Privacy.

Who is responsible

Luxin Łukasz Maj is the controller of personal data processed to operate from. Contact us without signing in, including if someone has created a Public Inbox for you before you joined.

Company details and contact

What we collect and where it comes from

• Identity and profiles: X user ID, handle, display name, profile image and membership status. We obtain public profile information from X when a person is looked up. On sign-in, X supplies account information and an email address when available. An X address is not permission to send marketing.
• Offers and feedback: requests, revisions, amounts, deadlines, decisions, drafts and private Delivery material supplied by participants, together with account and exchange history.
• Following and communications: followed inboxes, notification choices, messages, email delivery or suppression records and support correspondence.
• Payment and reporting records: transaction references, amounts, status and payout information. Stripe collects payment and verification information for its services. Where tax reporting applies, identity, address, tax residence, tax identification, birth date or business details, financial-account details and reportable activity are required.
• Security and measurement: session and abuse-prevention identifiers, technical request information and limited network identifiers. We record Share Card/link visits and actions and associated account activity to understand whether sharing leads to engagement.

What is public

Public Inboxes show X profile details, whether the person has joined, public Offers, amounts and activity. Offer Titles, Offer Notes, deadlines and public decisions can appear in search results, shared links and images. Other people and search engines can copy public information, including before a Recipient joins. Do not include private or sensitive information in your public request.

Private Delivery, unsent drafts, contact details, payment references, internal measurement and support records are not public features. Access to Delivery is limited to its participants and authorised operators who need it for support, security or legal duties. Service providers may process data to run the service.

Why we use it

• Providing your service (GDPR Article 6(1)(b)): account access, requests, drafts, agreed exchanges, Following and necessary communications, to the extent needed for your contract. Required account or transaction information is necessary to provide those features.
• Legal duties (Article 6(1)(c)): accounting, tax and applicable platform reporting, responding to lawful demands and handling statutory rights. Required reporting information cannot be treated as optional; failure to provide it may prevent reportable activity or payment as required by law.
• Legitimate interests (Article 6(1)(f)): protecting accounts and preventing abuse, investigating support problems, establishing or defending claims, and understanding sharing activity to improve the service. Creating public profiles of people who have not joined requires a separate balance of the invitation purpose against their privacy interests. Their public X profile is the source, not their consent or a contract with us.
• Your optional choice: Following email updates start off and can be switched off again. Where consent is required for optional communications, we rely on consent (Article 6(1)(a)); withdrawing it does not affect past lawful processing or necessary transaction notices.

We do not use an automated usefulness score to decide a complaint or refund. Payment and deadline rules apply to the agreed exchange; identity and fraud checks may also be performed by payment providers under their own policies.

Providers and international processing

We use X for sign-in and profile information, Cloudflare for network protection, DNS, object storage and the configured email service, and Hetzner Cloud for application hosting in Germany. Stripe processes payments and payout verification when those features are used. Authorised support and professional advisers may receive information needed for their work. Authorities receive records where the law requires it.

Providers may act as processors on our instructions or as independent controllers for their own services. Their relevant policies are available from X, Cloudflare and Stripe. We do not sell your private feedback or make it public as part of these services.

Provider processing can involve countries outside the European Economic Area. A European storage location does not mean all processing stays in the EU. International transfers require an applicable adequacy decision or appropriate safeguards, such as standard contractual clauses, as relevant to the provider and transfer. Contact us for information about the safeguards applicable to your data and how to obtain a copy.

Cookies and sharing measurement

We use functional cookies for sign-in, account security, draft recovery and abuse prevention:

Blocking necessary cookies can prevent sign-in or draft recovery. Sharing measurement records visits and actions on our server without an attribution cookie. A one-hour attribution window limits matching; it does not mean the underlying records are anonymous or deleted after one hour.

How long we keep information

• Accounts and profiles: while needed for the active service and justified access to account or Offer history, subject to closure, correction, objection and erasure requests.
• Delivery and media: for the agreed ongoing access of the participants. We assess removal against each participant’s rights, outstanding obligations and necessary evidence, and minimise or redact retained information where possible.
• Drafts: while needed to resume the request or feedback being prepared. Completion, abandonment, account closure and deletion requests determine whether draft material still has a purpose; a cookie’s lifetime does not set the draft’s retention period.
• Security, email and measurement records: only for the relevant abuse investigation, delivery or suppression control, or assessment of sharing activity. We review whether individual-level records remain necessary once that purpose ends, retaining only limited evidence for a continuing dispute or legal duty.
• Tax records: until the applicable tax obligation expires, generally five years from the end of the year in which that tax was due, subject to statutory extensions. Applicable platform-reporting records are kept for five years from the end of the year in which the reporting deadline expired. These duties do not justify retaining all private feedback.
• Complaints and claims: the evidence needed during the applicable limitation period or proceedings. A specific legal hold may require longer retention; it does not make every account record permanent.

Deletion may be partial where another person’s rights or a legal obligation requires limited retention. We explain the reason and restrict retained material to that purpose.

Your rights, including before you join

You can request access, correction, erasure, restriction or portability where applicable, and object to processing based on legitimate interests. You can withdraw consent for optional processing at any time. Contact [email protected] with the relevant profile or information. No account, X sign-in or payment is required. We may ask for proportionate evidence of identity to protect your information.

We normally respond within one month. If the law permits more time because of complexity or the number of requests, we explain the extension within that first month. If we cannot grant a request in full, we explain why and the available remedies.

Company details