Privacy Policy
Effective [EFFECTIVE DATE]
Postale finds the days worth keeping in your photographs and issues each one as a Card. It works on your iPhone. This page says what leaves your iPhone, who receives it, why, how long it's kept, and what you can ask of us.
The short version
- Postale has no accounts. We never ask for your name, email address or phone number.
- Postale reads your photographs on your iPhone. No images are sent to us except for the ones you choose to make cards from.
- The one photograph each Card is painted from, its Cover photograph, is made smaller and stripped of its metadata (where and when it was taken, the camera) before it leaves. Our press sends it to OpenAI, which paints the Cover.
- We delete the photograph and the Cover from our press within a day at most, usually within minutes. OpenAI may keep them for up to 30 days to check for abuse, and doesn't use them to train its models.
- Your Cards live on your iPhone and in your own iCloud. We can't read them.
- Postale asks for no location permission, and has no analytics, no advertising and no tracking. We don't sell anything about you.
Who we are
Postale is made by [OWNER LEGAL NAME], of [ADDRESS]. We decide how the information on this page is used, which makes us its controller under the UK and EU General Data Protection Regulation (GDPR).
Write to us at [CONTACT EMAIL].
[EU REPRESENTATIVE: name and address, if the owner is established outside the EU.] [UK REPRESENTATIVE: name and address, if the owner is established outside the UK.]
What stays on your iPhone
Postale needs access to your photo library. With it, Postale looks through your photographs on your iPhone: when and where each was taken, and what's in them, to judge which days are worth a Card. That judgement, the Places, the Trails and the figures on a Card's Back are all worked out on your iPhone, from your photographs' own information. None of it is sent to us.
Postale never asks for Location Services. Where a photograph was taken comes from the photograph itself.
The morning notices about a day waiting for you are scheduled on your iPhone.
The photograph that leaves your iPhone
A Card's Cover is painted from one photograph of its day, the Cover photograph. It is the only photograph that ever leaves your iPhone.
- You choose it. When you issue a Card, you choose the Cover photograph. For your first three Cards, when you tap Let's go, Postale picks a photograph for each of three days it found and makes them for you. Those three photographs leave your iPhone too.
- It's made smaller and stripped first. On your iPhone, the photograph is turned into a JPEG no larger than 1024 pixels on its long side, with all of its metadata removed: no location, no date and time, no camera details.
- It goes to our press, then to OpenAI. Our press is a small server run on Cloudflare. It sends the photograph to OpenAI's image model, together with Postale's house-style reference, and receives the painted Cover back. Your iPhone then collects the Cover from the press.
- We delete it. The press deletes the photograph as soon as the Cover is painted, and the Cover as soon as your iPhone has collected it. If anything goes wrong, a sweep deletes both after a day at most.
- OpenAI may keep it for a while. OpenAI keeps what it's sent for up to 30 days in logs it uses to detect abuse of its service, and then deletes it. We haven't arranged zero data retention with OpenAI. OpenAI doesn't use data sent through its API to train its models. OpenAI's own policies are at openai.com/policies.
The day's date travels with the photograph (see below), but nothing else about the day does: no Place, no Trail, no other photographs.
What else the app sends to our press
To make sure only a genuine copy of Postale asks for a Cover, and to count Free cards and Membership fairly without accounts, the app also sends our press:
| What | Why |
|---|---|
| App Attest proofs from Apple: a key made for this install and a signature on each request | to know the request comes from a genuine copy of Postale on a real iPhone |
| Your App Store install proof (Apple's signed AppTransaction), which carries an identifier Apple gives your Apple Account for Postale, and the date you first got the app | to count your Free cards and your Back issues, which follow your Apple Account across reinstalls |
| A DeviceCheck token from Apple | so that Apple can tell us whether this iPhone has already used its Free cards, perhaps under another Apple Account |
| Your App Store purchase proofs (Apple's signed transactions and renewal information) | to know whether you have Membership |
| A push token from Apple | to send one notification when a Cover is ready or couldn't be painted |
| The date of the day a Cover is for | to apply the rules on which days can be issued, and how often |
The press never stores the identifier from your install proof. It keeps only a one-way code made from it, which it can't turn back into the identifier. It never learns your name, your email address, your Apple Account's details or your payment details.
Cloudflare, which runs the press, sees your iPhone's IP address, as any server does. The press uses it only to limit how often one address can start Postale's security check, and doesn't store it.
