Privacy Policy

What we collect

When you use SnailCard, we collect:

• Account information — your email address and name when you register.
• Photos you upload — the images you choose to turn into postcards. These are stored securely and used only to print and mail your postcard.
• Recipient addresses — the mailing addresses you provide for delivery. We share these with our print partner (Lob) for fulfillment and never use them for marketing.
• Payment information — handled entirely by Stripe. We never see or store your card number.
• Usage data — anonymized analytics to understand how the app is used (pages visited, features used). No personal identifiers are attached.

How we use your information

• To create, print, and mail your postcards.
• To send you order confirmations and shipping updates.
• To provide customer support when you contact us.
• To improve the app experience.

We do not sell your personal information. We do not use your photos or recipient addresses for any purpose other than fulfilling your orders.

Who we share data with

• Lob — our print and mail partner. Receives your photo and recipient address to produce and deliver postcards. See Lob's Privacy Policy.
• Stripe — payment processing. Handles all payment data. See Stripe's Privacy Policy.
• Polsia — the platform we're built on, which handles email delivery and infrastructure.

SMS mobile information and consent are shared only with the operational service providers described in the SMS section below, not with advertisers or data brokers.

SnailCard Notifications (SMS)

SnailCard Notifications is an optional recurring service for future activity in categories you choose: postcards sent to you; printing, in-transit, delivery and return events for postcards you send; and new friend connections, follows and reactions to shared postcards. Own-order and friend activity requires sign-in. The program does not copy marketing, referral or win-back emails, or send account security credentials. Enrollment stays closed until carrier approval and activation; the SMS page shows availability.

You enter your own U.S. mobile number, choose initially unchecked notification categories, select a separate unchecked SMS consent box, and send the displayed one-time JOIN code from that same number to verify control. A sender entering someone else's number or adding a friend is not SMS consent. We do not send unsolicited SMS invitations or verification texts. After confirmation you receive an enrollment acknowledgment and only new eligible events occurring after activation and your confirmation. There are no catch-up texts for past orders, emails, friendships, or other activity.

Frequency varies with activity, up to 10 application texts per day, plus replies to STOP, HELP or START. A text may use multiple SMS segments. Message and data rates may apply, including your confirmation text. Reply STOP to opt out or HELP for help, or email paul@collins-mgmt.com. See the SMS Terms.

For this program we collect your mobile number, selected categories, account identifier when signed in, optional postcard association, consent timestamp, source page, disclosure version and exact disclosure, a hashed network identifier for abuse prevention, phone-confirmation timestamp and provider message identifier, opt-out events, and message delivery status or error codes. We use these records to deliver your selected service notifications, verify consent, prevent abuse and duplicates, honor suppression, and resolve support or compliance requests. Texts do not contain postcard images, private messages, or street addresses. Associating your number with a postcard affects only future eligible events; it does not reveal your number to other users through the map.

We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes. Mobile information and SMS consent are not shared with third parties or affiliates for marketing or promotional purposes. We share only the information needed with service providers supporting this program, including Twilio for messaging and carrier delivery, Vercel for application hosting, and Neon for database storage. These operational disclosures do not authorize providers to market to you.

Consent and delivery evidence is retained as needed to document authorization, investigate errors, and meet applicable legal requirements. We retain suppression records to prevent further texts after withdrawal; deleting an account or postcard does not mean we may resume texting. Contact us for access, correction, deletion, or withdrawal requests. Retention or deletion requests may be limited where records are needed for legal obligations or to honor an opt-out.

Data retention

We keep your order history and account data as long as your account is active. Photos are retained to allow you to view and resend previous orders. You can delete your account and request deletion of your data by contacting us.

Cookies

We use a single authentication cookie to keep you logged in. We do not use tracking cookies or third-party advertising cookies.

Security

All data is transmitted over HTTPS. Passwords are hashed with bcrypt. Payment data is handled entirely by Stripe and never touches our servers.

Your rights

You can request access to, correction of, or deletion of your personal data at any time. Contact us and we'll take care of it.

Changes to this policy

We'll update the "last updated" date at the top when this policy changes. For significant changes, we'll notify registered users by email.

Contact

Questions? Get in touch — we're happy to help.