Last updated 26 September 2026 · Penpal is made by Bionics LLC

Privacy

Penpal works by reading the emails you send it, so here is exactly what happens to them. The short version: we keep your conversations for 30 days so Penpal can remember them, then erase them automatically, a small number of services help deliver and answer them, and your data is never sold or used for advertising.

What we keep

• Your email address, and when you first wrote in.
• The emails you send and Penpal's replies, including anything you forward to it. We remove the old quoted history from replies, because we already have it.
• If you attach a file, the text Penpal reads out of it, so it can answer follow-up questions in that conversation. We do not keep the file itself.
• Which address you wrote to (for example hi+hn@askpenpal.com), so we can tell which places people hear about Penpal.
• How many replies you used, your credits, and what each reply cost us to produce.
• If you buy credits: the amount and the Stripe payment reference. We never see or store your card number.
• For each email, whether an automatic check thought an email came from a marketer rather than a person, and how sure it was. This holds none of your words.

The website sets no tracking or advertising cookies, and loads nothing from anyone else: the fonts are served by us, so opening a page tells no third party anything. We count how many times each page is served, as a daily total per page, with no cookie, no IP address and nothing that identifies you.

Who else sees your emails

• Resend receives email sent to askpenpal.com and delivers Penpal's replies.
• OpenRouter passes your conversation to the AI model that writes the reply. Every request is limited to model hosts that do not keep your messages and do not train on them.
• Web search. When a question needs current information or you paste a link, a search query or that link is sent to a search service through OpenRouter. The query is based on your question.
• Attachments. Files you attach are downloaded from Resend, read on our own server, and then discarded. Photos and scanned pages are sent once to an image-reading model through OpenRouter, on the same hosts that keep nothing and do not train on your data.
• Spam check. What you typed in each email (not attachments) is also sent once to a small model through OpenRouter, on the same hosts that keep nothing and do not train on your data, which guesses whether it came from a marketer. For now the guess is only recorded, to see how often it is right; it never stops an email being answered.
• Stripe processes payments if you buy credits.

Penpal's own servers and database are run by us. Nobody else gets your data, except where the law requires it.

Who reads it here

To catch mistakes and keep replies good, we read a sample of conversations and the replies Penpal sent. That review is done by the person who runs Penpal and by AI tools working for them. We do not use your emails to train AI models, and we do not share them for anyone else's use.

How long we keep it

What you wrote is erased after 30 days, automatically. You do not have to ask. Until then it is kept so Penpal can remember the conversation when you reply. After 30 days the words are gone, including any text read out of a file you attached; what is left is the date, whether it was a question or a reply, and what it cost us to answer, which is how we count usage and spot abuse.

Database backups are kept for 14 days and then deleted, so a conversation can survive in a backup for up to 14 days after it is erased. Server logs, which include email addresses and subject lines, roll over and are not kept long term. You can also delete everything at once, at any time, without waiting: see below.

Deleting your data

Email support@askpenpal.com from the address you used and ask us to delete your data. We will delete your conversations and account within 30 days and confirm by email. Payment records we are legally required to keep, such as tax records, stay with Stripe and in our accounts.

Deleting your data also removes any unused credits on that address. If you have some, say so when you ask and we will refund them before we delete anything.

Do not send Penpal passwords, card numbers, or anything you would not want stored.

Your rights

Depending on where you live, you may have the right to see, correct, export or delete your data, or to object to how it is used. Email the address above and we will help. If you are in the EU or UK and think we have handled your data badly, you can also complain to your data protection authority.

Changes

If this changes, we will update the date at the top. If a change affects how your existing data is used, we will say so on this page before it takes effect.