Privacy
What we keep, why, who else handles it, and how to have it back or gone. No advertising, no analytics, and nothing is ever sold.
Last updated 23 September 2026.
The short version
- We keep what it takes to make a card, send it, and keep it on a mantle. Nothing else.
- We never sell your information, show you ads, or use trackers or analytics scripts.
- Location is never read from your photographs.
- Children are never account holders. They appear on cards; they don’t sign up.
- You can download everything at any time, and ask us to delete it.
What we keep
Your account. Your email address, which is how you sign in, and your name if you give it. Signing in records a rough description of the device — “Windows desktop · Chrome” — so you can recognise it. Never your location.
Your household and the people on your cards. Names, how people are related, and a birth year if you add one. Never a full date of birth.
What you write. Greetings, letters, updates about each person, and moments from the year.
Your photographs. Resized copies of the pictures you choose, the date each was taken, and any faces you tag by hand. Before a picture leaves your device it is redrawn, which drops everything else the camera stored in it — including where it was taken. We don’t keep the original file. Nothing recognises faces: every tag is one a person placed.
The people you send to. Their names, and an email address or phone number if you add one. We use those only to recognise somebody who already has an account, so the card lands on their mantle. We don’t message them; you share each card’s link yourself.
Payments. What you paid and when, and Stripe’s reference for it. Your card number never reaches us — Stripe holds it.
Messages you send us through the contact form, and refund requests.
When a card is opened
For each person on your list we record when they first opened the card and how many times it has been opened. You see who has opened it, by name — never when, and never how often. We don’t record anybody’s IP address or browser for this.
A card opened in a browser is remembered in that browser, so it can be kept on a mantle if the person later makes an account. Opening a card never requires one.
Who can see a card
Anybody with its link, unless you lock it. A card link is long and unguessable, but it can be forwarded, and whoever it reaches can open it and see its photographs. A locked card opens only for people on your list who have signed in.
Cards are hidden from search engines, and a card link is not passed on to other websites when somebody follows a link out of it.
Who else handles it
A handful of companies run parts of the service for us. Each gets only what its job needs and may not use it for anything else.
- Vercel runs the website.
- Neon hosts the database.
- Cloudflare stores photographs.
- Stripe takes payments, and keeps what a payment processor is required to.
- Resend delivers the two kinds of email we send: sign-in links, and the one message telling somebody a card has been paid for them.
They operate mainly in the United States, which is where your information is stored. We would share information with anybody else only if the law required us to.
Why we use it
To provide what you asked for: building, paying for, sending and keeping cards. To keep the service secure — sign-in records exist so you can see and end your sessions. And to meet legal duties, such as keeping records of payments. We don’t use your information to profile you, and nothing is used to train AI.
How long we keep it
As long as your account exists, and then as described on your data and deleting it. That page also covers what happens to cards you’ve already sent, which live on other people’s mantles.
Your choices
- A copy of everything — download it from your account: your cards, the people on them, your list, and every photograph at full size.
- Corrections — most things can be edited in the app. Anything else, ask us.
- Deletion — ask us, and we’ll do it within 30 days.
These are yours wherever you live, including the rights California and European law give you. We don’t sell or share personal information for advertising, so there is nothing to opt out of.
Children
Accounts are for adults. Children appear on their family’s cards, added by a parent, and never have logins of their own. If you believe a child has made an account, tell us and we’ll remove it.
Cookies
Only the ones that make signing in and drafts work — listed on cookies.
Changes
If this changes, the date at the top changes with it, and a significant change is described on this page rather than slipped in.