Privacy Policy
Your photos and words stay on your device by default.
Postcard has no account requirement, ads, or third-party analytics SDKs. Ordinary creation does not upload photos, handwriting, messages, or drafts. The first free delivery uses an internet connection to verify an App Store identity and stores only an irreversible identity mapping, entitlement state, and delivery fingerprints. A processed main-image copy leaves the device only after you confirm AI Creation.
1. Scope
This policy applies to the Postcard iPhone and iPad app, and to the Postcard website and support channels that you choose to visit.
2. Photo selection and on-device creation
Postcard uses Apple’s system photo picker. It receives an item only after you choose a photo or Live Photo, and it does not require access to your full photo library. Thumbnails, layout, paper, edges, handwriting, recordings, and finished cards are processed on your device. If an original is stored in iCloud, iOS may download it from Apple’s services according to your settings.
3. Collections and AI Creation
Collections reads published catalog data, bilingual copy, and official resources from a public content service. Browsing Collections does not upload your photos, messages, recipients, handwriting, recordings, or browsing activity, and it does not enable third-party analytics.
AI Creation is an explicit exception. Each time you choose a mood, Postcard shows a confirmation first. Only after you select “Upload & Generate” does Postcard send a processed copy of the current main image, with photo metadata such as capture time and location removed, to Postcard’s cloud service and a third-party AI image-generation service for that one generation. People and private details visible in the image remain. Canceling sends no image and uses no AI credit. Task input and generated results are removed after confirmed delivery, failure, or expiry; the server removes a result after you download and confirm it.
4. Drafts, handwriting, and messages
Photo copies, draft state, templates, paper choices, typed text, recipients, signatures, dates, places, handwriting, paid-delivery bindings, and finished-work records remain in the app sandbox. The service separately stores an irreversible App Store identity mapping, the first-delivery status, and project, source, revision, and finished-artifact fingerprints with idempotency identifiers. This prevents the same identity from receiving the offer again after reinstall; it does not contain ordinary-work files or provide draft or finished-artwork sync. Postcard does not read Contacts or build a remote contact database.
5. Saving and sharing
Postcard requests Add Photos permission only when you choose to save a finished card. It does not overwrite or delete your source photo. A card or template file leaves Postcard only after you open the system share sheet and choose a destination; that destination handles the file under its own privacy policy.
6. Purchases
Apple StoreKit handles products, payment, Ask to Buy, verification, and refunds. Postcard does not receive payment-card or payment-account details. The app retains the local product and verified-transaction information needed for delivery. The first-delivery benefit and AI credit packs reuse an irreversible mapping of the Apple-signed identity, while their entitlement state and balance remain separate. These records are not used for advertising, analytics, or cross-company tracking.
7. App Privacy label
Ordinary creation is on device. AI Creation transmits a processed main-image copy only after each confirmation and cleans it up after the task ends. We keep App Store Connect privacy answers current under Apple’s then-current definition of data collection; neither the label nor this policy treats “on device by default” as “no network transmission ever.”
8. Website and support email
When you visit this website, your browser connects to GitHub Pages. When you send a support email, your mail provider processes what you submit. Do not send original private photos, Apple Account credentials, full transaction records, or unredacted sensitive screenshots.
9. Your controls
- Cancel the photo picker or an AI Creation confirmation;
- Delete drafts and local works in Postcard;
- Turn off Photos, Add Photos, or Microphone permission in iOS Settings;
- Cancel sharing or select only destinations you trust; and
- Uninstall Postcard to remove its app-sandbox data.
10. Updates and contact
If Postcard later adds accounts, cloud sync, public submissions, analytics, advertising, or other developer data collection, we will update this policy and the App Store privacy information before enabling it.
Privacy and support: yangkj310@gmail.com