kössy privacy notice
Last updated: 25 October 2026
Summary
kössy lets you write a thank-you letter (a kössy letter) to someone and send it to them as a link. You do not need an account, and we do not ask for your email address or phone number. We store the letter so that the person you send the link to can open it, check every letter automatically before we store it so that hurtful messages do not get through, and delete it on a fixed schedule. We do not sell personal data, show no ads, do not use letters for advertising, and do not pass them on to anyone unless the law requires it.
Someone at kössy reads your letter only if the recipient reports it as hurtful, or if an authority lawfully requires it. Every such case is logged.
Who is responsible for your data
The controller of your personal data is Creego Six Consulting Kft., registered office: 2161 Csomád, Szent István utca 19. A. ép. fszt. 3., company registration number: 13-09-209203, tax number: 28949437-2-13 (“kössy”, “we”).
Contact for any privacy question or request: creegosix@gmail.com.
What this notice covers
This notice covers the kössy website at kossy.eu and its subpages, including writing a letter, opening a letter, reporting a letter and contacting us. It applies to everyone whose data we handle there: the person who writes a letter (sender), the person who receives it (recipient), anyone else named in a letter, and visitors of the website.
What data we handle, why, and on what legal basis
Writing and delivering a letter
Data: the text of the letter, the recipient’s name as you write it, your name (unless you send it anonymously), the language of the recipient’s page, and the time of creation, first opening and expiry. We also store a fingerprint (hash) of the access code from the link and of the code that lets you withdraw the letter. The part of the link after the # sign stays in the browsers of the sender and the recipient and is never sent to us.
Purpose: to store the letter and show it to the person who opens it with the link.
Legal basis: for the sender, performance of the contract for using kössy (Article 6(1)(b) GDPR, see the terms of use). For the recipient and anyone else named in the letter, our and the sender’s legitimate interest in delivering a thank-you that the sender wants to send (Article 6(1)(f) GDPR). We think this interest is not overridden by the recipient’s interests, because a thank-you letter is meant for them, it reaches only whoever has the link, it is checked for hurtful content, and the recipient can report it or delete it.
Please note: write only what is needed for your thank-you. Do not include health data, contact details, identity numbers or other sensitive information about yourself or others. If a letter contains such data, it is because the sender wrote it there, and we handle it only to deliver the letter.
Automated safety check
Data: the text of the letter, the recipient’s name and the sender’s name, checked on their own and together.
Purpose: to stop hurtful, mocking, hateful, sexual, violent or otherwise harmful messages before they are stored. The check is automatic: if it finds such content, the letter is not saved and you can rewrite it. The check does not make any other decision about you and has no legal or similar effect on you.
Legal basis: our legitimate interest, and that of recipients, in a safe service (Article 6(1)(f) GDPR).
How: the check runs on Amazon Bedrock Guardrails in data centres inside the European Union. The provider does not keep the text after the check, and we log only which filter refused a letter, never the text itself.
Withdrawal, expiry and deletion
Until the recipient first opens it, the sender can withdraw a letter on the page where it was written. After that, the link shows that the letter was deleted. The withdrawal code exists only on that page: once you close it, you can no longer withdraw the letter yourself, but you can ask us to (see “Your rights”).
The recipient can delete the letter on the letter page at any time. After that, the link shows that the letter was deleted, and from that moment nobody can open it. We keep a withdrawn or deleted letter for 3 months, so that we can investigate a report or a complaint about it, and then it is deleted automatically for good.
Protecting the service against abuse
Data: your IP address, browser type, the time and address of requests, and a security token stored in your browser when you open the writing page (see “Cookies”).
Purpose: to block automated scripts and mass sending, limit the number of requests from one place, investigate attacks and keep the service running. This also applies when you send a letter anonymously: the recipient does not see who you are, but this technical data is kept for a short time.
Legal basis: our legitimate interest in the security of the service (Article 6(1)(f) GDPR).
Reports of hurtful letters
Data: the reported letter, the fact and time of the report and its reason, and our decision.
Purpose: to review the letter and remove it if it breaks the rules (see “Content and reporting rules” in the terms of use).
Legal basis: compliance with our obligations as a hosting service under the Digital Services Act (Regulation (EU) 2022/2065, Article 6(1)(c) GDPR) and our legitimate interest in protecting recipients (Article 6(1)(f) GDPR).
Reviewing a reported letter is one of the exceptional cases when kössy staff read a letter. Every such access is logged.
Requests from authorities
If a court, the police or another authority lawfully requires it, we disclose the data we hold about a letter (Article 6(1)(c) GDPR). We disclose only what the order covers. Since we do not ask for names, contact details or accounts, this is often very little.
Usage statistics
Data: which pages of the live site are visited and when, with any letter identifier and link code removed from the address, and your browser type. Each visit counts as a new one: we do not recognise returning visitors and build no profiles. After writing a letter you can answer an optional question (“How was it to write?”); we only count the answers, without linking them to your letter.
Purpose: to understand whether kössy works for people and to improve it. We count letters delivered, not people.
Legal basis: our legitimate interest in improving the service (Article 6(1)(f) GDPR). We collect these statistics without cookies or browser storage and without identifying you, and they never contain the text of a letter, any name or a letter’s identifier.
How: PostHog Inc., EU cloud (data stored in Frankfurt). PostHog receives your IP address and browser type with each request, but is set to discard IP addresses, so they are not stored. Session recordings, heatmaps and automatic click tracking are switched off.
Contacting us
Data: your email address, your name if you give it, and the content of your message.
Purpose: to answer your question, request or complaint.
