Privacy Policy
Short version: we collect what we need to print your card and mail it, and nothing for the fun of hoarding data. The longer version:
This policy explains what Codewrights, the business that owns and operates picpost (picpost, "we"), collects when you use picpost.io, why, and what choices you have.
What we collect
- Order details — the photo you upload, your framing and caption choices, your note and signature, and the artwork rendered from them.
- Addresses — the recipient's mailing address and your return address, used to print and mail the card. For holiday cards this includes the address list you build, along with any addresses people add through a share link you send them.
- Your email — to send order confirmation and a tracking link. Photo postcards need no account or password.
- Your Google sign-in — celebrations and holiday cards ask you to sign in with Google so your work is saved. Google tells us your name, email address and account ID; we keep them with the times you signed in so your projects stay with your account.
- Which link brought you — if you first reach holiday cards through a link with campaign tags (such as one of our ads, the QR code on a holiday card, or the “Design your card” link on an address page someone shared with you), your browser keeps those tags and we save them with your account when you sign in, so we can see which ads and links bring people to picpost. We don't collect ad click IDs or use advertising pixels.
- Holiday card projects — your card design and photos, your note, your address list, and the thank-you notes people send back after scanning your card.
- Payment info — handled by Stripe. We never see or store full card numbers; Stripe shares only a confirmation and limited metadata with us.
- Basic technical data — request logs (e.g. IP address) used to operate the site and prevent abuse.
How we use it
To print and mail your card, verify deliverability of the recipient address, take payment, send you tracking updates, provide support, prevent abuse, and meet legal obligations. We do not sell your personal information, and we never use your photos for anything except printing your card.
Who we share it with
The service providers needed to fulfill your order or provide a feature you choose:
- Lob — printing, address verification, and mailing.
- Google — confirms who you are when you choose to sign in with Google.
- Stripe — payment processing.
- Postmark — sending transactional email (confirmation and tracking), and reporting delivery, bounce, and observed tracking-image opens for our private Traffic reports. An observed open does not prove a person read the message; private tracking URLs are not collected there.
- Tigris / cloud storage & hosting — storing order records and artwork so we can fulfill and support orders.
- US Census geocoder & OpenStreetMap / Overpass — only when you use Pocket Neighborhood’s address lookup. The Census geocoder receives the address; the map service receives the resulting approximate coordinates to find nearby streets and buildings.
- TypeSafe AI — only when you ask Pocket Neighborhood to imagine a place from your words. It receives that description to choose a setting and color palette. We do not send it your uploaded photos or the separate address lookup field.
Each handles your data under its own terms. We may also disclose information if required by law.
Creative studios
The studios render artwork in your browser and keep a draft in the current browser session, including any photo you add to a trading card. Artwork enters the usual order process when you continue to checkout. Neighborhood map results are temporarily cached in server memory to avoid repeated lookups; we do not save lookup addresses or style descriptions in our order storage or application logs. A looked-up address is not automatically printed on the artwork. Closing a browser session usually clears its studio drafts, though browser session restoration may keep them.
AI assistants
You can ask an AI assistant you choose, such as Claude or ChatGPT, to help build a holiday card list. picpost gives you a prompt to paste into it. The prompt includes the names on that card's list with their city and state, the assistant's notes from earlier sessions, and a private link to a page with the same information. The assistant runs in your own account with that provider and under its terms; picpost never gets access to your contacts, email or other accounts. We receive only what comes back through the private link (or an optional connector that uses it) and what you paste into picpost: names, greetings, how you know someone and where the assistant found them, any addresses, and the assistant's notes. People the assistant suggests wait for your review and aren't on your list until you keep them; if you skip someone, we keep their name so it isn't suggested again. Anyone who has the private link can see those names and add people, but can't see street addresses, so keep it private. You can turn it off at any time on the card's People step.
If the assistant suggests personal notes or a standard note, they wait for your review and are never printed unless you choose to use them.
Collaborators
You can add a collaborator to a holiday card, such as your partner, with an invite link. Once they sign in with Google and join, they can see and change everything on that card, including its address list, and check out. We record their name and email address on the card so you can see who's on it. You can remove a collaborator, or make a new invite link that turns off the old one, at any time.
Retention
We keep order records, photos, and artwork as long as needed to fulfill the order, provide support, and meet legal/accounting requirements, then delete or anonymize them.
Your choices
You can ask us to access or delete your personal data — including your photos — by emailing us. Depending on where you live you may have additional rights (for example under GDPR or CCPA), and we'll honor them where they apply.
Cookies
picpost itself doesn't use advertising or tracking cookies. When you sign in, picpost sets a sign-in cookie so you stay signed in. Holiday cards keep an unsaved draft, and any campaign tags described above, in your browser's local storage until you sign in. Stripe and the hosting layer may set strictly-necessary cookies needed for secure payment and to run the site.
Contact
Questions about privacy or a data request? Contact us.
