Privacy Policy
Effective date: to be set
This Privacy Policy explains how H4CF2, LLC (“H4CF,” “we,” “us,” or “our”) collects, uses, shares, and protects personal information across h4cf.com and our products: LetterCircuit, Penspoke, TxtSndr, and Homes For Cash Fast (each a “Product”). Part 1 applies to every Product. Part 2 explains what each Product collects and anything that differs. We are a California business.
Part 1. How we handle information across every Product
1. What we do not do
We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as California law defines those terms. We do not sell or give the names, addresses, or phone numbers you give us about other people to anyone for their own use. Mobile phone numbers and text message consent are never shared with anyone for their own marketing.
2. How we use information
We use information to run each Product for you: to create and manage accounts, to write and mail the pieces you order, to send the text messages you signed up for, to look at a property you asked us about and contact you about it, to take payment, to answer you, to keep records, to understand and improve our sites and apps, to protect against fraud and abuse, and to meet our legal and tax obligations.
3. Who we share information with
We share information with service providers so they can do work for us. They may use it only to provide that work. Part 2 lists the providers for each Product. We may also disclose information if the law requires it, to enforce our Terms, or to protect the rights, safety, or property of our users, others, or us. If a business or Product is sold or merged, information may transfer as part of that deal, subject to this policy.
4. Payments
Card payments are processed by Stripe. Stripe handles your card details. We never store your full card number. We keep records of transactions and amounts charged.
5. Analytics, cookies, and Global Privacy Control
Some of our sites and apps measure how they are used. We do not send your name, email address, postal address, phone number, or message content to analytics providers. Where a Product’s website runs analytics, it honors a Global Privacy Control (GPC) signal from your browser. Part 2 explains which tools each Product uses and how to turn them off.
6. Security
We use reasonable administrative, technical, and organizational measures to protect personal information, including access limits and encryption in transit. No method of storage or transmission is completely secure, and we cannot promise perfect security.
7. Your California privacy rights
If you are a California resident, you have the right to know what personal information we collect, to delete it, and to opt out of its sale or sharing (we do neither). For LetterCircuit, Penspoke, and TxtSndr you can also ask us to correct it, and for LetterCircuit and Penspoke you can ask for a copy. We will not treat you differently for using these rights. To use them, contact the Product you dealt with (see section 10). For LetterCircuit and Penspoke, we verify your request before acting on it. If you gave us information about other people, you are responsible for having had the right to give it.
8. Children
LetterCircuit and Penspoke are not for anyone under 18. They do not knowingly collect personal information from anyone under 18. If you believe a minor has given LetterCircuit or Penspoke information, contact that Product and we will delete it. TxtSndr is not directed to children and does not knowingly enroll anyone under 18 as a resident subscriber.
9. h4cf.com
h4cf.com is a set of static pages that publish our policies. It has no forms and does not ask you for personal information. No analytics are planned for h4cf.com; if we add any, we will name them here. homesforcashfast.com is a separate site with its own forms, covered in Part 2, section D.
10. How to reach us
- The company as a whole: [email protected]
- LetterCircuit: the contact form at lettercircuit.com/contact, topic “Privacy request or delete my account”
- Penspoke: the contact form at penspoke.com/contact
- TxtSndr: [email protected]
- Homes For Cash Fast: [email protected], 510-560-6300, or 5424 Sunol Blvd, Ste 10 PMB 1068, Pleasanton, CA 94566
11. Changes to this policy
We may update this policy. If we make a material change, we will update the effective date and take reasonable steps to tell you.
Part 2. Product details
A. LetterCircuit
What we collect.
- Account: your name, email address, and sign-in credentials, or your Google sign-in identity if you use Google to sign in.
- Recipients: names and mailing addresses of the people you send cards or letters to. This is personal information about other people that you provide.
- Messages: the text, images, and other content you create or upload to be written and mailed.
- Handwriting samples: handwriting sheets you upload to create a custom handwriting style.
- Billing: transaction records, wallet balances, and amounts charged.
- Contact form: your name, email address, topic, and message, a one-way hash of your IP address, and your browser’s user agent. We use these only to answer you and to limit abuse.
- Usage and device: log data, IP address, device and browser type, pages viewed, and actions taken.
Recipient addresses. We send recipient addresses to Google and the United States Postal Service to check and standardize them.
Service providers.
| Provider | What it does |
|---|---|
| Supabase | Sign-in and the application database (account, workspace, contact, and order data) |
| Stripe | Payment processing and wallet billing |
| Vercel | Website and web application hosting |
| Railway | Backend services and mail fulfillment workers |
| Cloudflare | DNS, content delivery, network security, and a bot check on forms (Turnstile) |
| Optional “Sign in with Google,” recipient address checking, and Google Analytics 4 through Google Tag Manager | |
| United States Postal Service | Recipient address checking and standardization |
| Resend | Transactional and account email |
| PostHog | Product analytics and masked session replay |
Analytics and your choices. On lettercircuit.com, PostHog and Google Analytics 4 load only after you choose “Allow additional” in the consent banner. “Strictly necessary only” loads neither. You can change your choice with the “Privacy choices” link in the footer. In the signed-in application, PostHog also records masked sessions: form inputs, postal addresses, message contents, and API keys are masked and not recorded. In the application we link events to an internal account identifier and your email domain only. LetterCircuit does not use advertising networks. You can turn analytics off in Account settings, under Privacy, by unchecking “Allow analytics tracking.” That choice applies to the browser where you make it. Analytics cookies start with “ph_” (PostHog) and “_ga” (Google Analytics). A local storage item, lc_consent, records your consent choice.
How long we keep it.
