Privacy Policy

Your photos and words stay on your device by default.

Effective and updated: November 8, 2026

1. Scope

This policy applies to the Postcard iPhone, iPad, and Mac apps, and to the Postcard website and support channels that you choose to visit. iPhone and iPad are personal creation products; Mac is a business workspace for enabled partner accounts.

2. Mac business workspace

Mac sign-in uses an enabled partner account and has no public registration. Photos, messages, handwriting, recordings, and drafts are processed and stored on the Mac by default; Mac has no cloud AI or consumer in-app purchases. When you choose Save, Mac delivers the confirmed static result as a PNG file.

For sign-in, session restoration, file delivery, customer isolation, and reconciliation, the service stores account and customer identity, a random device_id, sessions, work names, order notes, content and photo fingerprints, and export, billing, and reconciliation records. These service records do not contain payment-card or payment-account details and are not uploads of original photos, messages, handwriting, recordings, or drafts.

3. Taking photos, selecting photos, and on-device creation

For library or file imports, the iPhone and iPad personal app uses Apple’s system photo picker; Mac uses the system file picker. It receives an item only after you choose a photo or Live Photo, and it does not require access to your full photo library. Reading a selected Live Photo’s paired motion may require additional Photos permission; you can choose limited access.

On iPhone and iPad, Postcard requests Camera permission only when you open the camera or choose to capture handwriting on paper. The camera takes still photos without requesting Microphone or Location permission, recording video, or recording sound. If you deny Camera permission, you can still choose photos with the system picker.

Photos taken in the camera, along with their filtered results, stay in the on-device showcase until you delete them. Taking a photo does not automatically upload it or add it to Photos. Saving a photo to Photos or using it to make a postcard does not remove it from the showcase. Deleting it from the showcase does not remove an existing postcard or a copy saved to Photos. If you later choose AI Creation, the upload still requires the separate confirmation described below.

Thumbnails, layout, paper, edges, handwriting, recordings, and finished cards are processed on your device. If an original is stored in iCloud, the system may download it from Apple’s services according to your settings. Microphone permission is requested only when you start recording sound for a postcard; taking a photo does not require it. You can deny or revoke Camera, Photos, or Microphone permission in system settings and continue using features that do not depend on it.

4. Collections and AI Creation

Collections reads published catalog data, bilingual copy, and official resources from a public content service. Browsing Collections does not upload your photos, messages, recipients, handwriting, recordings, or browsing activity, and it does not enable third-party analytics.

AI Creation on the iPhone and iPad personal app is an explicit exception. Each time you choose a mood, Postcard shows a confirmation first. Only after you select “Upload & Generate” does Postcard send a processed copy of the current main image, with photo metadata such as capture time and location removed, to Postcard’s cloud service and a third-party AI image-generation service for that one generation. People and private details visible in the image remain. Canceling sends no image and uses no AI credit. Task input and generated results are removed after confirmed delivery, failure, or expiry; the server removes a result after you download and confirm it.

5. Drafts, handwriting, and messages

Photo copies, draft state, templates, paper choices, typed text, recipients, signatures, dates, places, handwriting, paid-delivery bindings, and finished-work records remain in the app sandbox. The service separately stores an irreversible App Store identity mapping, the first-delivery status, and project, source, revision, and finished-artifact fingerprints with idempotency identifiers. This prevents the same identity from receiving the offer again after reinstall; it does not contain ordinary-work files or provide draft or finished-artwork sync. Postcard does not read Contacts or build a remote contact database.

6. Saving and sharing

The iPhone and iPad personal app requests Add Photos permission only when you choose to save a captured photo or a confirmed finished card. It does not overwrite or delete original photos in your Photos library. A photo, card, or template file is shared only after you open the system share sheet and choose a destination; that destination handles the file under its own privacy policy.

7. Purchases

For the iPhone and iPad personal app, Apple StoreKit handles products, payment, Ask to Buy, verification, and refunds. Postcard does not receive payment-card or payment-account details. The app retains the local product and verified-transaction information needed for delivery. The first-delivery benefit and AI credit packs reuse an irreversible mapping of the Apple-signed identity, while their entitlement state and balance remain separate. These records are not used for advertising, analytics, or cross-company tracking.

8. Data collected by the developer

When Postcard accesses its online service, basic requests include a random installation UUID, device model, OS version, app version and build, architecture, and language for installation counts, device distribution, and daily activity. This basic record exists by default. Optional behavior analytics is off by default in About Postcard; you may explicitly enable it within a signed-in Mac business account, recording creation, saving, and export interactions associated with the account and customer.

Raw behavior events are targeted for 30-day retention; daily installation records for up to 366 days; and the minimum installation record is retained long term. Necessary business ledger, fulfillment, and reconciliation records are retained independently for the periods required by the service and applicable legal obligations. We do not collect hardware serial numbers, advertising identifiers, custom device names, or precise location; we use no advertising SDK and do not track across companies. Basic installation analytics and necessary Mac account, session, and business-ledger processing are not controlled by the optional behavior analytics switch. Turning it off stops new behavior events and clears the local pending queue; received events follow the retention periods above.

9. Website and support email

When you visit this website, your browser connects to GitHub Pages. When you send a support email, your mail provider processes what you submit. Do not send original private photos, Apple Account credentials, full transaction records, or unredacted sensitive screenshots.

10. Your controls

• Cancel the photo picker or an AI Creation confirmation;
• Delete drafts and local works in Postcard;
• Turn off Camera permission for Postcard in iPhone or iPad system settings;
• Turn off Photos, Add Photos, or Microphone permission in iOS or Mac system settings;
• Turn off optional behavior analytics in About Postcard (basic installation analytics and necessary Mac account, session, and business-ledger processing remain);
• Contact support to ask about or correct account, customer, and service records;
• Cancel sharing or select only destinations you trust; and
• Use system controls to remove local app data. Uninstalling the Mac app may leave work files, sandbox data, or Keychain records; necessary server records are not automatically deleted by uninstalling.

11. Updates and contact

We will update this policy and the App Store privacy information when the data boundary or processing purposes materially change, and request consent again where required.

Privacy and support: yangkj310@gmail.com