Privacy Policy

Postlings is a digital pen-pal platform for children aged 6–12, run from Estonia, European Union. Grown-ups (parents, guardians and teachers) hold the accounts; children write letters inside them. Our registered company details and official privacy contact will be added here once verified.

• Grown-up accounts: your first name, email address and password (stored only as a secure hash by our sign-in provider).
• Child profiles: first name only, age, country and interests. We never ask for a child's surname, exact address, school name, photo or contact details.
• Letters and connections: the letters children write, pen-pal requests and approvals, and delivery times.
• Settings: Pip on/off, question allowances, per-child limits and PINs. Child-profile PINs are stored only on your own device, not on our servers.
• Demo mode: if you use Postlings without an account, everything is stored in your own browser's local storage and never leaves your device.

To run the service: deliver letters with realistic delays, show pen-pal profiles to other families (first name, age, country and interests only), apply your safety settings, and remember progress. We do not sell personal data, show advertising, or use children's data for marketing.

• Lovable Cloud hosts the app, accounts and database.
• Pip, the country guide, answers questions through the Lovable AI Gateway. Questions and country context are sent to generate answers; we ask children never to include personal details, and the app checks for contact details before sending.
• Stripe processes payments. Payments are currently in test mode only — no real charges are made.
• Google Fonts loads the typefaces on this site; your browser connects to Google to fetch them.

Lovable collects this data for us. Lovable's privacy policy explains how it handles it. Lovable's analytics uses no cookies, stores nothing on your device, doesn't keep IP addresses and doesn't identify visitors.

For every visitor it records the pages visited, where visitors came from, their country, browser, operating system and device type, how long they stay, how fast pages load, errors, and which buttons and links are clicked (a click is identified by where it is on the page, not by its text). Detailed data is kept for 90 days and daily summaries for a year.

You can ask to see, correct, export or delete your family's data. Self-service export and deletion tools are still being built; until then, contact us and we will help. Deleting your account removes your children's profiles, letters and connections.

Account and letter data is kept while your account is active. Website analytics is kept as described above. We will add exact retention periods here before launch.

We will update this page when the product or our practices change, and note the date at the top.