuvernd) actively enforces privacy rights
• Iceland ranks #1 on the Global Peace Index and has strong rule of law

Your data never leaves the protection of Icelandic and EEA law. We do not operate any servers in jurisdictions with weaker privacy protections.

We use your information solely to:

• Provide and maintain the TimedMail service
• Send check-in reminders to your email
• Deliver your letters to recipients when triggered
• Process payments
• Prevent fraud and abuse
• Respond to support requests

We do not use your information for advertising, profiling, or any purpose other than operating the service.

Your letter content is encrypted using AES-256-GCM encryption combined with timelock cryptography before being stored on our servers. This means:

• We cannot read the content of your letters — this is mathematically guaranteed
• Decryption keys are timelocked via a public beacon (drand) and only become available at a future date
• Each time you check in, your letters are re-encrypted with a new future timelock
• Only the intended recipient can decrypt and read your letter after the timelock expires

We use the drand (Distributed Randomness Beacon) network, operated by Cloudflare, Protocol Labs, and other independent organizations. This decentralized system ensures that no single party — including TimedMail — can access your content before the scheduled time.

Additional security measures include HTTPS encryption, secure password hashing, and regular security audits.

We do not sell, rent, or share your personal information with third parties, except:

We do not use any third-party analytics, advertising, or tracking services.

We retain your data for as long as your account is active. After a letter is delivered, the encrypted content is automatically deleted from our servers within 30 days.

If you delete your account, all your data including letters, recipient information, and account details are permanently deleted within 30 days.

You have the right to:

• Access your personal data
• Correct inaccurate data
• Delete your account and all associated data
• Export your data in a portable format
• Object to processing of your data

To exercise any of these rights, please contact us at [email protected].

We use only essential cookies required for the service to function:

• Session cookies to keep you logged in
• Security cookies to prevent CSRF attacks

We do not use tracking cookies, advertising cookies, or any third-party cookies.

TimedMail is headquartered in Iceland, a member of the European Economic Area (EEA). Your data is primarily processed and stored in Iceland.

For users outside Iceland, this means your data is transferred to and stored under Icelandic and EEA data protection law, which provides one of the highest standards of data protection globally.

Any data transfers outside the EEA (such as email delivery services) are conducted in compliance with GDPR requirements, using appropriate safeguards such as:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Transfers only to countries with an EU adequacy decision
• Binding Corporate Rules where applicable

We do not transfer data to, or operate servers in, jurisdictions that lack adequate privacy protections or are subject to mass surveillance programs.

TimedMail is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from children.

We may update this Privacy Policy from time to time. We will notify you of any significant changes by email and update the "Last updated" date at the top of this page.

If you have any questions about this Privacy Policy or our data practices, please contact us: