Privacy Policy
Last updated: July 29, 2026
My Virtual Postcard ("we", "us") lets you design a digital postcard and share it with someone through a private link. This policy explains what personal data we collect when you use the app, why we collect it, who we share it with, and the choices and rights you have.
The short version
We collect the account details you give us, the postcards you create, and the recipient information needed to send and track your shares. We use Supabase to host our database, authentication, and file storage, Resend to deliver emails, and (optionally, with your consent) Google Analytics via Google Tag Manager to see how the site is used. We never sell your personal data.
Who is responsible for your data
My Virtual Postcard is the data controller for the personal data described in this policy. Questions about this policy or your data can be sent via the app owner's contact channels (see "Contact us" below).
Information we collect
Account information
When you create an account, we collect your email address and password (stored in hashed form by our authentication provider), and, if you sign in with Google, your name, email address, and profile picture as provided by Google. You may also add a display name in your account settings.
Your postcards
The images or PDFs you upload, any text or message you write on the back of a card, and formatting choices (orientation, crop, stamp, fonts) are stored so your card can be displayed and edited.
Sharing and recipient information
When you share a card, we generate a unique link and store its status (opened, revoked, expiry). If you use email invites or the "collect emails" feature, we store the recipient's name and email address so we can send them the card and let you track whether it was opened. For personal links, we also store a hashed, anonymous device identifier (via a cookie) to limit how many devices a single link can be opened on; this cannot be used to identify a person on its own.
Usage and device data
Our hosting and email providers automatically log standard technical data (such as IP address, browser type, and timestamps) for security and delivery purposes. If you accept analytics cookies, we also collect anonymized usage statistics through Google Analytics. See our Cookie Policy for the full list of cookies and how to change your choice.
How we use your information
- To create and secure your account, and let you sign in.
- To let you design, save, and edit your postcards.
- To generate share links, send invite and notification emails, and show you who opened a card.
- To keep the service secure and prevent abuse, such as limiting how many devices a personal link can be opened on.
- To understand how the site is used and improve it, only if you have consented to analytics cookies.
- To communicate with you about your account or respond to a request you make.
Signing in with Google
If you choose "Continue with Google", Google shares your name, email address, and profile picture with us so we can create or sign you into your account. We only request the minimum information needed to identify your account and do not request access to your Google Drive, Gmail, or other Google data. You can review or revoke this access at any time from your Google account's "Security" → "Third-party access" settings.
Who we share data with
We share personal data only with the service providers that help us run the app:
- Supabase, our database, authentication, and file storage provider.
- Resend, our transactional email provider, used to deliver invite, notification, and one-time code emails.
- Google, for sign-in (OAuth) and, only with your analytics consent, Google Tag Manager / Google Analytics.
These providers process data on our behalf under their own data processing terms and may not use it for their own purposes. We do not sell personal data, and we do not share recipient email addresses with anyone other than these processors.
How long we keep your data
We keep your account and postcards for as long as your account is active. If you delete a card, its files and share links are deleted with it. If you delete your account, we delete your personal data within a reasonable period, except where we are required to keep certain records for legal or security reasons (such as fraud prevention). Share links can also be revoked or set to expire by you at any time.
Your rights
Depending on where you live, you may have the right to:
- Access the personal data we hold about you.
- Correct inaccurate data, for example your display name or email.
- Delete your account and associated data.
- Export your data in a portable format.
- Object to or restrict certain processing, such as analytics.
- Withdraw consent at any time, without affecting past processing.
- Lodge a complaint with your local data protection authority.
You can exercise most of these rights directly from your Account page, or by reaching out via the app owner's contact channels.
Children
My Virtual Postcard is not directed at children under 16, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can remove it.
International transfers
Our service providers may process data in countries outside your own. Where this happens, they do so under appropriate safeguards, such as standard contractual clauses, as required by applicable data protection law.
Changes to this policy
We may update this policy from time to time, for example when we add a new feature that affects the data we collect. We will update the "Last updated" date above when we do, and, for significant changes, let signed-in users know.
Contact us
For questions about this policy or how your data is handled, please reach out via the app owner's contact channels, or from your Account page when signed in.