Privacy Policy

dearfuture.site ("we", "us", "our") is operated by VibeCodeMom. We are committed to protecting your personal data and your right to privacy. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our website and services.

This policy complies with applicable data protection laws, including the UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "UAE PDPL"), the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other applicable privacy regulations.

VibeCodeMom is the data controller responsible for your personal data. For all privacy enquiries, data subject requests, or complaints, please contact us at:

We collect the following categories of personal data:

• Account data: email address, display name, password (hashed), authentication tokens, and account preferences.
• Letter content: the full text of letters you write, along with the delivery date, life area, tone summary, and seal status you assign.
• Payment data: transaction records (amount, date, currency, status). Credit card information is handled exclusively by Stripe and never stored on our servers.
• Usage data: IP address, browser type, device information, pages visited, and interaction logs collected through cookies and similar technologies.
• Communication data: records of support requests, delivery confirmations, and emails we send you.

Under the GDPR, we process your personal data on the following legal bases:

• Performance of a contract: processing your account and letter data to deliver the service you requested.
• Legitimate interests: using usage data to improve and secure our platform, provided your rights do not override these interests.
• Consent: using analytics cookies and optional marketing communications, which you can withdraw at any time.
• Legal obligation: retaining transaction records as required by tax and financial regulations.

We use your personal data to:

• Create and manage your account and authenticate your sessions.
• Store, seal, and deliver your letters on the dates you choose.
• Process payments and maintain billing history via Stripe.
• Send delivery notifications, reminders, and account-related communications.
• Generate AI-assisted insights (life area classification, tone summary, roadmap milestones) based on your letter content.
• Monitor, secure, and improve our services, including debugging and abuse prevention.
• Comply with legal obligations and respond to lawful requests from authorities.

We use cookies and similar technologies (local storage, pixels) to operate and improve our service:

• Essential cookies: required for authentication, session management, and core functionality. These cannot be disabled.
• Preference cookies: remember your settings, such as sound preferences and UI state.
• Analytics cookies: help us understand how visitors use our site so we can improve it. These are only set if you accept them via our cookie banner.

You can manage or delete cookies through your browser settings. Our cookie banner allows you to accept or reject non-essential cookies. If you reject, only essential cookies will be used.

When you seal a letter, we use AI language models to analyze your letter and generate a title, life area classification, tone summary, and (if enabled) a roadmap with milestones. Your letter content is sent to our AI provider for this purpose and is not used to train their models. The generated insights are stored with your letter and are visible only to you.

We do not sell your personal data. We share data only with the following categories of recipients:

• Stripe: payment processing and subscription management. Stripe processes your card data under its own compliance framework.
• AI providers: for letter analysis and roadmap generation, under data processing agreements that prohibit training on your data.
• Email delivery providers: to send you delivery notifications and reminders.
• Cloud infrastructure providers: for hosting, database storage, and application delivery.
• Legal authorities: where required by law, court order, or to protect our legal rights.

Your personal data may be processed and stored in countries outside the UAE, including the United States and European Union, where our infrastructure and service providers are located. We ensure appropriate safeguards are in place, such as standard contractual clauses and provider-level compliance certifications, to protect your data in accordance with the UAE PDPL and GDPR.

Your letters and account data remain stored for as long as your account is active. If you request account deletion, we begin a 30-day grace period during which your sealed letters are still delivered. After the grace period, all personal data is permanently removed. Transaction records are retained for the period required by applicable tax and financial laws (typically 5–7 years).

We implement industry-standard technical and organizational measures to protect your personal data, including encrypted data transmission (TLS), hashed passwords, access controls, and regular security reviews. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

Depending on your jurisdiction, you have the following rights regarding your personal data:

• Right of access: request a copy of the personal data we hold about you.
• Right to rectification: correct inaccurate or incomplete data.
• Right to erasure ("right to be forgotten"): request deletion of your personal data.
• Right to data portability: receive your data in a structured, machine-readable format.
• Right to object: object to processing based on legitimate interests.
• Right to restriction: restrict how we process your data in certain circumstances.
• Right to withdraw consent: withdraw consent for non-essential cookie processing at any time.
• Right to lodge a complaint: with your local data protection authority.

Under the UAE PDPL, you also have the right to request a data processing report, and to object to processing for direct marketing. To exercise any of these rights, contact us using the details in Section 2. We will respond within 30 days.

Our service is not directed to children under 13 (or the minimum age in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority and affected individuals without undue delay, in accordance with the UAE PDPL and GDPR requirements.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. We encourage you to review this policy periodically.

If you have any questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us using the details in Section 2.