Last updated: 1 November 2026.
This policy explains the processing of personal data in connection with the letrasdelcamino.com website, its newsletter, the Letras del Camino application, enquiries and customer support, and the activation of digital products purchased on Etsy. It applies to data managed by Letras del Camino and also explains which information remains on your devices or in services you choose to connect.
1. Data controller and contact details
The data controller is Vicente Soler, Spanish ID (DNI) 20465285T, with address at Calle Tosquella 65, 1º, Castelló de la Plana, Spain. Email: info@letrasdelcamino.com.
You can use this email address for privacy enquiries and to exercise your rights. Please do not send personal keys, recovery secrets or decrypted copies of your journals.
2. How the website, account and newsletter relate to one another
You can visit the website without creating an application account. The app uses its own account system to manage access, devices and products. Newsletter subscriptions are managed separately through our own WordPress plugin, “Letras del Camino — Suscripciones”, with mailing lists organised by language.
The Personal Journal can be activated free of charge directly in the app. It does not require an email address or a newsletter subscription. Unsubscribing from the newsletter does not delete your account, purchased products or free Personal Journal activation.
The website may display a floating invitation offering a free journal and linking to the subscription page. Its status is remembered locally in your browser when you minimise it, close it or confirm your subscription through the relevant page, as explained in our Cookies and Storage Policy. This does not, by itself, identify subscribers who access the website from other devices or browsers.
3. Website visits and email enquiries
Hosting and technical services may process your IP address, date and time, browser information, requests, errors and other connection data needed to deliver pages, prevent abuse and resolve technical issues. These logs do not contain the private content of your journals.
If you write to info@letrasdelcamino.com, we process your email address, the content of your enquiry and any documents you voluntarily provide in order to respond. Please share only the information necessary. The website does not currently offer public comments or a community area for user-generated posts.
4. Newsletter: subscription, confirmation and content
To subscribe, we request your email address and your express acceptance of the consent statement. The request is managed through our own WordPress subscription plugin, with separate mailing lists for each language. After requesting a subscription, you will receive an email containing a confirmation link. Your subscription remains pending until you complete that step. This verification helps prevent subscriptions submitted by third parties without permission.
Once confirmed, you may receive Letras del Camino content including journaling questions, reflections, writing examples, articles, resources, news and communications about our journals and other materials. Emails may also contain promotional information related to the project.
To manage mailing lists and document consent, the plugin stores your email address, language and mailing list, subscription status (pending, confirmed or unsubscribed), the source indicated by the form, the purpose, wording and version of the consent statement accepted, and the dates of the request, consent, confirmation and unsubscribe action, where applicable. Confirmation links use protected temporary identifiers. Confirmation links expire after 48 hours, although a new message may be requested if the subscription is still pending.
After confirmation, you may receive a welcome email and newsletters associated with your selected list. Each message provides a way to unsubscribe from that list or from all lists. Subscriptions and unsubscribe requests are managed in the WordPress database, separately from your application account and purchased products.
5. Newsletter delivery and technical records
The subscription plugin sends emails through the WordPress mail function (wp_mail()) using the server’s email configuration or whichever email delivery service is configured for the installation. For newsletter campaigns, it records management information such as the recipient list, queue status, delivery attempts, dates and technical sending results. These results do not, by themselves, prove that a message reached the recipient’s inbox or was read.
Our plugin does not currently include tracking pixels to measure email opens or individually record clicks on newsletter links. It also does not automatically track bounced emails. Technical providers involved in transporting messages may process the information required to provide that service, according to their respective functions and applicable agreements.
You may withdraw your consent and stop receiving newsletters by using the unsubscribe links included in our emails or by contacting us at info@letrasdelcamino.com. Withdrawal does not affect the lawfulness of processing carried out before it. We do not use activity within your journals to personalise emails or create commercial profiles based on email opens or clicks.
6. Application account data
The account uses a username and authentication mechanisms. Under the current model, your personal key is processed on your device, and the server receives derived proofs to verify access, together with encrypted material that cannot, by itself, be used to open your journals. The name you choose for a journal cover is part of its locally stored content and should not be confused with your account username.
The server manages technical account and device identifiers, device linking and technical activity records, the status of the free Personal Journal and product access rights. It may retain limited device labels and reduced browser information to recognise installations and manage access.
Accounts created with older versions may require a private migration from an already linked device. Until this migration is completed, authentication material from the previous system may be retained. The protections described for the current model should not be taken to mean that all older accounts have automatically migrated.
