At Postcard Shark, we take your privacy seriously. This policy outlines what information we collect, how we use it, and how long we retain it. Postcard Shark is operated by Derivative Works LLC.
Account Information:
When you create an account, we collect your email address and optional display name. We use your email to send login codes (one-time passwords) and communicate about your orders.
Mailing Addresses:
When you place an order, we collect your return address and the destination addresses for your postcards. These are stored in your address book and attached to order records.
Postcard Content:
We store the images you upload for your postcards, thumbnail versions of those images, and the back text you compose (including messages, fonts, and any link URLs). This content is stored in our database to fulfill your orders and allow you to reuse designs.
Order History:
We retain records of your orders including status, dates, and associated postcard and address information.
Blog Posts:
If you create blog posts, we store the post title, content, and your display name as the author.
QR Code & Open Tracking:
If you enable scan tracking on an order, we generate a unique QR code for each sent card. When a recipient scans the QR code, we log the IP address and timestamp of the scan. This allows you to see whether your postcards were received. You can choose to disable this feature per order.
Analytics:
We collect basic analytics on page visits including: hashed IP address, approximate location (city, country, and state derived from a local geolocation database — your IP is not sent to any third party for this purpose), device type, browser, screen dimensions, and page load performance metrics. Full IP addresses are deleted within 24 hours; hashed IPs are retained for aggregate analytics.
Security & Bot Detection:
On the login page, we collect interaction signals (such as mouse movement counts and touch events) to distinguish real users from automated bots. This data is used solely for abuse prevention.
Cookies:
We use a single authentication cookie (auth_token) to keep you signed in. It expires after 30 days. We do not use advertising or third-party tracking cookies.
We do not sell or rent your personal information. We share data with third parties only as necessary to operate the service:
You can delete your postcards, addresses, and blog posts from within the app. To request full account deletion or a copy of your data, contact us at support@postcardshark.com. We will respond within 30 days. Note that some data may be retained as required by law (e.g., addresses on completed orders for tax purposes).
If you have any questions about this privacy policy or our data practices, please reach out to us at support@postcardshark.com.
Last updated: February 2026