Privacy

Our philosophy

oorb is built on the belief that personal correspondence should be private, deliberate, and free of the surveillance economy. We do not track you, we do not advertise to you, and we do not sell anything about you.

What follows is not that sentiment restated at length. It is an itemised account of what is held, by whom, and for how long — including the two places where this site reads something you wrote, because a notice that mentions only the flattering half is not one you can rely on.

The short version

Anything you write or say in the Hearth stays in your browser. There is no request that carries it and no store that holds it — the destruction you see is the whole of it.

A letter you choose to send from an overture card is different. It is stored in full, because it has to be delivered to someone and kept where you can both read it again. Neither your email address nor your username is shown to the person who receives it, and it arrives from this site rather than from you.

Confirming your address is also what makes you reachable. A letter sent from here goes to one person drawn at random from everybody who has confirmed one, and nobody signs up to be written to separately — there is no list to join and none to leave except by closing the account. It is said at the point you confirm, and it is repeated here because it is the part of confirming that is easiest to miss.

It is signed with the face and the name you chose. Pick a face on your account page and it comes with a few words — the doorway cat, a lone wolf — or write your own instead. The two of them sign your letters together, and they are the only thing about you the person reading one ever sees. Choose nothing and it is signed a stranger, as every letter here was before faces existed. An answer you write is signed the same way, by you — the same two things, and nothing more of you than a letter carries.

Worth knowing, because it is the point of choosing: a name you keep is a name that repeats. Two letters signed the same way are recognisably from the same person, which is what makes it a name rather than a disguise. Change it whenever you like: a letter is signed when it is written, so everything already sent keeps the signature it went out with and the new one starts with your next letter.

While you are still writing one, it is kept in your own browser so that closing the window does not destroy it. That is your device, not our server — nothing about it is sent to us, and it is erased the moment the letter goes out or you empty the box.

What is collected, and why

There is no analytics, no advertising, no tracking pixel, no profiling, and no cookie other than the one that signs you in.

No payment details, of any kind. A gift has a price, but there is no gateway on this site and no card field on any page — the amount is settled with a person afterwards, and nothing about how you pay it is stored here.

No postal address is stored on this server, and there is no column for one. A printed letter plainly needs somewhere to be posted: we ask you for that in the same conversation that settles the price, and it lives in that correspondence rather than in this database. Saying we never collect one at all would be the easier sentence and the wrong one.

What is never collected

Anything written or spoken in the Hearth. Nothing written there is sent anywhere, kept anywhere, or matched anywhere but on your own machine — including the literary line you are given at the end. When the words come apart on screen there is nothing left anywhere to delete. A letter spoken there rather than typed is the same claim and the same mechanism: the recording is made by your own browser, is never uploaded, and is discarded when you cast it. The microphone is asked for only when you press record, and released the moment you stop.

No profiling of what you are interested in, no third-party marketing script, no advertising identifier, and no font or stylesheet from anybody else’s server.

Who else sees it

Our email provider. When a letter reaches you, the service that carries our mail is given your email address, the name the letter was addressed to, and its first few words — enough for the message to say what it is about. The letter itself is not handed over. It stays here and is read on your account page, which is where the whole of it lives. A spoken letter hands over less still: the message says only that a voice note has arrived, and no recording is ever attached to an email or sent to that provider in any form.

An answer is never emailed to anybody. It is written here and read here, so answering hands nothing to anyone at all.

Nobody else. Reading a page here contacts no other company at all. Nothing on it — not a script, not a typeface, not an image — is fetched from anywhere else, so there is no third party in a position to watch you read it.

Site administrators. An administrator can see who wrote to whom, whether a letter was delivered and whether it was answered — and, in the ordinary case, not a word of what was written. The list of letters carries counts and addresses and never any prose. It exists so a complaint from either person can be answered.

A letter somebody reports is the exception, and only the half reported. When you report a letter or an answer, whoever answers the report reads that half in full — or listens to it, if it was spoken. A claim cannot be judged from an excerpt, and there is no way to decide whether something broke a rule without seeing the thing itself. The other half of the exchange is not opened, and nothing is read this way unless a report was filed about it.

Whoever writes your gift. The one exception to the line above, and the reason the exception exists: a letter cannot be written from a brief nobody reads. If you ask for a gift, a person here reads what you wrote in full, along with the name and email address you gave. Nothing you write anywhere else on this site is read that way.

