About this policy
Postcarto turns travel photos into illustrated postcards and helps you save, revisit and share them. This policy explains how information is handled when you visit the website, create an account or open a shared postcard.
“We” and “us” mean the operator of Postcarto. You can reach us through the contact details below.
Information we collect
- Account information. Your email address, account identifier, sign-in records, chosen public username, postcard preferences, plan and creation usage.
- Your memories. Photos you upload, generated artwork, titles, stories, locations, travel dates and privacy settings. If a photo contains location or date metadata, we can use it to suggest where and when it was taken.
- Sharing information. Airmail recipient labels, sender names, notes and link settings; social submissions, permission records, optional Instagram usernames, captions and publishing results.
- Support and safety information. Messages you send us, content reports and the information needed to investigate them. A report can retain a limited text excerpt of the reported postcard.
- Technical information. Our hosting and authentication providers may process IP addresses, browser information, request times, errors and security logs to deliver and protect the service.
Signing in with Google
If you choose Google, Google shares your account identifier, email address and basic profile information, such as your name and profile picture, with our authentication provider, Supabase. We use this information to create and secure your account and recognize you when you return.
Postcarto does not request access to Gmail messages, Google Drive files, Google Photos or contacts. Your public author name is the username you choose in Postcarto, not your Google email address. Google sign-in information is not sent to our AI models for postcard creation or used for advertising.
You can remove the connection through your Google Account connections. Removing it does not automatically delete your Postcarto account or saved memories. Email sign-in is also available.
How we use information
We use information to sign you in, create and store postcards, suggest places and text, show your world, apply account allowances, carry out sharing choices, answer requests and prevent misuse. An email address is required for an account; a photo is needed to create a postcard. Public sharing and social submissions are optional.
Where data protection law requires a legal basis, we rely on performing our agreement with you for the features you request; our legitimate interests in maintaining a reliable, secure service for security and abuse prevention; consent for optional social publishing; and legal obligations when they apply.
We do not sell your personal information or use it for targeted advertising. Postcard suggestions do not make legal or similarly significant decisions about you.
Photos and AI processing
Postcarto uses Google’s Gemini API to suggest places, titles and stories and to turn your photo into artwork. The relevant photo, instructions and, where needed, location or postcard text are sent to Google to perform that request. This applies to private postcards too. Public postcard text can also be used to generate a place summary, and submitted postcard content can help draft social captions.
Choosing Original skips AI image generation; requesting place or writing suggestions still uses AI. Suggestions can be inaccurate, so check them before saving or sharing.
Google processes these requests under its Gemini API terms. Those terms distinguish paid and unpaid processing: unpaid use may include product improvement and human review, while paid processing has different data protections. Do not upload sensitive or confidential information.
Private, public and shared
Private by default. New memories are not listed publicly. We and our service providers still process them to deliver the features you use.
Public postcards. If you make a postcard public, others can see its artwork, original photo, title, story, place, date and public username. It can appear on the world, place pages and search engines. Public place dots use town centers.
Airmail links. Anyone with an active link can open its shared postcard and dedication without signing in. Recipients can forward the link or save what they see. You can stop a link from the postcard’s sharing controls. Postcarto does not import your address book or record whether a recipient opened a link.
Making content private, stopping a link or deleting a memory restricts future access through Postcarto. It cannot recall copies, screenshots or search-engine caches already held by others.
Service providers and transfers
We use Supabase for authentication, database and photo storage; Google for sign-in and AI processing; and hosting infrastructure to serve and secure the website. Upload-Post and Meta receive the content needed for approved social publishing. Providers receive information needed for their part of the service.
Information may be processed outside your country, including in the United States. Applicable protections depend on the provider, service and region. Contact us for details about the arrangements relevant to your information.
We may also disclose information when required by law or when necessary to investigate abuse, protect someone’s safety or establish or defend legal claims. External sites and social platforms handle information under their own policies.
Retention and deletion
We keep account information and saved memories while needed to provide your account and the features you use. You can delete individual memories in the app. For account deletion or a copy of your data, contact us from your account’s email address.
Deleting a memory removes it from the app. Removing unused image files may take additional processing; backups and provider logs follow their own retention cycles. Images retained for an approved social submission are handled separately, as described above.
We may keep limited records after deletion when needed for security, usage accounting, permission evidence, unresolved reports or legal obligations. Retention depends on the record’s purpose, ongoing sharing, an outstanding request or dispute, and applicable requirements. We do not promise that every copy disappears immediately.
Your choices and rights
You can edit your username and memories, change postcard visibility, download postcards, stop Airmail links and withdraw pending social submissions in the app.
Depending on where you live, you may have rights to access, correct, delete or receive a portable copy of your personal information, restrict processing, or withdraw consent. You may also object to processing based on legitimate interests. Withdrawing consent does not invalidate processing that took place before withdrawal.
Contact us to make a request. We may need to verify ownership before releasing or changing account information, and we will respond within the period required by applicable law. You may complain to your local data protection authority; UK users can contact the Information Commissioner’s Office.
Age and policy changes
Postcarto is intended for adults aged 18 and over. If you believe a child has provided personal information through an account, contact us so we can investigate and take appropriate action.
We may update this policy as the service changes. The date above identifies the latest version. Where required, we will give notice or ask for consent before making a material change to how information is used.
Contact Postcarto
For privacy, account deletion, support or content-removal requests, contact @postcarto on Instagram. Please identify the account or postcard concerned, but never send passwords or sign-in links.
Our Terms of service explain the rules for using Postcarto.
Optional social features
Submitting a postcard to be featured is a separate choice. Only after you give permission do reviewers receive a snapshot of its artwork, original photo, postcard details and optional Instagram credit. We keep a record of that permission.
If approved, both images and a caption are sent through Upload-Post to Postcarto’s selected Instagram or Facebook account. Those posts are public even if your postcard remains private in Postcarto. You do not connect your own social account.
You can withdraw a submission while it is awaiting review. Approved submissions retain their publishing snapshot; editing or deleting your memory does not automatically update or remove a social post. Contact us to request removal of a post we control or withdraw permission for future use. Copies held by others may remain.