Safety by design

Last updated: August 15, 2026

Postmello is a place for children to write letters to people they already know. Most of what keeps that safe isn’t a setting someone has to find and switch on — it’s the way the product is built. This page explains it in plain English. The legal detail lives in our Privacy Policy.

The short version

• Letters travel only between contacts that have been approved.
• There is no way for a stranger to find, search for, or write to a child.
• An adult owns the account, approves every contact, and can remove one at any time.
• A reply can never reach anyone who wasn’t already part of the original letter.
• No ads, no third-party advertising, and we don’t sell anyone’s information.
• Nothing is sold to your child. Buying happens away from the desk, in the adult’s area.

Only approved contacts

Before two people can write to each other, the connection has to be approved on both sides. Once it is, a drawer with that person’s name appears on the desk, and letters can travel in either direction.

This isn’t a rule the interface merely suggests. Every letter is checked against the approved connections by our server as it is sent, so unapproved mail — incoming or outgoing — cannot be created in the first place. There is no “send to an address” field for a child to type a stranger into.

Nobody can find your child

Postmello has no public profiles, no user search, no friend suggestions, no “people you may know”, and no open inbox that anyone can post into. A child cannot be discovered by someone who has their name, their school, or their email address. Connections start as an invitation between people who already know each other, and they only become a correspondence when both sides accept.

There are also no comments, likes, followers or public posts anywhere in Postmello. A letter goes to the people it is addressed to, and to nobody else.

An adult stays in control

An adult creates the account and holds the admin area, which is reached through the Postmello Key — a deliberately quiet affordance on the desk, not a button that invites a child to explore. From there an adult can invite a contact, approve or decline a request, and remove a contact whenever they want to. A desk can also be given a PIN.

Removing a contact stops any further letters between those two people.

A reply can’t reach someone new

Postmello lets a child write their reply directly on top of the letter they received, the way you might scribble an answer on a paper letter and post it back. That creates a privacy question the moment it exists: the reply now carries somebody else’s letter inside it.

So the audience travels with the letter. A reply can go back privately to the person who wrote it, or to that whole original group — and nothing else. Recipients can’t be added, and the group can’t be narrowed to single people out. It is not possible to take a letter somebody sent your child, write on it, and pass it along to someone who was never meant to see it.

We would rather make that impossible than show a warning and ask a child to reason through the consequences. The reasoning behind this and other decisions is in Designing a Desk, Not an App.

No ads, and no selling your data

Postmello shows no advertising of any kind, and contains no third-party ad networks. We do not sell personal information, and we do not use letters, drawings or contacts to build advertising or marketing profiles. We use limited diagnostic information — things like app version and error reports — only to keep the app working.

Nothing is sold to your child

Postmello offers collections of desks and stationery, and children enjoy choosing between them. That is exactly where a children’s product can go wrong, so the desk carries no prices, no locks, no countdowns, no currencies and no limited-time offers.

If something appeals to a child, there is one action: make a wish. The wish goes to the Postmello Stationery Shop — a place, not a character who could appear to say no. The household can act on it or quietly leave it alone, and the child is never told a wish was declined. Purchases happen in the adult’s area. The child may want; only an adult may buy.

No pressure to reply

There are no typing indicators, no read receipts back to the sender, no presence dots and no streaks. Nothing in Postmello tells a child that someone is waiting, or turns opening a letter into a signal. A letter arrives, the mailbox flag goes up, and it waits.

If something goes wrong

If a letter upsets your child, or you want a connection to end, an adult can remove that contact in the admin area and no further letters will be delivered between them. Letters can be removed from inside the app. If you need help with anything else — including deleting an account and its data — write to us and a person will read it.