Privacy Policy

Last updated 2026-09-07

Ferna (formerly Wabi) helps you take control of your physical mail — including getting you off mailing lists you never asked to be on. Privacy isn't a side feature of that; it's the point. This policy explains what we collect, how we use it, who we share it with, and the choices and rights you have. "Ferna", "we", "our", and "us" mean the company operating the Service; "you" means the person using it. It applies to our website, apps, and services (the "Service") and works alongside our Terms of Use.

Information we collect

We collect only what we need to run the Service:

Account details — your name, email address, and password (stored as a secure hash by our authentication provider).
Mailing information — the postal address(es) you ask us to act on, which senders match against to remove you from their lists.
Mail you submit — photos of mail you upload and information drawn from them, such as the sender and mail type, so we can identify who to contact and, where you ask, analyze the mail for you.
Requests and their status — the opt-out and mail-preference requests you create and how they progress.
Payment information — if you subscribe, our payment processor handles your card details directly; we receive only a customer/subscription identifier and your plan status, never your full card number.
Usage and device information — IP address, device and browser type, and how you interact with the Service, collected through cookies and similar technologies to keep the Service working, secure, and improving.

How we use your information

Provide the Service — identify senders, create and track your requests, and manage your account.
Submit opt-out and mail-preference requests to senders on your behalf, as you authorize.
Provide AI-assisted analysis of mail you photograph, when you use that feature.
Process payments and manage subscriptions.
Understand and improve how the Service is used, and keep it secure and reliable.
Communicate with you about your account, requests, and service updates.
Comply with law and enforce our Terms.

How we share your information

With senders, to opt you out

This is core to how Ferna works, so we want to be plain about it: to remove you from a mailing list, we transmit your name and the relevant mailing address to that sender (or their designated privacy/opt-out contact, or a preference registry). That's the information a sender needs to find and remove your record. We share only what the request requires, and only with senders you are opting out from.

With service providers

We use a small set of vetted providers to operate the Service. They may process your information only to provide services to us, under contract, and not for their own purposes:

Google Firebase (Google LLC) — authentication, database, and file storage.
Vercel — application hosting.
Stripe — payment processing.
Resend — sending opt-out requests and transactional email.
Lob — if and when we send opt-out requests by postal mail on your behalf, for printing and mailing those letters.
Anthropic, Google (Gemini), and Tavily — AI analysis of mail you submit and locating senders' opt-out contacts. Providers process this content only to return a result to us and do not use it to train their models on our behalf.
PostHog — product analytics that help us understand and improve the Service.
Google Ads — measuring which of our ads led to a subscription, so we know what our advertising is worth. It receives the fact that a purchase happened and its amount, not your name, email, or address. We run it with ad personalization and Google signals switched off, so it is not used to build advertising audiences or to follow you around other sites.
Mailchimp — managing our email and waitlist communications.

For legal reasons and business changes

We may disclose information if required by law or valid legal process, or where we reasonably believe it is necessary to protect the rights, safety, or property of you, us, or others. If Ferna is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction; we will notify you of any such change.

What we do not do

We do not sell or rent your personal information, and we do not share it for cross-context behavioral advertising. Sharing your name and address with a sender to effect an opt-out is done at your direction to fulfill the Service — not for anyone's marketing. We do measure whether our own ads lead to subscriptions (see Google Ads above), which is advertising measurement, not targeting: we build no audiences, run no remarketing, and pass no personal information to do it.

AI features

When you use AI-assisted analysis, the contents of the mail you photograph — which can include personal details printed on that mail — are processed by the AI providers listed above to produce a summary and suggested actions. AI can make mistakes; its output is for convenience only and is not legal, financial, or professional advice. Verify anything important against the original mail.

Data retention

We keep your information for as long as your account is active or as needed to provide the Service, resolve disputes, and meet legal obligations. When you delete your account or ask us to delete your data, we remove or de-identify it within a reasonable period, except where we are required to retain it (for example, billing records).

Security

We use commercially reasonable technical and organizational measures to protect your information, including encryption in transit and access controls. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your information and to respond promptly if something goes wrong.

Your privacy rights

Depending on where you live, you may have the right to access, correct, delete, or receive a copy of your personal information, and to opt out of certain processing. Because we do not sell your information or use it for cross-context behavioral advertising, there is nothing to opt out of on those points — but you can still exercise the rights below.

Access & portability — request a copy of the information we hold about you.
Correction — ask us to fix inaccurate information.
Deletion — ask us to delete your account and personal information.
Non-discrimination — we will not treat you differently for exercising these rights.
Authorized agents — you may authorize someone to make a request on your behalf; we may ask to verify your identity and their authority.

To exercise any of these, email hello@meetferna.com. We may need to verify your identity before acting. California residents have these rights under the CCPA/CPRA; residents of other states with privacy laws have comparable rights.

Cookies and analytics

We use cookies and similar technologies to keep you signed in, remember your preferences, keep the Service secure, and measure how it is used so we can improve it. If you arrived from one of our ads, a Google Ads cookie records that click so a later subscription can be credited to it; it expires on its own and is used for that measurement only. You can control cookies through your browser settings, though some features may not work without them.

Children's privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from them. If you believe a child has provided us information, contact us and we will delete it.

International users

We operate in the United States, and your information is processed there and in the countries where our service providers operate. By using the Service, you understand your information may be transferred to and processed in the United States.

Changes to this policy

We may update this policy from time to time. We will post the updated version here with a new "last updated" date, and for material changes we will take reasonable steps to let you know. Your continued use of the Service after a change means you accept the updated policy.

Contact

Questions about this policy or your information? Contact us at hello@meetferna.com.