Little letters.Big protection.

Safety at Postlings is not an optional extra parents switch on. It is built into how accounts work, how children connect, how letters travel, and what the app never offers. Our principles:

• ✓Children's best interests come before engagement or revenue.
• ✓Every child profile is created and managed by an authorized grown-up.
• ✓Children have no unrestricted access to strangers — both families approve every friendship.
• ✓Letters are deliberately delayed, never instant.
• ✓Grown-ups can read all of their child's correspondence.
• ✓Privacy settings start at their most protective.
• ✓No behavioral advertising, and we never sell children's personal data.
• ✓No public feeds, followers, likes or popularity rankings.
• ✓Children can block a pen pal without confronting them.
• ✓We review our safeguards whenever features change.

You can see exactly which of these are live today in the safety status section below.

Children aged 6–12 never register on their own and never need an email address or password. The account belongs to the grown-up:

1. 1A parent, guardian or teacher creates the account with their own email and confirms it.
2. 2The grown-up creates each child's profile: first name, age, country and interests.
3. 3The grown-up controls whether a child's profile can be discovered by other families.
4. 4The child takes part only within those permissions — on a family device, optional child PINs keep siblings' letters separate.

Children can only write to a pen pal after both families say yes. Here is what that means in practice:

• ✓Child profiles are private by default; families choose whether to appear in pen-pal discovery.
• ✓Discovery shows only a first name, age, country and interests — never a surname, school, city, address, phone number, photo or social media account.
• ✓Matching filters by age so children meet pen pals close to their own age.
• ✓A connection request must be approved by the receiving family before any letter can be sent.
• ✓Either family can end or block a connection at any time, and the child never has to confront the other user.
• ✓Plans limit how many pen pals a child can have, which keeps correspondence meaningful and reduces unsolicited contact.

Every letter follows a supervised journey:

1. 1Your child writes a letter — with stationery, drawings and stamps, but no attachments.
2. 2Automated checks gently flag phone numbers, email addresses, home addresses, links and social-media names, and the letter can't be sent while they remain.
3. 3In classrooms, the teacher approves each letter before it sends. In families, grown-ups can read every letter their child sends or receives, at any time.
4. 4Only then does the simulated postal journey begin — letters travel at the speed of real distance, from about 12 hours to 10 days.
5. 5The receiving family can read the letter once it arrives. There is no instant messaging anywhere in Postlings.

Photo sharing is off — by design. Children cannot send photographs, files or attachments in Postlings letters today. We would rather keep a feature switched off than ship it before it is safe.

What children can send is creative but contained: colorful stationery, stickers, stamps and drawings made with the in-app drawing pad. Drawings are part of the letter itself, so the same grown-up visibility applies to them.

If we ever introduce photo sharing, it will arrive only with separate send and receive permissions for parents, screening for unsafe content, removal of hidden metadata such as GPS coordinates, file checks, and clear retention rules — and it will stay off by default.

We follow the GDPR's core principles: collect only what we need, use it only for the reasons we tell you, keep it accurate and secure, and keep it no longer than necessary. Here is what we collect and why:

• We never sell children's data, show behavioral advertising, or profile children for marketing.
• Teachers never see a child's private family letters or Pip conversations — classroom and family spaces are separate.
• Payment screens exist only in the signed-in grown-ups area. Children never see prices or checkout.

Under the GDPR, you can ask to:

• ✓see the personal information we hold about your family;
• ✓correct anything that is wrong;
• ✓delete your account and your children's data;
• ✓withdraw consent where processing is based on consent;
• ✓receive a copy of your data in a portable format;
• ✓object to certain kinds of processing.

Every child profile starts with the most protective settings we offer:

• Discoverability off until a grown-up turns it on
• No photos or file attachments
• Contact details and links blocked in letters
• No precise location — country only
• No public activity status, followers or popularity scores
• No instant messaging of any kind
• No behavioral advertising
• Grown-up approval required for every new pen pal

Grown-ups can relax optional settings (like showing a child's age, or enabling Pip). Essential protections — both-family approval, no contact details, no instant messaging — can never be switched off, and no paid plan can weaken them.

If something feels wrong, here is what your family can do today:

• Block a pen pal

  Either family can end a connection instantly from the Grown-ups area. The other child is never told who blocked them or why.

• Read everything

  Grown-ups can read all of their child's letters, so nothing has to be taken on trust.

• Turn things off

  Discoverability, Pip and group letters can all be switched off per child.

Classroom exchanges run in a separate, teacher-supervised space:

• ✓The teacher holds the account and creates student profiles — children never sign up themselves.
• ✓Teachers record which students have parent or guardian permission to take part.
• ✓Classes only exchange letters with approved partner classrooms, and the teacher approves each letter before it sends.
• ✓Classroom letters are completely separate from a child's private family correspondence.
• ✓Teachers cannot see a child's family letters, family Pip chats or other personal information.
• ✓Student Pip questions come from a shared classroom allowance the teacher controls.

For schools, data-protection roles matter: depending on how a school uses Postlings, the school and Postlings may each have their own GDPR responsibilities. We are happy to discuss this with school data protection officers before a class joins.

Postlings is deliberately built without the mechanics that make apps hard to put down:

• Letters take real time — there is nothing to refresh.
• No endless feeds, likes, follower counts or streaks.
• No pressure to reply quickly; a letter that waits is normal.
• Quiet hours keep nights notification-free.
• You can never pay to make a letter arrive faster.
• Stamps and achievements celebrate moments — a first friendship, a finished quiz, 25 thoughtful replies — never time spent or money spent.
• Country activities are designed to continue offline: recipes to cook, words to practice, things to find out together.

Postlings has a free plan and optional paid plans, but money is strictly a grown-up matter:

• Children never see prices, checkout or purchase prompts anywhere in their views.
• Pip never suggests buying more questions — when questions run out, Pip suggests exploring country content instead.
• Essential safety features are free on every plan, forever.
• If you downgrade or cancel, existing friendships and letters are always preserved.
• Paid stationery is decoration only — it never buys access to other children.
• All payments currently run in Stripe test mode: no real charges are made while we finish verification and compliance work.

Postlings is built in Estonia, for families everywhere. Here is the legal landscape we design against — in plain language, with links if you want to read more.

Every protection on this page, checked against what is actually built. We update this section as things ship — and we would rather show you a "planned" than pretend a "done".