Privacy Policy

Last updated: August 18, 2026

Postmello (“we,” “us,” “our”) makes a cozy iPad app for writing and exchanging handwritten digital letters with a small circle of approved contacts. We care deeply about privacy - especially because families and children use Postmello. This policy explains what we collect, why, and the choices you have.

Who we are. Postmello is operated by Postmello LLC, based in Palo Alto, California, USA. You can reach us at [email protected].

Where your data is stored. Your account, letters, and images are stored on servers in the United States (Amazon Web Services, US West / Northern California), operated on our behalf by Supabase. If you use Postmello from outside the United States, your information is transferred to and processed in the United States.

The short version

• An admin creates and controls the account and approves every contact.
• We collect only what’s needed to deliver letters and keep accounts secure.
• We do not sell your information, show third-party ads, or use your letters to build advertising profiles.
• Letters only travel between contacts who have been approved on both sides.

Information we collect

• Account information. When an account owner signs up, we collect an email address and authentication details. If you choose Sign in with Apple or Sign in with Google, we receive the account identifier (and, depending on your choices, a name or email) from that service to create your account.
• Profile and desk details. Display names, nicknames, icons, and contact labels you create for desks and mailboxes inside the app.
• Letter content. The handwritten letters, drawings, and stationery you create, and the records needed to deliver them to your approved contacts.
• Contacts. The approved connections that determine who may exchange letters with whom.
• Diagnostic information. Limited technical and usage information (such as app version and error reports) that helps us keep Postmello reliable.

How we use information

• To operate the service - storing your letters and delivering them between approved contacts.
• To create and secure accounts and to verify approved connections.
• To provide customer support and respond to your requests.
• To diagnose problems, prevent abuse, and improve the app.

We use diagnostic and analytics information only to understand reliability and improve Postmello. We do not use it to advertise to you or to build marketing profiles, and we do not sell it.

Children’s privacy

Postmello is intended to be used under the involvement of a parent or guardian. An adult account owner creates the account, approves every contact, and can review or remove content and connections at any time. By design, a child can only exchange letters with contacts an adult has approved - unapproved mail, incoming or outgoing, is not possible.

We do not knowingly use children’s personal information for advertising or sell it.

How parental consent works

When someone sets up a desk for a child under 13, we ask the adult to approve it and we verify that they are an adult before the desk does anything at all. That is how we obtain verifiable parental consent under the US Children’s Online Privacy Protection Act (COPPA). There is a plain-language walkthrough on the Parent Privacy Notice.

1. An adult creates the account and signs in with an email address and password, Sign in with Apple, or Sign in with Google.
2. That adult sets an Admin PIN, which protects the admin area.
3. The adult creates each desk, and tells us whether it is for a child under 13. We store that answer and nothing more - we never ask for a birthday or an age.
4. For a child’s desk, the adult reads and approves our parental consent statement, and then confirms they are an adult through Kids Web Services, a verification service run by Epic Games. No identity document, card number, Social Security number or selfie ever reaches Postmello - that happens with the verification provider, and we receive only the fact that an adult was verified.
5. Until both the approval and the verification are recorded on our servers, the desk cannot send, cannot receive, and nothing written on it leaves the iPad. This is enforced by our database, not by the app.
6. An adult verifies once. Setting up a desk for another child later asks for approval again, but not for another verification.
7. Every contact is approved by the adult, in the admin area, behind that PIN.
8. Mail between people who are not approved contacts is refused by our servers - it is not merely hidden in the app, it cannot be sent or received at all.

We do not knowingly allow a child to create an account, and we never ask a child for a birthday, a phone number, or a location.

Desks that are not for a child under 13 - a parent’s own desk, a grandparent’s - do not go through verification.

Rights of the parent or guardian

As the account holder you can, at any time and from inside the app: review the contacts approved for any desk and remove any of them; review and remove desks; and delete the account and its data outright (Settings → Delete Account), which also stops any further collection. You do not need to send us a written request to do any of these. If you would rather we help, or you want to review information associated with your account, contact us at [email protected].

Postmello contains no third-party advertising and no third-party analytics or tracking SDKs. The only third-party component in the app that receives any diagnostic data is Sentry, which we use solely for crash and error reports so we can fix problems. We do not use it to build profiles, and we do not sell or share diagnostic data for advertising.

How information is shared

We do not sell your personal information. We share information only in these limited ways:

• With your approved contacts. A letter you send is delivered to the contact you addressed it to.
• With service providers who help us run Postmello - for example, our cloud hosting, database, storage, and authentication providers - who process data on our behalf under appropriate confidentiality and security obligations.
• For legal reasons, if required by law or to protect the safety of our users and the service.

The service providers we currently use are:

• Supabase - hosting, database, file storage, and authentication (servers in the United States).
• Resend - delivery of account and notification emails.
• Sentry - crash and error reporting.
• Apple - app distribution, subscriptions and billing, and Sign in with Apple.
• Google - Sign in with Google, if you choose that option.
• Kids Web Services (Epic Games) - confirming that the adult approving a child’s desk is an adult. They receive the adult’s email address; they receive nothing about the child.

Data retention and deletion

We keep your information for as long as your account is active or as needed to provide the service.

How long we keep letters and drawings. Handwritten letters and their images are kept for as long as the account is active, because rereading old mail is the point of the product - a letter you were sent last year should still be there. We do not delete them on a schedule, we do not use them to train anything, and we do not show them to anyone outside the approved audience of that letter. You can remove letters from inside the app at any time, and deleting the account removes them as described below.

You can delete your account from inside the app, at any time: open the admin area, go to Settings, and choose Delete Account. The account is then scheduled for deletion 30 days later. During those 30 days its desks stop receiving mail and any sharing links are revoked straight away, and you can cancel by signing back in. After 30 days the account and its data - desks, contacts, drafts, and the letters and images stored for them - are removed from our database and file storage, subject to any limited records we must keep for legal or security reasons, and to routine backups that are overwritten in time.

Letters you have already sent are not deleted from the people who received them. A delivered letter is part of the recipient's own mailbox, in the same way a posted letter belongs to the person who receives it, and we do not reach into someone else's account to remove it. Your desk, your profile and your account are still deleted.

Deleting your account does not cancel a paid subscription. Subscriptions are billed by the App Store, and only the App Store can cancel one - see Manage Subscriptions in your device settings.

Security

We use industry-standard measures to protect your information in transit and at rest. Letters are stored so they can be delivered to your approved contacts. No system is perfectly secure, but we work to safeguard your data and to limit access to it.

Your choices and rights

You can delete your account and its data yourself, from inside the app - see "Data retention and deletion" above. Depending on where you live, you may also have rights to access or correct your personal information, or to object to certain processing. To exercise any of these, contact us at [email protected].

Changes to this policy

We may update this policy from time to time. When we make material changes, we’ll update the “Last updated” date above and, where appropriate, provide additional notice.

Contact us