Privacy

This policy covers POST POST. We collect what the service needs to work and not much else — there is no advertising business here, and we do not sell your personal information.

What we collect

• Your account — email address, name if you give one, and a password stored only as a cryptographic hash.
• Your mailing address, if you subscribe. We can’t post you anything without it.
• What you choose — which creators you place credits on, and which drops you have received.
• Payment details are collected and held by Stripe, not by us. We keep the identifiers Stripe gives us and a record of the terms you agreed to.
• For creators — your public profile, the work you upload, and the bank and tax details you give Stripe in order to be paid. We never see those directly.

The code on your card

Every card we post carries a small heart-shaped code, and it is unique to you and to that card. If you scan it:

• The creator is told that you — by the name on your account — liked that drop, and sees any note you leave.
• We use it to understand which drops land, and to suggest creators you might like.

The creator never sees your address, your email, or how to contact you. They see that a named subscriber responded to their work. Scanning is entirely optional — a card that is never scanned tells the creator nothing about you.

Cards also carry a referral code and an edition serial. The referral code identifies your account when a friend uses it, so we can credit you.

Who else sees your information

We share the minimum required with the companies that make the service work:

• Our printing and mailing partner receives your name and postal address for each card, because they print the label and hand it to the postal service. They are not permitted to use it for anything else.
• Stripe — payments, and the creator verification required by law.
• Our email provider — your email address, to send you the messages the service needs to send.
• Our hosting and database providers — they store the data on our behalf under contract.

We may also disclose information if the law requires it, or to protect someone’s safety. If the business is ever sold, your information moves with it, and we’ll tell you first.

How your address is handled

Addresses are the most sensitive thing we hold, so it’s worth being exact — including about what we don’t do.

• They are stored in our database, which is a managed PostgreSQL service run for us by our hosting provider. Its disks are encrypted, and connections to it are encrypted in transit.
• They are not separately encrypted field by field.Inside that database an address is ordinary text, the way your name and email are. Disk encryption protects the stored hardware; it is not a second lock inside the database, and we would rather say so than let the word “encrypted” imply one.
• Who can read one: you, on your own account, and the small number of people who run POST POST, when running it requires it — a mailing that bounced, a support request about a card that never came. Creators cannot.A creator cannot look up a subscriber’s address and there is no screen anywhere that would let them.
• When a card is posted, we take a snapshot of the address onto that order. Changing your address later changes where the next card goes; it does not rewrite the record of where the last one went.
• The only company we hand an address to is our printing and mailing partner, one card at a time, so they can print the label. It goes nowhere else — not to creators, not to advertisers, not to anyone who wants to buy a list.
• We keep addresses only while your account is open, plus the period we’re required to retain business records.

Email you receive

Some email is part of the service and can’t be turned off — password resets, notice of a charge, and cancellation confirmations. Everything else is there to tell you what’s happening with your mail. If you’d rather not receive a particular kind, write to us and we’ll take you off it.

Your choices

You can see and change your address, your creator choices, and your account details at any time by signing in. Write to [email protected] and we will:

• tell you what we hold about you, and give you a copy;
• correct anything that’s wrong;
• delete your account and personal information, keeping only what we must for tax and accounting;
• confirm that we have not sold or shared your information for advertising, because we don’t.

Depending on where you live, you may have these rights by law. We extend them to everyone rather than checking which state you’re in.

Cookies

We use cookies to keep you signed in and to keep forms secure. There is no advertising or cross-site tracking on this site.

Children

POST POST is for adults. We don’t knowingly collect information from anyone under 18; if we learn we have, we’ll delete it.

Changes, and how to reach us

If this policy changes materially we’ll tell you, and the date at the top will change. For anything on this page — including a request to see or delete your data — email [email protected]. See also our Terms of Service.