Privacy

Draft, last updated November 2026. This draft has not yet been reviewed by a lawyer.

Who this is for

PaperPort is a service for parents and guardians aged 18 and older. Children do not create accounts, sign in, or give us information. The parent decides what to upload and where to send it.

What we collect

• Your email address, so you can sign in.
• Photos you upload of artwork and handwriting, the message you write, and an optional first name for the artist.
• Names and mailing addresses of the people you send cards to.
• Payment records. Card numbers are handled by Stripe and never touch our servers.

How we use it

Only to print and mail the postcards you ask for, show you your archive, and support your account. We do not sell data, show ads, or use your child's artwork to train AI models.

Who helps us

Lob (printing and mailing, receives the card images and recipient address), Stripe (payments), Supabase (secure storage and sign in), and Vercel (hosting). Each processes data only to provide its service to us.

How long we keep it

• Artwork, messages and card history: until you delete them or your account.
• Addresses: until you remove them.
• When you use Delete my data, we remove your drawings, cards and addresses right away. Backups roll off within 30 days. Payment records are kept as tax law requires.

Your choices

You can download images from your archive, remove addresses, or delete all your data from the Addresses page. Questions: privacy@paperport.example (placeholder until a domain is set up).