Privacy & security

Your letters are sealed before they leave the page

When you hand in a letter it is encrypted in your browser with AES-256-GCM, under a key that never leaves your device. What reaches LunaStamp Logistics is a block of unreadable text and the random number used to encrypt it. There is no key on the server to go with it. Nobody here can read a letter — not an engineer, not an administrator, and not anyone who obtains a copy of the database.

Why your password is stretched twice

Your password is run through PBKDF2-SHA256 600,000 times, twice, under two different random salts. One result proves to us that you are you. The other unlocks your letters. They are separate values, and the one we hold cannot be turned into the one we do not.

That is the difference between a service which stores your letters encrypted and one which genuinely cannot read them. If the key were derived from the same value we check, then the check itself would be a way in — and "end-to-end" would be a claim rather than a fact.

The letters themselves are encrypted with a random key, and your password merely unlocks that key. Changing your password re-locks one small value; your letters are not touched and are not re-uploaded.

What we store

Your email address, so you can sign in. It is never shown to anyone you write to.
Your handle, which is public by design — it is the address people write to.
A hash of the value your browser derives from your password. Not the password.
Your wrapped key: a locked box whose key only you hold.
Sealed letters, and the dates they were handed in and delivered.
Whether a correspondence is open or closed, and whose turn it is.

No advertising identifier, no analytics, no third-party script, no tracking pixel. The page loads nothing from any other host — you can confirm that in the Content-Security-Policy header, which permits only this origin. Fonts are served from here, not from a font network.

The limits, stated honestly

End-to-end encryption has a genuine boundary, and it is usually left out of the marketing paragraph. Ours is this.

We deliver the code that does the encrypting. A determined server — or anyone who compromises it — could serve a modified page that captured your key as you typed your password. The strict Content-Security-Policy we set narrows that considerably, and the native app we are building can pin exactly which code runs. On an ordinary web page it cannot be closed completely. This is a property of every browser-based encryption tool, not a shortcoming unique to us.
We cannot reset your password. We hold no key, so we cannot hold a spare. Lose your password and your recovery code and your letters are gone — not withheld, gone. We would rather say that plainly than discover it with you later.
Metadata is not encrypted. We know that one account wrote to another, and when. We do not know, and cannot learn, what was said. This is the position every courier has ever been in.
Your handle is public. Anyone may visit lovelink.to/yourhandle and see that it exists and whether it is currently mid-correspondence. They cannot see who you are or what you have written.

The recovery code

When you claim a handle we show you a 32-character code, once. It wraps the same key your password does. It is the only route back into your letters if you forget your password, and we cannot reissue it. Keep it somewhere that is not the device you read your letters on.

Deleting things

Ending a correspondence closes it for both of you. To have your account and its letters removed entirely, write to privacy@aerialgiant.com from your registered address. Because we cannot read your letters, deletion is the only thing we can do with them.

Contact

security@aerialgiant.com — we would rather hear about a flaw than not hear about it.

LunaStamp Logistics is the in-app mail service of LoveLink, operated by Aerial Giant Inc. Last updated 18 September 2026.