Legal
Privacy Policy
We believe your family's data belongs to your family. Here's exactly what we collect, why, and how we protect it.
WriteToSanta.ca Privacy Policy
The short version
We collect your child's first name, age, and city, plus a parent email address — only to deliver a personalized Santa reply. We never sell data, never show ads to children, and we delete letter data within 90 days. That's it.
Introduction
Welcome to WriteToSanta.ca. We know that when a site is used by children, privacy isn't just a legal checkbox — it's a fundamental responsibility. This policy explains in plain language how we handle information when your family uses our site.
WriteToSanta.ca is operated from Canada and complies with the Personal Information Protection and Electronic Documents Act (PIPEDA) and, for families visiting from the United States, the Children's Online Privacy Protection Act (COPPA). Where these laws overlap, we follow the stricter standard.
By using WriteToSanta.ca you agree to the practices described below. If you have any questions, the Contact Us section explains how to reach us.
What We Collect
We collect the minimum information required to operate the site. The table below shows every category of data we collect, the reason we collect it, and how long we retain it.
| Data | Purpose | Retained |
|---|---|---|
| Child's first name | Personalize Santa's reply | 90 days after submission |
| Child's age | Age-appropriate letter content | 90 days after submission |
| City / Country | Santa's reply greeting | 90 days after submission |
| Parent email address | Deliver Santa's reply email | 90 days after submission |
| Wish list & message | Write personalized letter | 90 days after submission |
| Browser & device type | Improve site performance (anonymous) | 30 days, anonymized |
| Pages visited | Site usage analytics (anonymous) | 30 days, anonymized |
How We Use It
Information submitted through the Write to Santa form is used exclusively to:
- Generate a personalized reply letter from Santa
- Deliver that letter to the parent's email address via our email provider (Resend)
- Confirm the submission was received
Anonymous usage analytics (pages visited, device type) are used solely to understand how people use the site so we can improve it. This data cannot be traced back to an individual.
We do not use any collected data for advertising, profiling, remarketing, or any purpose other than the ones listed above.
We will never
- Sell or rent your personal information to any third party
- Share data with advertisers or data brokers
- Use children's data to build advertising profiles
- Send unsolicited marketing email
- Use data for any purpose beyond what's stated in this policy
How We Protect It
All data submitted through WriteToSanta.ca is stored in a Supabase-hosted PostgreSQL database with row-level security and encryption at rest. Data is transmitted over HTTPS (TLS 1.2+) at all times.
Access to the database is restricted to the application service role and a single administrator account protected with multi-factor authentication. No third-party personnel have access to raw submission data.
While no system can guarantee absolute security, we apply industry-standard practices and review our security posture regularly.
Children's Privacy
COPPA & PIPEDA Compliance
WriteToSanta.ca is designed for use by children under parental supervision. We do not knowingly collect personal information directly from children without a parent or guardian's involvement. The Santa letter form is addressed to the parent, who submits it on the child's behalf.
Under COPPA, parents of children under 13 (US residents) have the right to review the personal information we have collected about their child, request deletion of that data, and refuse further collection. Under PIPEDA, these same rights extend to all Canadian residents regardless of age.
To exercise any of these rights, contact us at privacy@writetosanta.ca with the subject line Data Request — [Child's First Name].
Minimum Data
We collect only the child's first name, age, city, and parent email — the bare minimum to deliver a personalized Santa reply.
Full Transparency
This policy explains in plain language exactly what we collect, why, and how long we keep it. No legalese, no surprises.
Child Safe by Design
We don't show ads to children, don't build profiles, and don't share data with third parties. COPPA and PIPEDA compliance is non-negotiable.
Data Retention
Santa letter submissions (child name, age, city, parent email, wish list, and message) are retained for 90 days after submission, then permanently deleted from our database. This window allows us to handle re-delivery requests and support inquiries.
Anonymous analytics data (no personal identifiers) is retained for 30 days in raw form, after which it is rolled into aggregated monthly statistics that contain no individually identifiable records.
If you request deletion before the 90-day window, we will delete your submission within 5 business days of receiving the request.
Your Rights
Under PIPEDA (Canada) and COPPA (United States), you have the following rights with respect to personal information we hold about you or your child:
Right to Access
Request a copy of all personal data we hold about your family.
Right to Correction
Request that inaccurate information be corrected.
Right to Deletion
Request that we delete your family's data. We will action deletion requests within 5 business days.
Right to Withdraw Consent
You may withdraw consent for future data collection at any time. This will not affect data already lawfully collected.
Right to File a Complaint
If you believe your rights have been violated, you may file a complaint with the Office of the Privacy Commissioner of Canada at priv.gc.ca.
Contact Us
If you have questions about this policy, wish to exercise your rights, or have a concern about how your family's data is handled, please get in touch.
Questions about your privacy?
We aim to respond to all privacy inquiries within 48 hours. For urgent concerns about your child's data, include URGENT in the subject line.
privacy@writetosanta.caSubject line hint: Privacy Inquiry — [Your Name]
This Privacy Policy was last updated on May 1, 2026. We will post a notice on the site if we make material changes. Continued use of WriteToSanta.ca after a policy update constitutes acceptance of the revised terms. For questions about the site in general, see our About page.
Your privacy is protected.
Start your family's Christmas tradition — Santa is waiting to write back.