Privacy Policy

This is the privacy policy for Cheddagram (“we,” “us,” “our”), a service operated by Peyton Lewis d/b/a Cheddagram, based in Georgetown, Texas, United States.

By using Cheddagram (the “Service”), including our website at cheddagram.com and our iOS app, you agree to the collection and use of information in accordance with this policy.

What we collect

Information you give us directly

• Account information: name, email address, password (hashed, never stored in plain text)
• Sender return address: the physical mailing address you configure for outgoing letters (name, street, city, state, zip)
• Payment information: processed by our payment providers Stripe (web) and Apple (iOS). We do not store your full card number or Apple account details. We receive only the last four digits and the transaction ID for record-keeping.
• Letter content: the recipient address, template used, and body text of any letter you send through the Service
• CRM notes: any notes, tags, or pipeline stages you attach to contacts within the app
• Support communications: if you email us, we retain your messages to provide support and improve the Service

Information we collect automatically

• Device information: device type, operating system version, app version, unique device identifier (advertising identifier only if you opt in)
• Usage information: which screens you view, which features you use, when you sign in, letters sent, subscription events
• Approximate location: if you grant location permission, we use it to center the map on your current location and identify nearby properties. We do not track your precise real-time location or store a history of your movements.
• Log data: IP address, request timestamps, error events for debugging

Information from third parties

• Parcel and property data: when you tap a location on the map, we look up parcel and public ownership records via Regrid. This information originates from county assessor databases and other public records.
• Skip trace data: when you initiate a skip trace on a paid plan, we look up contact information from BatchData or a similar provider. This information is compiled from public records.

Contact information sourced from public records may not always be current.

How we use your information

• To provide and maintain the Service
• To process letters and mail them via our print/mail partner Lob
• To process subscription payments via Stripe (web) and Apple (iOS)
• To send you transactional emails (receipts, delivery confirmations, security alerts)
• To respond to your support requests
• To detect and prevent fraud and abuse
• To improve the Service through aggregated analytics
• To send you optional marketing communications (only if you opt in — you can unsubscribe anytime)

How we share your information

We share information with:

• Lob: recipient address, sender address, and letter content — required to print and mail your letters
• Handwrite.io (if you use the handwritten option): recipient address, sender address, letter body
• Regrid: the coordinates you tap on the map — required to look up parcel records
• Skip trace provider: the parcel information — required to look up owner contact details
• Stripe: payment card details you provide during checkout (web only)
• Apple: subscription events on iOS via App Store
• RevenueCat: subscription state on iOS (name, email, subscription tier)
• PostHog and Sentry (if used): event and error data for analytics and debugging
• Legal authorities: if required by law, court order, or valid legal request

We do NOT:

• Sell your personal information to third parties
• Share your CRM notes or letter content with marketing partners
• Use your data to train AI models
• Share the identity of your recipients with anyone other than the mail print vendor

Data retention

• Account data: kept as long as your account is active. Deleted within 30 days of account deletion.
• Letter records: retained for 7 years after send date for compliance and dispute resolution.
• Payment records: retained for 7 years per tax and accounting requirements.
• Support tickets: retained for 3 years.
• Log data: retained for 90 days.

Your rights

Depending on where you live, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate personal information
• Delete your personal information (except where retention is required by law)
• Export your data in a portable format
• Opt out of marketing communications
• Object to certain uses of your data

To exercise these rights, email us at privacy@cheddagram.com. We’ll respond within 30 days.

California residents (CCPA): you have the right to know what personal information we collect and share, to request deletion, and to opt out of any sale of personal information (we do not sell personal information).

EU/UK residents (GDPR): the lawful bases for our processing are: (a) performance of a contract, (b) our legitimate interests in providing and improving the Service, and (c) your consent for optional communications and analytics.

Data security

We use industry-standard security measures:

• All connections are encrypted with TLS 1.2+
• Passwords are hashed with bcrypt
• Payment card details are never stored on our servers
• Access to production systems is limited to authorized personnel and requires multi-factor authentication
• Database backups are encrypted at rest

No system is 100% secure. If we ever experience a data breach affecting your personal information, we will notify you within 72 hours of discovery.

Children’s privacy

Cheddagram is not intended for children under 18. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us information, email privacy@cheddagram.com and we’ll delete it.

International users

Cheddagram is operated from the United States. If you use the Service from outside the United States, your information will be transferred to, stored, and processed in the United States. By using the Service, you consent to this transfer.

Cookies and tracking

Our website uses:

• Essential cookies — required for the Service to work (session, CSRF)
• Analytics cookies — help us understand which features are used (via PostHog)
• No advertising cookies — we do not run ads and do not use tracking pixels for advertising

You can disable non-essential cookies in your browser settings. The mobile app does not use cookies in the same way but does track events via PostHog if you have not opted out.

Changes to this policy

If we make material changes, we’ll notify you by email and update the “Last updated” date at the top. Continued use of the Service after changes means you accept the updated policy.

Contact us

Questions? Email:

This privacy policy is provided as a starting point and should be reviewed by a licensed attorney before public launch. Common gaps to watch for: your specific mailing address in the “Contact us” section, updated entity name after LLC formation, and any additional third-party services added between now and launch.