Privacy Policy

Data We Collect

• Parent account: name and Google account email you sign in with.
• Children's profiles: first name and optional age. We never ask for full names, addresses, or contact details for children.
• Letter and chat content: the messages you and your children write, and the AI-generated replies.
• Usage metadata: which assistant platform or web app a message came through, message timestamps, and delivery status.

How We Use It

• To generate Santa's personalized replies (Google Gemini, processed on Google Cloud).
• To store the conversation so you and your children can revisit it (Google BigQuery and Firestore).
• To email you Santa's reply and confirmations (Amazon SES).
• To detect and block unsafe or inappropriate message content before a reply is generated.

When You Use ChatGPT

Messages typed into ChatGPT are first processed by OpenAI under their own terms before reaching our service. OpenAI acts as an independent controller of that input; see OpenAI's privacy policy for their handling. Once the message reaches Santa Mailbox, this policy applies.

Retention

Child profiles are deleted by the parent in the Santa Mailbox web app at any time. Letters and chat messages are retained in our records for the operation of the service; if you would like them removed, ask us at privacy@santa-mailbox.app and we will delete them on request. Account data is removed when you ask us to remove your account.

Your Controls

• View, edit, and delete children's profiles in the web app.
• Ask us to delete letters, chat messages, or your account at privacy@santa-mailbox.app.
• Revoke the Santa Mailbox connection in ChatGPT or any assistant account settings; our access token then expires within one hour.
• Contact us at privacy@santa-mailbox.app for anything else.

Who We Share With

Google Cloud (storage, Gemini), Google OAuth (sign-in), Amazon SES (email delivery), and OpenAI (as the access channel when you use ChatGPT). We never sell data and never share children's information for advertising.