Privacy Policy

Vespera (“we”, “us”) operates vesperanights.com, where you buy and host narrated evenings called Nights. For data-protection law, the controller of your personal information is the operator of Vespera, and the fastest way to reach her is aliia@kozlo.ski. This policy explains what we collect, why, who processes it for us, how long it lives, and the rights you have over it.

• There are no accounts and no profiles.
• There is no advertising, no ad tracking, and no analytics script on this site.
• We never sell, rent, or trade personal information, and never will.
• What you write during a Night stays in your own phone’s storage. It reaches us only if you ask for a morning letter and tick the box to include your lines.
• We hold an email address only when you give it to us for a specific reason, and we use it for that reason alone.

The doorway list. If you leave your email to hear when new Nights open, we store that address with the signup time in a private repository we control. We use it to send the occasional letter about new Nights — nothing else. Legal basis: your consent, which you can withdraw at any time by asking off the list.

The morning letter. If you request a letter at the end of a Night, we receive your email address, which Night it was, and the morning time your own phone proposed. The lines you wrote are included only if you tick the box that says so; without the tick they never leave your device. We use all of it once, to typeset and send your letter. Legal basis: performing what you asked for, and your consent for the lines themselves.

Purchases. Payment happens on Stripe’s hosted checkout page. Your card number goes to Stripe and never touches our servers. From a completed purchase we receive the email address you used, which Night you bought, and the payment status, so we can send your unlock link and honor refunds. Legal basis: performing the contract, and our legal obligations around bookkeeping.

Gifts. If you send a Night as a gift, the recipient’s email address, your name, and your note travel with the purchase so we can address the unlock letter to her. We use the recipient’s address once, for that delivery, and it is not added to any list. Please only give us an address you are allowed to share.

The unlock key. When you unlock a Night, we set one cookie for that Night. It holds a cryptographically signed proof of purchase — no name, no email, nothing about you. Details in section 6.

Server logs. Like every website, our hosting provider produces short-lived technical logs (IP address, requested page, time) that we use to keep the site up and to diagnose faults. Legal basis: our legitimate interest in running a working, safe service.

The writing pages of a Night save into your device’s own browser storage. That text is not sent to us, and we could not read it if we wanted to. It leaves your phone in exactly one case: you request the morning letter and tick the box to include your lines. You can erase it yourself at any time with the begin-again link on the writing page, or by clearing the site’s data in your browser.

Four providers handle data on our behalf, each only for its own job, each bound by its own data-processing terms:

• Stripe — payments. Card details go to Stripe directly; see stripe.com/privacy.
• Resend — sends the emails we owe you (unlock letters, morning letters); see resend.com/legal/privacy-policy.
• GitHub — hosts the private, access-restricted store where doorway signups, letter requests, and order records live; see github.com/site/privacy.
• Vercel — hosts the site and produces the technical logs in section 3; see vercel.com/legal/privacy-policy.

These providers operate in the United States, so your information may be processed there. Each of them commits to recognized safeguards for international transfers (including standard contractual clauses) in their data-processing agreements. We share nothing with anyone else, and no one buys access to anything.

This site sets exactly one kind of cookie: an unlock key, one per Night you have unlocked. It is scoped to the play pages, marked secure and httpOnly, contains only a signed proof of purchase, and lasts two years so the door stays open on your next visit. It is strictly necessary for delivering what you bought, which is why there is no cookie banner: there is nothing optional to consent to. There are no advertising, analytics, or third-party cookies. Browser storage is used only for your own writing, as described in section 4.

• Doorway-list address: until you ask off the list, or we close the list.
• Morning-letter requests: until the letter is sent, plus a short window to make sure it arrived. Captured requests that could not send immediately are deleted once the letter goes out.
• Order records: as long as needed to honor refunds and support, and as bookkeeping law requires.
• Unlock cookie: two years, in your browser, deletable by you at any time.
• Hosting logs: short-lived, on our provider’s standard rotation.

Wherever you live, you can ask us what we hold about you, ask us to correct it, ask us to delete it, ask for a copy you can take elsewhere, object to a use, or withdraw a consent you gave. Write to aliia@kozlo.ski and it is done within the same week — deletion included, except order records the law makes us keep. If you are in the EU or UK, you also have the right to complain to your local data-protection authority. If you are in California: we do not sell or share personal information as the CCPA defines those terms, and the rights above cover knowing, deleting, and correcting.

Vespera is made for adults. The site is not directed at children, we do not knowingly collect information from anyone under 16, and purchasing requires being at least 18. If a child has given us an address, write to us and we will delete it.

Everything travels over HTTPS. Unlock keys are cryptographically signed so they cannot be forged. Card numbers never reach our servers. The private stores that hold addresses and orders are access-restricted to the operator. No system is perfect; if a breach ever affects your data, we will tell you plainly and quickly.

If our data practices change — for example, if we ever add privacy-respecting traffic measurement — this page changes first, the date at the top moves, and material changes are announced on the site before they take effect. We will never quietly broaden what we collect.

Questions, requests, complaints, doubts: aliia@kozlo.ski. A human answers. See also the Terms of Service.