Nobody here can read your letters.

Your letters are sealed before they leave the page

When you dispatch a letter it is sealed in your browser with AES-256-GCM, under a key made for that one letter and wrapped to the person it is for. What reaches Lunastamp Logistics is a block of unreadable text and a key that is itself locked — and there is nothing here that opens either. Nobody can read a letter — not an engineer, not an administrator, and not anyone who obtains a copy of the database.

Each mailbox holds a pair of keys, made in the browser when the handle is claimed. The public half is the one handed to whoever writes to you, so that a letter can be locked to it. The private half never leaves your device, and it is what opens the letters that arrive. We hold the public half, and the private half only as a box we cannot open.

Why your password is stretched twice

Your password is run through PBKDF2-SHA256 600,000 times, twice, under two different random salts. One result proves to us that you are you. The other unlocks your letters. They are separate values, and the one we hold cannot be turned into the one we do not.

That is the difference between a service which stores your letters encrypted and one which genuinely cannot read them. If the key were derived from the same value we check, then the check itself would be a way in — and "end-to-end" would be a claim rather than a fact.

Two things are wrapped under that second value: the private half of the pair your letters arrive under, and the key that seals the drafts this browser keeps. Neither is derived from the value we check, so the check itself is not a way in. Setting a new password — which is what a recovery code is for — re-wraps those two under a fresh one and touches nothing else: your letters are not re-encrypted and not re-uploaded, because they were never sealed to your password in the first place.

What we store

• Your email address, so you can sign in. It is never shown to anyone you write to.
• Your handle, which is public by design — it is the address people write to.
• Your inscription, if you write one. The line under your handle is the one thing you leave open, so it is held in the clear, for anyone who opens your page to read.
• A hash of the value your browser derives from your password. Not the password.
• The pair your letters travel under: the public half in the clear, and the private half only as a locked box your password or your recovery code opens.
• The key the drafts in this browser are sealed with, locked the same way.
• Sealed letters, and the dates they were dispatched, delivered and read.
• Whether a correspondence is open or closed, and whose turn it is.
• The ledger from the counter: what you paid, and the shillings your letters spent.

No advertising identifier, no analytics, no third-party script, no tracking pixel. The page loads nothing from any other host — you can confirm that in the Content-Security-Policy header, which permits only this origin. Fonts are served from here, not from a font network. The one thing that happens off this origin is a payment: the counter hands you to Stripe's own page, and no card number is ever entered on a page we serve.

The limits, stated honestly

End-to-end encryption has a genuine boundary, and it is usually left out of the marketing paragraph. Ours is this.

• We deliver the code that does the encrypting. A determined server — or anyone who compromises it — could serve a modified page that captured your key as you typed your password. The strict Content-Security-Policy we set narrows that considerably: every script the page runs comes from this origin, and no other origin may supply one. loveLINK is a web page and nothing else — there is no application to install, and no second copy of the code to hold up against the one that is served. On an ordinary web page the gap cannot be closed completely, and we do not pretend to close it. This is a property of every browser-based encryption tool, not a shortcoming unique to us.
• We cannot reset your password. We hold no key, so we cannot hold a spare. Lose your password and your recovery code and your letters are gone — not withheld, gone. We would rather say that plainly than discover it with you later.
• Metadata is not encrypted. We know that one account wrote to another, and when the letter was carried, delivered and read. We do not know, and cannot learn, what was said. This is the position every carrier has ever been in.
• Your handle is public. Anyone may visit lovelink.to/@yourhandle and see that the handle exists, the day it was claimed, the inscription you have left there, and whether it is currently mid-correspondence. They cannot see who you are, which address the mailbox answers to, or what you have written.

The recovery code

When you claim a handle, a 32-character code is made in your browser — eight groups of four, from a 32-symbol alphabet — shown to you once, and posted to your address once, so that a closed window does not lose it. What we keep is a check value we can weigh the code against; the code itself is not in it, so nothing here can be read back as the code, and no one at Lunastamp can use what we hold to open a mailbox.

The code wraps your mailbox the way your password does — the private half your letters are opened with and the key your drafts are sealed with — and it is the only route back in if you forget your password. We cannot reissue it, so keep it somewhere that is not the device you read your letters on. Use a recovery code.

It is also the only thing that closes a mailbox: deleting your account asks for this code and nothing else. There is no other way to prove the mailbox is yours.

Deleting things

A correspondence lapses when a turn goes unanswered.

No letter is taken back once dispatched.

Close your account from inside the mailbox using your recovery code, and the account is emptied — address, inscription, keys, drafts — every correspondence you were in is closed, and the balance of shillings forfeited.

The letters stay. Nothing is taken from anyone else's letterbox, and each one carries the notice that the account at the other end is gone. Two things of yours stay with them: the handle the letters were written under, and the published half of the key that opens them. Without that half, the letters you wrote would stop opening. Your handle is frozen for three months before it is offered to anyone, so a name cannot change hands while letters are still addressed to it.

We cannot read any of it; what stays, stays with whoever holds it.

Contact

hello@lovelink.to — we would love to hear from fellow encryption nerds.

Last updated 24 September 2026.