What our press keeps, and for how long
| What | How long |
|---|---|
| The Cover photograph | until the Cover is painted: seconds, or about 20 minutes if painting keeps failing. A day at most. |
| The Cover | until your iPhone collects it. A day at most. |
| The push token | until the notification is sent. A day at most. |
| A record of each Cover asked for: its job number, the day's date and whether it's ready | one week |
| For each install: the App Attest key, the one-way code from your install proof, the install date, Apple's DeviceCheck answer | [RETENTION TO DECIDE: kept today with no deletion date] |
| For each Apple Account, under the one-way code: one line per Cover (job number, the day's date, whether it was a Free card, a Back issue or Membership, its estimated cost and when) | five weeks for Membership Covers of recent days; for Free cards and Back issues, as long as the count is needed [RETENTION TO DECIDE: kept today with no deletion date] |
| Membership: the date it runs until, from Apple's word | [RETENTION TO DECIDE: kept today with no deletion date] |
| The press's logs | job numbers, sizes and outcomes only: never images, dates of days, keys, the one-way code or tokens. [CONFIRM: Cloudflare Workers log retention on the owner's plan.] |
Apple
Some of Postale works through Apple, under Apple's own privacy policy (apple.com/legal/privacy):
- iCloud. Your Cards, their Covers and their Backs are kept on your iPhone and, if you use iCloud, in a private database in your own iCloud account, so they follow you to a new iPhone. That database belongs to your iCloud account: we can't read it.
- Maps. A Card's Back shows its Trail over a live Apple map inside the app. To draw the walk along the streets, Postale asks Apple Maps for walking directions between the Trail's stops, so Apple receives those points when you open a Card. Nothing from Apple Maps is saved into a Card.
- The App Store. Apple takes payment for Membership. We never see your payment details. When the app first sets up its security check, our press may ask the App Store whether you have Membership, using the identifier from your install proof.
- App Attest, DeviceCheck and notifications are Apple's services, used as described above.
If you test Postale in TestFlight
Beta versions of Postale installed from Apple's TestFlight have one more thing: Help improve Postale, in Profile. If you use it, you can mark which of a day's photographs Postale got wrong and send us a file of the numbers Postale measured: when each photograph was taken (to the minute), what Postale's on-device analysis made of it (scores, the kind of scene, shares of the frame covered by text or people), what Postale decided, and your marks and notes. It never holds your photographs, where they were taken, the words in them, your camera or your iPhone's name.
You see a summary, and the file itself if you want, before anything goes, and you choose where it goes (Mail, Messages, AirDrop or Files). Postale never sends it by itself, and it doesn't reach our press. We use what you send only to improve how Postale picks days and photographs, and we keep it only with your agreement. Ask us to delete it at any time. The App Store version of Postale doesn't have this feature.
What we don't do
- No accounts, and no sign-in.
- No location permission and no tracking of where you go.
- No analytics, no advertising and no tracking across other companies' apps or websites.
- No selling or sharing of your information for advertising.
- No recognising faces or people on our press.
- No keeping your Cards or your photographs on our press.
Why we use it (our lawful bases)
- To make the Cards you ask for (GDPR Article 6(1)(b), a contract with you): the Cover photograph, sending it to OpenAI, the date of the day, the push token, and the purchase proofs that show your Membership.
- To keep Postale safe and fair (Article 6(1)(f), legitimate interests): the App Attest and DeviceCheck proofs, the install proof and the counts kept under the one-way code. Each Cover costs us money to paint, and without accounts these are the only way to stop a tampered app, or someone with many Apple Accounts, from running up the bill. We keep them to the minimum: no identifier we could use to find out who you are.
- People in your photographs (Article 6(1)(f), legitimate interests): a Cover photograph may show other people. It's one photograph, stripped of its metadata, painted as an illustration, and deleted quickly. Nobody is identified from it.
Where it goes
Cloudflare runs the press in its data centres around the world. OpenAI is in the United States. Both process what we send them only on our instructions, under data processing agreements. Where your information leaves the UK or the European Economic Area, it's protected by [TRANSFER MECHANISM: e.g. the EU–US Data Privacy Framework, the UK Extension, or the standard contractual clauses and the UK Addendum in each processor's agreement. CONFIRM the agreements are signed.]
Your rights
Under the UK and EU GDPR you can ask us for a copy of your information, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable form. You can also complain to the data protection authority where you live or work. In the UK that's the Information Commissioner's Office (ico.org.uk).
Because Postale has no accounts, we hold nothing that tells us who you are, so we can't look you up by name or email address. Most of what Postale knows about you, you already control:
- Your Cards. Delete a Card in the app. Delete them all by deleting Postale and its data in your iCloud storage, in the Settings app.
- Your photographs. Change Postale's access to your photo library at any time in Settings › Privacy & Security › Photos.
- Notifications. Turn them off in Settings › Notifications › Postale.
- Membership. Manage or cancel it in Settings, under your Apple Account's Subscriptions.
For anything the press keeps, write to [CONTACT EMAIL]. We'll answer within a month, and we'll tell you what we need to find your records.
Children
[MINIMUM AGE: the owner's decision. Postale isn't directed at children, and the age rating and the Terms should say the same age.]
Changes
If this policy changes, we'll update the date at the top. If a change matters, for example if another company starts receiving your photographs, we'll tell you in the app before it happens.
Contact
[OWNER LEGAL NAME], [ADDRESS]. [CONTACT EMAIL].