- Account information: while your account is open.
- Recipients and messages: while your account is open and as needed to keep a record of your orders. Deleted on account closure or on request, subject to legal and tax holds.
- Handwriting samples and custom styles: while the style exists in your workspace. Deleted when you delete the style or close your account, or sooner on request.
- Billing and transaction records: as long as tax and accounting law requires.
- Analytics: under our analytics providers’ retention settings.
Deleting your account. Use the account deletion option in your account settings, or the contact form.
B. Penspoke
What we collect in the app.
- Account: your email address and sign-in identity. If you sign in with Google, we receive your name and email from Google. We never receive your Google password.
- Recipients: the name and mailing address of each person you send a card to. These are saved on your device. When you place an order, that order’s recipient name and address are sent to us so we can write and mail the card.
- Your card: the message you write and the card front you choose. If you upload your own image as a card front, we collect that image.
- Payment: a record of the transaction and, if you give one, a billing address.
- Postal code lookup: when you enter a recipient’s postal code, the app sends the code and country to an outside postal code lookup service to suggest the city and state. We do not send the recipient’s name, street, or your message to it.
- App usage: PostHog measures which screens you open and the steps you take to place an order. You can turn this off with a switch in the app’s settings. The app does not use Google Analytics.
What we collect on penspoke.com. PostHog and Google Analytics 4 (through Google Tag Manager) measure page use, approximate location from your network address, and device and browser type. They load only if you have not opted out. You can opt out with the “Do Not Sell or Share My Personal Information” option on the Penspoke privacy page. When you opt out, we delete those cookies and do not load either tool again in that browser.
Contact form. Your name, email address, topic, and message, plus a one-way scrambled form of your IP address, your browser type, and the time you sent it. We also run an automated check that you are a person.
Service providers.
| Provider | What it does |
|---|---|
| Supabase | Sign-in and the application database (account and orders) |
| Stripe | Payment processing, when payment is turned on |
| Optional “Sign in with Google,” and Google Analytics on penspoke.com only | |
| PostHog | Product analytics in the app and on penspoke.com |
| An address checker | Checking and standardizing recipient addresses |
| Cloudflare | Website hosting, storing contact form messages, and the check that you are a person |
We also use providers for hosting, for account and order email, for storing a card front you upload, and for carrying the mail.
How long we keep it.
- Account, and the recipient and message details on your orders: while your account is open. After you delete your account, held for 30 days, then permanently deleted, or sooner on request, subject to legal and tax holds.
- A card front you upload: while your account is open, or one year from upload, whichever is longer. Deleted when your account is permanently deleted.
- A redacted record of each order and payment (recipient, billing, and message removed): seven years from the order date, then deleted.
- Contact form messages: 24 months, then deleted, or sooner on request.
- Analytics: under our analytics providers’ retention settings.
Deleting your account. In the app, open Account and tap Delete my account. Your account closes right away and is held for 30 days, during which you can ask us to restore it. After that it is permanently deleted. See penspoke.com/delete-account for the details.
C. TxtSndr
TxtSndr has its own terms and privacy policy at txtsndr.com.
TxtSndr is offered under its own Privacy Policy at txtsndr.com/privacy, which names the company responsible for TxtSndr. Where that policy differs from this one, it controls for TxtSndr. In short:
- What it collects. Resident mobile number, property or community, unit or address if given, text subscription status, and consent records (timestamp, source, and the exact disclosure version agreed to). Message and delivery data (message body, type, provider message ID, send time, and delivery status). Contact details for property administrators. The browser user agent and related details at the moment of opt-in, for the consent record.
- How it uses it. To send the reminders you asked for, run the service, prevent abuse, meet legal duties, and record and honor opt-outs.
- Who it shares with. Twilio (text delivery, delivery status, and opt-out processing) and hosting and infrastructure providers, under written contract.
- Opting out. Reply STOP to any message. Further messages stop on STOP or a clear equivalent.
- How long it keeps it. Consent and delivery records are kept as long as needed to meet legal duties, defend claims, and run the service. Some records are kept even after an opt-out or account closure because the law requires them.
D. Homes For Cash Fast
What we collect when you ask for a cash offer.
- Your name, phone number, and email address (optional).
- The address of the property you want to sell.
- Your consent to calls and texts, with the date and time you gave it.
- How you found us: referring page, campaign tags, and the page where you used the form.
- Usage data collected through Google Analytics: IP address, browser and device type, pages visited, referring page, and approximate location from IP address.
To limit spam, the form uses your IP address to throttle repeat submissions.
Where it goes. Form submissions are stored in our customer relationship management system (Twenty). We use them to look at your property, decide whether it fits what we buy, make and send you an offer, and talk with you about the sale. We may share them with our team and, if a sale goes forward, with the title company, escrow officer, and attorneys needed to close it. We send email through Resend. Cloudflare hosts homesforcashfast.com and runs the spam limit on the form.
Analytics. Google Analytics 4 measures how the website is used. It sets first-party cookies such as _ga. If your browser sends a Global Privacy Control signal, the site does not load Google Analytics. Pages that can show a named person’s information, such as a property offer page, do not load Google Analytics. We have turned off Google signals and data sharing with other Google products, and analytics data is kept for 2 months. You can also opt out at tools.google.com/dlpage/gaoptout.
Calls and texts. If you check the consent box on the form, we may call or text you at the number you gave about the sale of your property. Consent is not a condition of any purchase or service. Message and data rates may apply. Reply STOP to any text to opt out, or contact us.
How long we keep it. As long as needed to finish a sale and to meet our legal and tax record keeping duties. After that, we delete or anonymize the information.