Privacy Policy
The short version: we collect the minimum needed to send a private note and keep it from being abused. We never sell data, we never tell a recipient who sent their note, and nothing is ever posted publicly.
What we collect, and why
If you receive a note
- Your email address — given to us by the sender, so the note can be delivered to you.
- The note itself — the message, stored so it can be shown on your private note page and so we can act on it if you report it.
If you send a note
- The recipient's email address and your message — to screen it and deliver it. A draft stays in your browser until you submit it.
- Your email address at checkout — for your receipt, and so we can reach you about that note if needed (for example, a refund). It is never shown to the recipient.
- Basic technical information — like any website, our hosting provider processes things like IP addresses to serve pages, keep the site secure, and spot abuse patterns such as pile-ons.
Payments run through Stripe
All payments are processed by Stripe. Your card details go to Stripe, not to us: we never see or store your full card number. What we keep is the transaction record — amount, status, and a payment reference — so we can prove a note was paid for, release authorisations for blocked notes, and issue refunds. Stripe's own privacy policy covers how it handles your payment information.
Screening
Custom messages are screened before they send, as described in our Acceptable Use rules. That screening includes automated checks on our servers and an AI moderation service (OpenAI) that receives the message text only — never the recipient's email address, and never your payment details. Flagged and blocked texts are kept in a private moderation log, used only for enforcement and for improving the screening.
The block list (suppression)
When an address hard-bounces (the mailbox doesn't exist or won't accept mail) or reports a note as spam, we add that email address to a block list, and that address never receives a note from us again.
Honestly stated: the list stores the address itself (in lowercase), because that's the only way to reliably match it at send time. It is used for exactly one thing — keeping undeliverable and spam-complaining addresses out of future sends — and for nothing else: no marketing, no sharing, no other product. Block-list entries are kept permanently. If we deleted them, we'd risk sending again to an address the mail system has already told us not to send to, which would defeat the point.
What we never do
- Never sell or rent anyone's information. Anyone's.
- Never share a sender's identity with a recipient — not their name, not their email, not their payment details.
- Never post a note publicly, and never use notes or addresses for advertising.
- Never send marketing email to recipients. A recipient address is used to deliver the one note it was given for, and that's the end of it.
How long we keep things
- Notes and delivery records are kept as the record that a note was screened, paid for, and delivered — and so abuse reports can be investigated.
- Reports and moderation records are kept so repeat abuse can be recognised and stopped.
- Block-list entries are kept permanently, for the reason explained above.
- Payment records are held by Stripe under its own retention rules.
Security
The site and its data run on Cloudflare's infrastructure, with traffic encrypted in transit (HTTPS) and access to the service's data limited to the small team that operates it. Email delivery runs through Resend. No system is perfectly secure, but we keep the data we hold small on purpose — the less there is, the less there is to protect.
Cookies
This site sets no analytics, advertising, or tracking cookies, and runs no trackers. The only cookies that may appear are strictly-necessary security cookies from our hosting provider, used to tell humans from bots. That's it.
Your choices
You can ask us what personal information we hold about you, ask for a correction, or ask for deletion, by emailing youmayhavebeenrude@proton.me. We'll respond and sort it out. Two honest exceptions: a block-list entry has to stay (it's how we keep from ever sending again to an address that bounced or complained), and records tied to an active abuse investigation or a payment dispute may need to be kept until that matter closes.
Who we are
You May Have Been Rude is operated from British Columbia, Canada.
[BUSINESS ADDRESS — to be added before launch]