Safety by design

Last updated: August 27, 2026

Postmello is a private place for families to exchange digital letters with people they know. Adults and children can have their own desks; accounts are created and managed by adults, who control the friends available to children’s desks. Most of what keeps a child safe here isn’t a setting someone has to find and switch on - it’s the way the product is built. This page explains it in plain English. The legal detail lives in our Privacy Policy.

The short version

• Letters travel only between friends who have been approved.
• There is no way for a stranger to find, search for, or write to a child.
• An adult owns the account, approves every friend, and can remove one at any time.
• A reply can never reach anyone who wasn’t already part of the original letter.
• No ads, no third-party advertising, and we don’t sell anyone’s information.
• Nothing is sold to your child. Buying happens away from the desk, in the adult’s area.

Only approved friends

Every person who can write to a child’s desk must first be approved by the adult managing that desk. With another Postmello desk, the connection is made with a connect code and approved by the adult on each side. A friend reached by email is approved for a specific email address. Once a connection exists, a drawer with that person’s name appears on the desk, and letters can travel in either direction.

This isn’t a rule the interface merely suggests. Every letter is checked against the desk’s approved friends by our server as it is sent, so unapproved mail - incoming or outgoing - cannot be created in the first place. There is no “send to an address” field for a child to type a stranger into.

Letters by email follow the same rule

Not everyone a child writes to has the app. An adult can approve a friend who is reached by email instead. The letter arrives in that person’s inbox as a picture of the envelope and a private link, and the letter is read on a web page rather than sent as an attachment. When they reply, their words come back to the desk as a typewritten letter.

Approval does not bend for this. Only an address an adult approved can be written to, and only a reply from that address reaches the desk - a reply we cannot confirm came from the approved address is held for an adult to look at first. Links, photos and attachments are removed before any reply is delivered.

Nobody can find your child

Postmello has no public profiles, no user search, no friend suggestions, no “people you may know”, and no open inbox that anyone can post into. A child cannot be discovered by someone who has their name, their school, or their email address. Connections between Postmello desks begin with a connect code shared between people who already know each other. Friends reached by email are added by the adult managing the desk. There is no public way for someone to discover a child or write to them.

There are also no comments, likes, followers or public posts anywhere in Postmello. A letter goes to the people it is addressed to, and to nobody else.

An adult stays in control

An adult creates the account and holds the Admin Portal, which is reached through the Postmello Key - a deliberately quiet affordance on the desk, not a button that invites a child to explore. From there an adult can invite a friend, approve or decline a request, and remove a friend whenever they want to. A desk can also be given a PIN.

Removing a friend stops any further letters between those two people.

A reply can’t reach someone new

Postmello lets a child write their reply directly on top of the letter they received, the way you might scribble an answer on a paper letter and post it back. That creates a privacy question the moment it exists: the reply now carries somebody else’s letter inside it.

So the audience travels with the letter. A reply can go back privately to the person who wrote it, or to that whole original group - and nothing else. Recipients can’t be added, and the group can’t be narrowed to single people out. It is not possible to take a letter somebody sent your child, write on it, and pass it along to someone who was never meant to see it.

We would rather make that impossible than show a warning and ask a child to reason through the consequences. The reasoning behind this and other decisions is in A World Built for Childhood.

No ads, and no selling your data

Postmello shows no advertising of any kind, and contains no third-party ad networks. We do not sell personal information, and we do not use letters, drawings or friend lists to build advertising or marketing profiles. We use limited diagnostic information - things like app version and error reports - only to keep the app working.

Nothing is sold to your child

Postmello offers Collections of desks and stationery, and children enjoy choosing between them. That is exactly where a children’s product can go wrong, so the desk carries no prices, no locks, no countdowns, no currencies and no limited-time offers.

A child who finds a Collection they like can choose it. Choosing buys nothing. It opens the Postmello Key, where an adult enters the PIN and decides - and that is the only place a price is ever shown. If the answer is no, nothing is saved, and nothing on the desk is left sitting there marked as wanted, so there is nowhere for a child to go back and ask again. The child may choose; only an adult may buy.

No pressure to reply

There are no typing indicators, no read receipts back to the sender, no presence dots and no streaks. Nothing in Postmello tells a child that someone is waiting, or turns opening a letter into a signal. A letter arrives, the mailbox flag goes up, and it waits.

If something goes wrong

You have three ways to act, and none of them need us:

• Report a letter. Anyone reading a letter can report it. Reports reach a real person, and we aim to look within a day.
• Block a friend. Blocking stops letters in both directions immediately.
• Remove a friend, or delete the account. An adult can remove a friend in the Admin Portal, and no further letters pass between them. The whole account can be deleted from Settings. A delivered letter stays in the mailbox that received it, the same way a posted letter does - if one needs removing from other people’s mailboxes, write to us and we will where the law requires it.

When we act on a report we may suspend or remove content or a desk. If we do, we tell the affected account what happened and why. We do not read letters otherwise - Postmello is private correspondence, not a feed, and we do not scan or monitor what people write.

To report illegal content, or for a legal or government request, write to [email protected] with the details and a person will handle it.