Pen Friend Club

Privacy Policy

Last updated: 11 November 2026

This page explains what personal data Pen Friend Club collects, why we need it, who can see it and what you can do about it. We've tried to keep it short and in plain English.

Who we are

Pen Friend Club is run by Timrus apps Oy, business ID (Y-tunnus) 3252439-4, Arabiankatu 4 C 82, 00560 Helsinki, Finland. We are the controller of your personal data under the EU General Data Protection Regulation (GDPR).

If you have a question about your data, write to support@penfriendclub.com. We reply in English.

What we collect

Things you give us

Account details: your name, email address and password. We never see your password in plain text.
Profile: your country, a short text about yourself and the character you choose. We don't ask for a photo of you.
Mailing address: the address where you want to receive postcards.
Messages and photos you send in chat once a bridge is built.
Reports you send us about other members, and anything you write to our support.

Things we record while you use the club

Who you were paired with and when, the secret words for your postcards, and when each word was typed in.
Who you've blocked or reported.
Basic technical data: device type, app version, IP address and error logs. We use these to keep the service working and secure.

From other services

If you pay through the App Store, Google Play or our payment provider, we get the status of your membership (active, cancelled, renewal date). We never receive your card number.

We don't know what you write on your postcards. They travel by ordinary post and never pass through us.

How we use your data and why

What we do	Data used	Legal basis
Create and run your account	Account details, profile	Our contract with you
Pair you with a pen friend each Monday and show them where to send their postcard	Name, country, character, profile text, mailing address	Our contract with you
Check secret words and build bridges	Pairing and word records	Our contract with you
Chat and photo sharing	Messages and photos	Our contract with you
Handle payments and your membership	Membership status, email	Our contract with you; our legal duty to keep accounting records
Keep members safe, review reports, stop abuse and fraud	Reports, blocks, relevant messages, technical data	Our legitimate interest in a safe club
Send service emails (new pen friend, postcard arrived, payment receipts)	Email address	Our contract with you
Tell you when the iPhone and Android apps come out, and other club news	Email address	Our legitimate interest; you can opt out in any email

We don't sell your data, and there are no ads inside the club.

What your pen friend sees

When you're paired with someone, they see your first name, country, character and profile text. They also see your mailing address so they can send you a postcard.

Your address is shown to your pen friend only during that exchange. It disappears from their app once both postcards have arrived, or after 90 days, whichever comes first. Other members never see it.

Please keep in mind: once someone has written your address on a postcard, we can't make them forget it. Only share an address you're comfortable giving to a fellow member. Some members use a P.O. box.

After a bridge is built, you and your pen friend can see each other's chat messages and photos. If you block someone, they can no longer message you or see your profile.

We use a small number of service providers to run the club. They process data only on our instructions and under a data processing agreement:

Hosting and database: our cloud hosting provider
Email delivery: the provider we use to send account and reminder emails
Analytics: PostHog, which keeps the data in the EU (only if you agree to cookies)
Advertising: Meta Platforms (Facebook and Instagram), to measure our ads (only if you agree to cookies)
Payments: Apple (App Store), Google (Google Play) and Stripe for payments on our website. Apple and Google handle in-app payments under their own privacy policies.

We may also share data if the law requires it, for example with the police when we receive a valid legal request, or to protect someone's safety.

Data outside the EU

We aim to store your data in the European Union. Some of our providers are based in the United States or may access data from there. When that happens, we rely on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses to protect your data.

How long we keep your data

Your account, profile and address: for as long as you're a member. When you delete your account, we delete them within 30 days.
Chat messages and photos: until you delete your account. Your pen friend will no longer see messages from a deleted account.
Backups: deleted data can stay in encrypted backups for up to 35 days before it is overwritten.
Payment records: kept as long as Finnish accounting law requires, which is usually 6 years.
Safety reports: up to 2 years, so we can spot repeated problems.
Technical logs: up to 90 days.

Your rights

Under the GDPR you can ask us to:

give you a copy of your data,
correct data that's wrong,
delete your data,
limit how we use it, or object to how we use it,
send your data to you in a file you can take elsewhere.

You can change most things yourself in the app under Profile, and you can delete your account there too. For anything else, email support@penfriendclub.com. We answer within one month.

If you think we've handled your data badly, you can complain to the Finnish Data Protection Ombudsman at tietosuoja.fi, or to the data protection authority in your own country. We'd be grateful if you contacted us first so we can try to fix it.

Cookies

The app and website store a small amount of data on your device so you stay signed in. That storage is needed for the service to work, so we don't ask for consent for it.

If you agree (where the law requires it, we ask the first time you visit), we also use:

PostHog, to count how many people reach each step of joining, so we can see where things are confusing. PostHog keeps this data in the EU.
Meta Pixel, to learn which of our ads on Facebook and Instagram bring people to the club. When you start a membership, our server also tells Meta about it, with your email address scrambled (hashed) so it can't be read.

If you say no, none of this is used and the club works the same. You can change your mind at any time from Help & support.

Age limit

Pen Friend Club is for adults. You must be 18 or older to join. If we learn that an account belongs to someone under 18, we will close it and delete the data.

Security

We use encrypted connections, store passwords only in hashed form and limit who on our team can see member data. No system is perfectly safe, so if we ever have a data breach that puts you at risk, we'll tell you and the authorities as the law requires.

Changes to this policy

If we change this policy in a way that matters, we'll tell you by email or in the app before the change takes effect. The date at the top shows when it was last updated.

Questions? Write to support@penfriendclub.com.