Legal basis: our legitimate interest in answering you (Article 6(1)(f) GDPR); for requests about your rights, our legal obligation to answer (Article 6(1)(c) GDPR).
Link previews
When you share a letter link in a messaging app (for example Messenger, WhatsApp or Viber), the app’s provider fetches a preview of the page. The preview is the same for every letter (“You have received a kössy letter”) and contains no text, name or other detail of the letter. The preview is handled by the messaging app under its own privacy policy.
How long we keep data
| Data | How long |
|---|---|
| A letter that is never opened | Deleted 90 days after it was written. |
| A letter that was opened | Kept until one year after the last opening. Each opening extends this by a year from that day. |
| A withdrawn or deleted letter | Cannot be opened from the moment of withdrawal or deletion, and is deleted automatically for good 3 months later. |
| Backups | Deleted letters may remain in backups for up to 35 days, after which they are removed. Backups are used only to restore the service after a failure. |
| Technical and security data (IP address, logs, security token) | 30 days. |
| Report record and decision | As long as the letter exists; if we removed the letter, one year after the decision, so we can answer complaints and authorities. |
| Usage statistics | 24 months, without any data that identifies you. |
| Emails to us | One year after your matter is closed, unless the law requires longer. |
Deletion from the live service happens automatically; the storage system removes expired items within a few days of their expiry, and the letter cannot be opened from the moment it expires.
Who else handles the data
We do not sell or rent personal data, and we do not share it with advertisers. We use the following service providers (processors), who handle data only on our instructions and under a data processing agreement:
| Provider | What for | Where |
|---|---|---|
| Amazon Web Services EMEA SARL (Luxembourg) | Hosting, storage of letters, safety check (Amazon Bedrock), security protection and content delivery (CloudFront, WAF) | Letters and logs are stored in Frankfurt (Germany). The safety check runs only in EU regions (Frankfurt, Ireland, Paris, Stockholm). Web pages are delivered through AWS servers near the visitor, which for visitors in Europe are in Europe. |
| PostHog Inc. | Visit statistics, without cookies | EU (Frankfurt, Germany) |
| Google (Gmail) | Handling emails sent to us | EU and USA (Google is certified under the EU-US Data Privacy Framework) |
Amazon Web Services is part of a US group. If any data reaches the United States, for example for support of the service, the transfer is covered by the EU-US Data Privacy Framework and by the European Commission’s standard contractual clauses.
Security
The services run in the European Union. Access to stored letters is limited to a small number of authorised kössy staff with multi-factor authentication, and every access to production data is logged. Each letter has its own random identifier and an access code that only the link carries; we store only a fingerprint of that code, so we cannot open a letter for someone who lost the link and cannot recreate the link.
If a security incident affects your data, we act as the GDPR requires, including notifying the supervisory authority within 72 hours and informing you where the risk is high and we can reach you.
Your rights
You have the right to:
- ask what data we hold about you and get a copy (access);
- have incorrect data corrected (rectification);
- have your data deleted (erasure);
- ask us to limit the use of your data while a complaint is checked (restriction);
- object to processing based on our legitimate interest, for example as a recipient or as a person named in a letter;
- receive data you gave us in a machine-readable format (portability), where the processing is based on the contract.
Write to creegosix@gmail.com. Because we do not use accounts, we can find a letter only if you send us its link or describe it precisely; we may ask for the link to make sure the letter concerns you. We answer within one month, which we can extend by two more months for complex requests, and we tell you if we do. If you ask us to erase a letter, we delete it for good without the 3-month period, unless we need it to handle a report or a legal claim. Exercising your rights is free.
If you think we handle your data unlawfully, you can complain to the Hungarian supervisory authority: Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH), 1055 Budapest, Falk Miksa utca 9-11; postal address: 1363 Budapest, Pf. 9.; phone: +36 1 391 1400; email: ugyfelszolgalat@naih.hu; website: www.naih.hu. You can also go to court; you may choose the regional court (törvényszék) of your place of residence. We would be glad if you contacted us first, so we can try to resolve the matter.
Cookies
kössy uses no advertising, tracking or analytics cookies. We use one security cookie, which is needed to protect the writing page from bots. You do not need to accept anything.
| Name | Set by | Why | How long |
|---|---|---|---|
| aws-waf-token | kossy.eu (Amazon Web Services WAF, on our behalf) | When you open the writing page, your browser solves a small puzzle in the background and gets this token. Writing a letter requires it, so scripts and bots cannot send letters in bulk. It does not identify you and is not used for anything else. | The token is valid for 24 hours. |
This cookie is strictly necessary for a service you asked for, so the law does not require your consent for it (section 155(4) of Act C of 2003 on electronic communications and Article 5(3) of the ePrivacy Directive).
What we do not store in your browser: kössy does not save the link of your letter or its access code. The code that lets you withdraw a letter exists only while the writing page is open. Visit statistics (PostHog, EU cloud) are collected without cookies, browser storage or similar identifiers. We do not embed social media buttons, videos or maps that would set third-party cookies.
You can delete or block cookies in your browser settings. If you block the security cookie, you can still open letters, but you cannot write one. If we ever want to use a cookie that is not strictly necessary, we will ask for your consent first and update this notice.
Changes to this notice
If kössy changes, for example when accounts, email delivery or paid features arrive, we update this notice before the change takes effect and show the date of the latest version at the top. We tell you about important changes on the website.
Legal background
Regulation (EU) 2016/679 (GDPR); Act CXII of 2011 on informational self-determination and freedom of information (Infotv.); Act CVIII of 2001 on electronic commerce services (Ekertv.); Regulation (EU) 2022/2065 (Digital Services Act).