Last updated: October 2026
The short version
- The Create page builds your card in your browser. Your front photo and note are sent to us only when you place an order.
- To send a postcard we need the photo for the front, your note and the recipient’s mailing address. We keep those to make and mail the card and to show you your order history. Your email is optional unless you use your own handwriting.
- Card details go straight to our payment processor. We never see or store your full card number.
- Delete your account and everything tied to it is removed.
- We don’t sell your data and we don’t run advertising trackers. We use PostHog to see how the site is used and where it breaks, and it respects Do Not Track.
What we collect
When you just browse
Our host (Cloudflare) logs standard request data, your IP address, the pages you request, your browser type, for security and to keep the site up. We don’t run advertising cookies. We do use PostHog for product analytics (see below). When you just browse, the only things kept in your browser are your light/dark choice and PostHog’s random ID (below). Cards you build on the Create page are kept in your browser until you send them.
Analytics and session replay
We use PostHog to count visits, see which pages and steps people get stuck on, catch errors and run short surveys. It records the pages you view, clicks, your device and browser type, rough location from your IP address, page speed, and a random ID kept in your browser. We also record short anonymous screen replays of the public pages and the Create page to see where people get confused; every text field is masked, and photos, your note preview and the postcard are blocked from the recording. We don’t record replays on the sign-in, password reset, gift-claim or account pages, and we never record the admin console. If you’re signed in, your events are tied to your account ID, not your email or name. We never send your note, your photo, an address or card details to PostHog, and links that carry a sign-in, reset or gift code are cut down to the bare page address before anything is recorded. If your browser sends Do Not Track or Global Privacy Control, PostHog doesn’t load at all.
When you create an account
- Email address, for signing in, order confirmations and password resets.
- If you sign in with Google, Google shares your email address and basic profile (name, profile picture) with us. We only use the email.
- A password, if you don’t use Google, stored hashed by our auth provider, never in plain text.
When you set up your handwriting
You can photograph your own handwriting: a sentence in lowercase, then the same sentence in capitals. The photos are uploaded to a server, where an algorithm finds your letters, and then they are deleted. We keep the letter shapes it finds, a derived “font”, so you can reuse them on future cards. They’re private to your account.
When you place an order
- The photo you choose for the front and how you framed it.
- Your note, the text drawn on the back.
- The recipient’s name and mailing address and your return address if you add one.
- Payment, your card is handled by Stripe. We receive only a confirmation, the card brand and the last four digits so you can recognize a saved card.
- The finished files we generate for that order (images of the front and back, the pen path, a print PDF), plus a log of the order’s progress.
Who we share it with
We use a small number of service providers to run PenPigeon. They only get the data they need to do their job and they aren’t allowed to use it for anything else:
- Supabase, database, file storage and login. This is where your account, handwriting and orders live. (Hosted in the United States.)
- Cloudflare, serves this website and sits in front of our servers.
- Stripe, processes card payments.
- PostHog, product analytics and session replay (see “Analytics and session replay”). (Hosted in the United States.)
- Resend, sends our emails (order confirmations, password resets).
- Modal, runs the algorithm that finds the letters in the photos you upload when you trace your own handwriting.
- Google, only if you choose “Continue with Google” to sign in.
- The United States Postal Service, we print the recipient’s address on the card and hand it to USPS for delivery.
To make your postcard, a person (currently just the operator of PenPigeon) prints your photo, has your note written on the back in ink, addresses the card and mails it. Your recipient’s address is necessarily seen by that person and by USPS.
We will also disclose data if the law requires it, or to protect PenPigeon or someone’s safety.
How long we keep it
- Account, handwriting, saved cards, until you delete them or close your account.
- Order records and generated files, kept while your account is open so you can re-download them. Basic records of a completed sale (date, amount) may be kept longer where we’re required to for tax and accounting.
- Emails we send, Resend keeps delivery logs for a limited period on their side.
Deleting your data
In your account, Account → Delete my account removes your login, your saved handwriting, your orders and every uploaded file. This is immediate and can’t be undone. If you can’t sign in, email support@penpigeon.com from your account address and we’ll do it for you.
Your rights
You can ask us to show you what we hold about you, correct it, or delete it. Email support@penpigeon.com. If you’re in the EU, UK, or a US state with a privacy law (California and others), you have those rights under that law too, including the right to complain to your local regulator. We don’t sell personal information and we don’t “share” it for cross-context advertising.
Children
PenPigeon isn’t intended for anyone under 16. We don’t knowingly collect data from children. If you believe a child has given us information, email us and we’ll remove it.
Security
Data is encrypted in transit (HTTPS) and at rest by our providers. Uploaded photos and generated files are stored in private buckets that require a signed link to access. No system is perfectly secure, but we keep the amount we collect small on purpose.
Changes
If we change this policy in a way that matters, we’ll update the date at the top and, for material changes, email account holders. Continuing to use PenPigeon after a change means you accept it.
Contact
PenPigeon support@penpigeon.com
This is a plain-language draft written by the person who built PenPigeon. It is not legal advice. If PenPigeon starts taking real payments and mailing cards at any volume, have a lawyer review this and the Terms.