Nothing is sold, and nothing is shared for advertising.

If an exchange is published

Nothing is published unless somebody chooses to publish it. Once an answer has come back, the person who wrote the letter may put the exchange on the public page — both halves, as they were written. Until then, and unless they do, a letter is read by one person and by nobody else.

Only the writer decides, and this is the part to be plain about. If you answered a letter, the person who sent it may publish your answer along with their letter, and you are told rather than asked. You cannot take it down. That is a real thing this site lets one person do with another’s words, and it should be read before you answer rather than found out afterwards.

This page is where you are told. Until 11 September 2026 the same warning also sat above the box you answer in, so it was read at the moment the decision was yours to weigh. It was taken off, and this clause is now the only notice given beforehand — afterwards the card in your drawer says the exchange was published, who published it, and links to the page. If you would rather an answer of yours was never public, that has to be decided here, before you write it.

What is published carries no account. Both halves are signed the way they always were — a face and the name you chose — and never a username, never an email address, and never the name the letter was addressed to. There is nothing on the page that can be looked up here or anywhere else.

That protects your account, not your story. A letter is made of particulars, and anybody who already knows what happened will recognise it. Publish the way you would publish under a pen name rather than the way you would tell a secret.

A published voice note is your voice, and that is different. The faces are a fixed set of glyphs shared by everybody wearing them, so no two writers can be told apart by one. A recording is not like that: it can be recognised by anyone who knows you, and it can be matched to another recording of you by a machine. Publishing a spoken exchange puts the audio on a page anybody can open, and the same is true of a spoken answer, which is published by the person who wrote the letter rather than by whoever recorded it. If that is not what you want, the letter you publish should be one that was written, and an answer you would rather was not published should be written too.

Taking it down is immediate and permanent here. It leaves the public page within the request, its address stops working for good, and publishing the same exchange again puts it at a new one. The audio’s own address is destroyed with it, so a link to the recording that somebody copied out of the page stops working at the same moment the page does. Closing your account removes it as well.

What no site can undo is a copy somebody else already took. A search engine keeps its own until it next looks, and an archive may keep one indefinitely. Nothing here reaches those. The window in which publishing is genuinely reversible is short — it is the first few days — and that is the reason to treat publishing as a decision rather than as a setting.

Administrators are not excepted by it. A published exchange can be connected to the accounts at either end by whoever runs this site, exactly as any other letter can. What the public page withholds, it withholds from the public.

What you can do about any of it

See what is held. It is on your account page rather than behind a request: every letter you sent, every letter that reached you, the answer attached to each, and your own username, address and the day you joined. There is nothing kept about you that is not shown to you there.

Correct it. Your username, your email address and your password are yours to change, on the same page. Changing the address puts the account back to unconfirmed and sends a link to the new one, because the old confirmation proved only that you could read a different inbox.

Withdraw consent, or have it erased. Deleting the account is the mechanism for both, and what it does and does not remove is set out under How long it is kept below — including how to have the record that survives it destroyed as well.

Complain. Write to the address at the foot of this page and a person here answers. If that does not settle it, the Data Protection Board of India will hear a complaint without needing our agreement.

If someone asked us to write to you

A gift is the one place where an email address reaches us from somebody other than its owner. If a letter arrived for you from this site, someone gave us your email address so that one letter could be written and sent. We hold it for that, and for answering you about it — never to make you an account, add you to anything, or write to you again.

This section is your notice, and the letter itself carries a short version of it, because you never came here to be shown one. Everything on this page applies to you as much as to anyone with an account, and none of it requires you to make one. There is nothing to sign up for in order to be told what is held, or to write to us about it.

What is held about you, in full: your email address, the name the letter was addressed to, what the person who asked said they wanted said — which is about you, and which a writer here read — and the letter that came of it. Nothing else. No account, no password, no profile, and nothing derived from you for any other purpose.

It goes to nobody. What is held about you is not sold, not used for advertising, not handed to any other company, and not given to anyone who asks for it — there is no circumstance in which we pass it on. The single unavoidable exception is the service that carried the letter into your inbox, which had to be given your email address in order to deliver it, exactly as the post office has to be given a street one.