7. Private journal content
Personal Journal entries, guided journal answers, private titles, photographs and other personal content are stored and processed on your device. Private content is encrypted before being included in backups or synchronisation files that leave your device.
WordPress does not receive your journal entries, answers or decrypted private files. The website owner does not maintain a server-side library of your writing and does not review or moderate it. Your private content is not used for advertising, commercial analysis, profiling or artificial intelligence training.
Your device must be able to decrypt content while you are using it. Encryption therefore does not replace device locking or precautions against other people accessing an open session.
Import and export features may process files originating from other journaling applications on your device. Depending on their format, these files may contain text, dates, times, titles, photographs, tags, location information and other metadata. Reading, converting and generating these files takes place locally in your browser. Letras del Camino does not receive their contents merely because you use these features.
8. Etsy orders, products and licences
Purchases and payments take place on Etsy. Letras del Camino receives purchase notifications and consults the order information necessary to verify payment and identify the products purchased. The activation system retains order, transaction and listing identifiers, products, quantities, order status, licence information and device information.
As a seller, Letras del Camino may also access buyer information and communications made available through Etsy to manage sales and comply with applicable obligations. The application does not request payment card details to activate a product.
A product activation key is different from the personal key used to protect access to your journals. The former verifies your entitlement to a product; a copy of your journal content does not grant or transfer that entitlement.
9. Local backups and exported documents
Current full backups are encrypted on your device before being downloaded or saved to a folder you select. The server does not receive their contents. Backups remain in the locations where you save them until you replace or delete them.
PDF documents generated for reading or printing your writing are different from full encrypted backups. A PDF or printed copy may display your content in readable form. Please store and share such documents with this distinction in mind.
10. Google Drive and synchronisation
Connecting to Google Drive is optional. After authorisation through Google, your browser communicates directly with Drive using the limited drive.file permission to work with files created or authorised for this application, without general access to all your documents.
Backups and synchronisation files are encrypted on your device before being uploaded. WordPress does not receive these private files or store access tokens, refresh tokens or a user client secret for this connection. Your Google token is kept temporarily in browser memory, and you may need to authorise the connection again after it expires.
Google processes encrypted files and technical information related to its services under its Privacy Policy. The use of Google APIs for this feature is limited to the backup, restoration and synchronisation operations requested, in accordance with the Google API Services User Data Policy, including its Limited Use requirements.
Disconnecting Drive does not delete local journals or automatically remove files already stored there. You can manage those files in Google Drive and review or revoke access permissions in your Google account.
11. Website and application statistics and diagnostics
The website uses Koko Analytics with the “None” tracking method. This configuration counts page views and referral sources without using Koko cookies or attempting to distinguish returning visitors through that method. The results are stored within the website infrastructure.
Application statistics consist of aggregated counts of functional events and products, without private text or persistent account identifiers in the aggregated statistics. They are separate from the records required to authenticate accounts, activate products or manage devices, which may be associated with an account.
Diagnostics are limited to technical information, versions, status information, counts and test results. They must not include actual journal entries, keys, tokens or decrypted backups.
12. Purposes and legal bases for processing
- Accounts, activations, devices and service support: performance of a contract or steps requested before entering into a contract.
- Newsletter subscriptions, confirmation, welcome messages and related communications: consent, which may be withdrawn at any time. Newsletter subscription is independent of using the application.
- Security and abuse prevention: legitimate interest in maintaining a secure service, limited to what is necessary and subject to your rights.
- General statistics: service improvement and maintenance. Where information is genuinely anonymous, it does not identify individuals. Any processing of personal data or access to a device that requires a legal basis or consent must comply with the applicable requirements.
- Tax administration, official requests and applicable obligations: compliance with legal obligations.
Failure to provide information essential for an account or order may prevent us from managing that account or activating a product. Not providing your email address for the newsletter only prevents you from subscribing.
13. Service providers and disclosures of data
- Loading: website hosting, server services and contact email services.
- Our own WordPress subscription plugin: a tool installed on the website to manage mailing lists, subscriptions, confirmations, unsubscribes and email campaigns. The plugin itself is not an external service provider to whom data is disclosed. Subscription information is stored within the website infrastructure. Emails are transported using the WordPress mail configuration and the applicable technical providers.
- Etsy: the platform used for purchases, payments, digital delivery and communication with buyers, with its own responsibilities regarding the data it processes.
