Postcard Club privacy policy

Who we are

Postcard Club is operated by COMORA PTY LTD, Australia. You can contact us about privacy or support at support@comora.co.

Information you share

We process the email and account information used to sign in, your chosen name, colour and optional avatar, and the photos, postcard words, place text, replies and hearts you submit. Recipient relationships, delivery activity, notification preferences, time-zone settings and device identifiers help us provide access and deliver postcards.

Drafts and selected photos are kept on your device while you edit. A device identifier held in secure device storage, or a browser cookie where applicable, supports sign-in and access to your account.

Apple and Google sign-in

If you choose Apple or Google sign-in, we exchange an authorization code with that provider and verify its identity token. We process the provider account identifier, email and verification information. Apple may supply a private relay email instead of your usual email address.

We keep the provider identifier, linked account email, provider email information and an encrypted refresh token to maintain the connection and revoke provider access when you delete the account. Google access is used for sign-in, account linking and account deletion. This sign-in integration requests basic identity information; it does not request access to Gmail, Drive, Contacts or Google Photos content.

Who can see your postcards

Postcards and replies are available to the people you choose under the service's access rules. Creating a public share link lets anyone with that link see its shared photo and words. Private replies are not included in that public share. Revoking the link stops further access through it, but cannot recall copies someone has already saved.

Reports can contain your explanation, content references and reporter identity. Authorized operators can review reported content and related safety records. Reporting does not automatically remove content, and blocking does not erase previously delivered history.

Photos, location, speech and notifications

Server photo processing removes embedded image metadata from processed photos. You can choose a photo and enter place text without granting device location access. The native app does not request device location permission. If you use the web location lookup, coordinates are sent to BigDataCloud to produce place text.

Optional native speech recognition asks for microphone and speech permissions and uses on-device recognition. Recognized words become postcard text; the app has no audio-upload or stored-recording path for this feature.

If you enable iOS notifications, we store an Apple push token, its environment and its device association. Delivery records include notification and postcard-routing metadata. Apple processes notification delivery through APNs. You can turn notifications off in the app or device settings.

Service providers

The service uses Vercel for hosting and image storage, Neon for its database, and Resend for configured email delivery. Apple and Google handle their sign-in services, and Apple handles iOS push delivery. These providers process the information needed to perform their respective services. Optional web location lookup uses BigDataCloud.

Service operations can also involve technical information and operational logs. This policy does not promise that all processing or backups take place in Australia.

Deletion and retained information

You can request account deletion in the app. The flow requires fresh proof of account access and confirmation. Completed deletion removes account access and linked provider records, revokes linked provider access and public shares, and clears applicable device registrations.

Account deletion removes your postcard and reply records from the service, including delivered postcards and recipients' saved copies held by the service. Associated image files with verified ownership are queued for cleanup. File cleanup can remain pending or need follow-up after account access has been removed; some older uploaded cut-out images need ownership review before their stored files can be removed.

Copies already downloaded by other people cannot be recalled. Backups, operational logs and safety records can remain after account deletion. Retained moderation records, block information and private review exports do not currently have an automatic purge period.

Contact support@comora.co for questions or requests about your information, including retained records or an account you can no longer access. We do not promise immediate deletion of every copy or a fixed retention period in this policy.

Your choices and contact

You can edit your profile, change your verified email, manage email and notification preferences, revoke public share links, sign out and request account deletion. Photo, microphone and speech permissions are optional and can be managed in device settings.

For privacy questions or requests, email support@comora.co. Please do not include sign-in codes, private keys or private postcard content in an initial request. Updates to this policy will appear here with an updated date.