LetterlockSub-processors
Last updated: 24 August 2026
Every third party that can receive personal data in the course of running Letterlock. It is a section of the Privacy Policy as well; this page exists so it can be linked to on its own.
The hostname column is exhaustive rather than illustrative. The service runs behind an egress allowlist — a list of hostnames it may open a connection to, and it can reach nothing else — and that list is generated from the code, not maintained by hand. If a name is not in this table, nothing here can talk to it.
| Who | What they do | Where / transfer basis |
|---|---|---|
Google Ireland Ltd. / Google LLCgmail.googleapis.comcalendar.google.comaccounts.google.comoauth2.googleapis.comwww.googleapis.com |
The mailbox and calendar the service acts on: sign-in, the messages it reads, the drafts it writes back, the events it creates, and the push notification that says new mail arrived. | [location to confirm] [transfer basis to confirm] |
DeepSeekapi.deepseek.com |
Writes the draft, when it is the provider you selected. It is the current default. It receives masked text and is not an enclave provider: it can read whatever the masking did not catch. Settings lets you change this. | [location to confirm] [transfer basis to confirm] |
NEAR AIglm-5-2.completions.near.aigpt-oss-120b.completions.near.ai |
Writes the draft, when you select one of the two enclave models. It receives masked text, inside a hardware enclave whose attestation report this server checks before each session. | [location to confirm] [transfer basis to confirm] |
Polar Softwareapi.polar.shsandbox-api.polar.sh |
Takes the payment, as Merchant of Record, and tells this server whether a subscription is live. It holds the billing relationship and the payment details; this server never sees a card number. | [location to confirm] [transfer basis to confirm] |
Telegramapi.telegram.org |
Carries notifications to you, if and only if you linked a chat, and carries contact-form messages to the operator. Message text and your chat id pass through Telegram in the ordinary way, so do not put anything in a notification you would not put in a Telegram message. | [location to confirm] [transfer basis to confirm] |
Phala Networkpccs.phala.network |
Runs the confidential-compute host the service is being moved onto, and serves the certificates used to check an attestation quote. Phala operates the machine and, by construction, cannot read what runs inside the enclave. | [location to confirm] [transfer basis to confirm] |
Hetzner Online GmbHcosigner.morganrivers.com |
Runs the servers: the co-signer that holds the outer half of your token's encryption, and the current deployment of the service itself. Hetzner holds ciphertext and neither key. | Germany No transfer: processing is in the EU. |
Which of these apply to you
Google, Polar, and whichever hosting provider serves your account are unavoidable: they are the mailbox, the payment, and the machine. The rest depend on what you switch on. An AI provider receives masked text from your mail only while it is the provider selected in your Settings, and only one is ever selected. Telegram is involved only if you linked a chat.
Changes
If we add a sub-processor, we will update this page and tell existing subscribers before it starts receiving data, so that anyone who objects has time to say so or to leave.
See also the Privacy Policy, the Terms of Service and the Imprint.