- Google: authorisation and optional connection to your Google Drive.
- cdnjs / Cloudflare: distribution of the PDF.js library used by the PDF viewer. When these technical files are downloaded, the provider may receive connection information such as an IP address. PDF documents are read in the browser; downloading this code does not mean the document itself is sent to the CDN. See Cloudflare’s Privacy Policy.
- Technical service providers and public authorities: limited access when necessary to provide the service, comply with legal requirements or handle claims.
WordPress and WooCommerce are part of the website’s infrastructure and product catalogue; their presence does not mean that purchases are processed directly through this website. Koko is the analytics tool installed on the site. Service providers are not authorised to use your private journal content, which is not supplied to them by WordPress.
14. International data transfers
Services provided by Etsy, Google and Cloudflare may involve international processing operations and subcontractors. Our own subscription plugin does not, by itself, involve an international data transfer. However, the hosting arrangements and the email delivery providers actually used must also be taken into account. Where Letras del Camino commissions processing involving transfers outside the European Economic Area, appropriate safeguards must be in place, such as an adequacy decision or Standard Contractual Clauses, as applicable. You may request information about the safeguards applying to processing managed by us. Services you contract directly are also governed by their own privacy policies.
15. Data retention and deletion
- Newsletter: subscription data is retained while the subscription remains active. After unsubscribing, the minimum information necessary to respect the decision, demonstrate consent or address legal responsibilities may be retained for the applicable periods. The plugin does not currently provide a general automatic deletion process for all old subscription records. Requests for erasure will be handled in accordance with applicable law and relevant retention obligations.
- Accounts and product entitlements: for the duration of the service and, where necessary, for the periods required to comply with legal obligations or handle claims.
- Enquiries and customer support: while the enquiry is being handled and for as long as necessary to address related responsibilities.
- Recent Etsy diagnostics: the plugin applies a 30-day window and a limit on the number of records. This does not automatically delete licence records or sales information that must be retained.
- Quality assurance diagnostics: scheduled removal of records older than 90 days. Aggregated application statistics have a configured retention period of 365 days. These clean-up operations depend on the server’s scheduled tasks running correctly.
- Hosting logs and infrastructure backups: according to their technical purposes and the provider’s retention cycle. Deletion from the active database does not necessarily mean immediate deletion from every infrastructure backup.
- Private journals and backups: stored on your devices, in your selected folders and in your Google Drive, under your control.
The app’s “Delete Account” feature deletes the account, its linked devices and associated entitlements from the server, and removes data linked to that account from the device on which the operation is performed. If the browser cannot complete the local clean-up, the app displays an error. Downloaded backups, Google Drive files and data remaining on other devices are not automatically deleted. Deleting an account also does not automatically delete Etsy order records or cancel an independent newsletter subscription.
16. Your rights
You may request access, rectification, erasure, restriction of processing, objection and data portability where applicable, and withdraw your consent by writing to info@letrasdelcamino.com. We will request only the information reasonably necessary to verify your identity. Requests will be answered within the time limits established by the GDPR, normally one month. Any legally justified extension will be communicated to you.
You may also lodge a complaint with the Spanish Data Protection Agency (AEPD). Journal entries stored only on your device or in your Google Drive must be accessed and exported from those locations. We cannot provide private journal content from the server when we have never received it.
17. Minors, security and changes
In Spain, where processing is based on the consent of a person under the age of 14, consent must be provided or authorised by the person exercising parental responsibility or legal guardianship. Legal capacity to make purchases is governed by the applicable rules and the conditions of the purchasing platform.
Encryption, access controls and data minimisation measures appropriate to the service are applied. No system can guarantee zero risk. If features or processing activities change, this policy will be updated and significant changes will be communicated. A new processing activity requiring consent is not authorised merely by updating this policy.
18. Closure of the service and personal data
If Letras del Camino permanently ceases operating, personal data associated with accounts and services will be deleted or anonymised when no longer necessary for the purposes for which it was processed, except where retention is required to comply with legal, tax or accounting obligations, defend legal claims or meet other applicable responsibilities.
Where circumstances permit, reasonable advance notice will be provided of measures affecting accounts and services. Journals, downloaded backups and files stored exclusively on your devices, in your folders or in Google Drive will remain under your control and cannot be deleted from our systems.
Related documents: Legal Notice · Privacy Policy · Terms of Use · Cookies and Storage · Terms of Purchase.