Why it is kept at all. So that if this letter is ever questioned — by you, or by the person who asked for it — there is a record here to answer with instead of a shrug. It exists to settle a complaint or a misunderstanding, not to build anything about you, and holding it is what keeps the answer available to you rather than only to us.

If you want to ask about any of it, write to admin@oorb.in from the email address the letter reached. A person reads it and answers.

It is kept unless you ask for it to go. Left alone, the record of a gift stays here so that if anything about this letter is raised later — a dispute, a claim, a settlement between any of the people involved — it can be answered from what actually happened rather than from memory. That cuts both ways: it is the same record you would need if the complaint were yours.

And if you would rather it were gone, say so and it goes. Write from the address the letter reached and a person here destroys the record of it — your address, the name it was addressed to, what was asked for, and the letter itself. That one does not come back, and it cuts the same way the last paragraph did: afterwards a question about this letter cannot be answered from anything here, including a question of yours.

You can object to it being held, and a person here will read that and answer you. If we do not settle something to your satisfaction, the Data Protection Board of India will hear it without needing our agreement.

We ask for nothing to prove who you are beyond the email address itself — writing from it is the proof. That cuts the other way too, and deliberately: there is no page or form on this site that will tell you whether a given email address has been written to, because that question is somebody’s private life and anybody could ask it. A person here reads your message and acts on it.

Nothing is sent by a form. Every gift is read and written by a person before it leaves here, which is what stops this from being a way to mail anyone anything.

On a phone

The oorb app holds nothing the website does not. The Hearth there makes no network request either, whether the letter is typed or spoken. A recording is the one thing the app handles differently from a browser, and it is worth saying plainly: a phone records to a file rather than to memory, so while you are speaking there is an audio file in the app’s cache. It is deleted when you drop that part, when you cast the letter, and when you leave the screen — whichever comes first. A half-written overture is kept on the phone by the same rule as in a browser, and erased when the letter goes out. Signing in uses the same cookie, kept by the phone’s own operating system, so the app never holds a credential of its own.

The microphone is asked for only when you first record. The app requests it the moment you press record for the first time and not at any point before, it is released the moment you stop, and it is never opened in the background — the app declares no permission to record while it is not the screen you are looking at. A part you record and do not send — because you deleted it, or closed the letter — is a file in the phone’s own temporary storage that never leaves it.

There is no analytics or crash-reporting library in the app, and no advertising identifier is read.

How long it is kept

Sessions expire and are deleted. Confirmation links expire and are single-use. Letters are kept for as long as your account is open, because the whole point of keeping them is that you can read them again years later. A voice note is a letter for this purpose and for every other: it is kept exactly as long, destroyed at exactly the same moment, and goes when the letter it belongs to goes.

Deleting your account closes it rather than wiping it, and you should know the difference. Signing in stops working, and every letter you sent leaves your drawer and the drawer of the stranger who received one — nobody using this site can reach any of it, including you. What is left behind is a hidden record, kept so that a question about a letter can still be answered afterwards.

That record is not kept forever. It is destroyed 3 years after you close the account, by the site itself, without your having to ask and without anybody here deciding to. That is roughly how long a claim about any of it could still be brought, which is the whole reason the record exists; once it can no longer answer anything, keeping it is just keeping it.

You can have it destroyed sooner. Write to admin@oorb.in from the address on the account and a person here removes the record itself, by hand. That one does not come back.

Backups are the other exception. The database is copied regularly so that a failure does not erase everybody’s letters, and each copy is destroyed in its turn as newer ones are taken. You remain inside the copies already taken until each of those is destroyed. Nothing is read from them except to restore the site after a failure.

Children

This site is for adults. Letters here are written to strangers, and what people say in them is not written for a child to receive.

We do not check, and we should say so rather than imply otherwise. Signing up asks for a username, an email address and a password, and nothing about your age. Confirming your email proves only that you can read that inbox. So this is a statement of who the site is for, not a gate that anybody passed.

We do not knowingly keep an account for anyone under 18. If you tell us one exists — your own or your child’s — we will delete it and everything it holds, and you do not have to prove anything to us to have that done.

Contact

Grievance Officer: Shivam Chauhan. Email: admin@oorb.in. We answer within 30 days.

This is the email address for questions about your data, for anything held about you that you want looked at, and for anyone who received a gift they did not ask for.