Penspoke Privacy Policy

What we collect

When you use the Penspoke app

• Your account. Your email address and your sign-in identity. If you sign in with Google, we receive your name and email from Google. We never receive your Google password.
• Your recipients. The name and mailing address of each person you send a card to. You type this in, and it is saved on your device. It is personal information about other people, and you confirm you have the right to give it to us. When you place an order, the recipient's name and address for that order are sent to us so we can write and mail the card.
• Your card. The message you write inside a card, and the card front you choose from our catalogue. If you upload your own image to use as a card front, we also collect that image. Uploading your own card front is not available in every version of the app.
• Payment. When card payment is turned on, payment is handled by Stripe. We never see or store your full card number. We keep a record of the transaction and, if you provide one, a billing address.
• Postal-code lookup. When you enter a recipient's postal code, the app sends that code and the country to an outside postal-code lookup service to suggest the city and state. We do not send the recipient's name, the street, or your message to it.
• App usage. The app uses PostHog to measure how the app is used, such as which screens you open and the steps you take to place an order. We do not send your card message, your recipients' names or addresses, or your email address to PostHog. You can turn this off at any time with a switch in the app's settings. The app does not use Google Analytics.

When you visit penspoke.com

• Site usage. The website uses PostHog and Google Analytics 4 (loaded through Google Tag Manager) to measure how pages are used, such as the page viewed, approximate location from your network address, and device and browser type. These load only if you have not opted out (see Your choices). This is the only place Google Analytics is used; the Penspoke app does not use it. PostHog sets a cookie whose name starts with "ph_", and Google Analytics sets cookies whose names start with "_ga". If you opt out on our privacy page, we delete those cookies and do not load either tool again in that browser.

When you contact us

• When you send us a message through the contact form at penspoke.com/contact, we collect your name, your email address, the topic you choose, and the message you write, so we can read it and reply to you. To protect the form from spam and abuse, we also keep a one-way scrambled form of your internet (IP) address that cannot be turned back into your real address, the type of browser you used, and the time you sent the message, and we run an automated check that you are a person before we accept it. We use what you send only to answer you. We keep these messages for 24 months and then delete them, or sooner if you ask us to.

How we use your information

We use your information only to run Penspoke: to create and manage your account, to check recipient addresses, to write and mail the cards you order, to take payment, to answer you when you contact us, to keep records of your orders, to understand and improve the website, and to meet our legal and tax obligations. We do not use your recipients' details or your card message for anything other than writing and mailing your card.

How your card is written

Your card is written by a pen plotter, a machine that holds a real pen and draws your message onto the card in real ink in a handwriting style.

How we check your recipient's address

When you give us a recipient address, we check it with an address checker so your mail is formatted correctly and is more likely to arrive. The service standardizes the address and flags obvious problems; it does not guarantee that a card will be delivered.

How we mail your card

We prepare your card and hand it to the United States Postal Service, which carries and delivers the mail. We do not sell or give your recipient's address to anyone for their own use.

How we keep your information safe

We protect your information with reasonable measures. Data moving between the app, the website, and our servers travels over an encrypted connection (TLS). Access to stored information is limited to the people and services that need it to run Penspoke. No service can promise perfect security, and we do not claim any security certification.

Who we share information with

We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We use the service providers below so they can perform services for us; they may use the information only to do so.

We also rely on service providers for hosting our systems, for sending account and order email, for storing any card-front image you upload, and for carrying the mail. We may also disclose information if the law requires it, to enforce our Terms, or to protect the rights, safety, or property of Penspoke, our users, or others. If the business is sold or merged, information may transfer as part of that deal, subject to this policy.

How long we keep your information

• Your account, and the recipient and message details on your orders: kept while your account is open; when you delete your account they are held for 30 days and then permanently deleted, or erased sooner on request, subject to legal and tax holds.
• A card front you upload: kept while your account is open, or one year from when you upload it, whichever is longer. It is permanently deleted when your account is permanently deleted.
• A redacted record of each order and payment, with the recipient details, billing details, and your message removed: kept for seven years from the date of the order, then deleted. We keep these to meet tax, accounting, and legal obligations.
• Messages you send us through the contact form, including your name, email, the topic, your message, a one-way scrambled form of your internet (IP) address, and your browser type: kept for 24 months, then deleted, or erased sooner on request, subject to legal and tax holds.
• Website and app analytics: kept according to our analytics providers' retention settings.

Deleting your account

You can delete your Penspoke account from the app at any time: open Penspoke, go to Account, and tap Delete my account. Your account closes right away. We hold it in a recycle bin for 30 days, during which you can ask us to restore it, and after that we permanently delete it. For exactly what is deleted, what we keep, and for how long, seepenspoke.com/delete-account. You can also request deletion if you cannot open the app (see "How to reach us").

Children

Penspoke is not for anyone under 18. We do not knowingly collect information from anyone under 18. If you believe someone under 18 gave us information, contact us and we will delete it.

Your choices, Do Not Sell or Share, and GPC

We do not sell your personal information and we do not share it for cross-context behavioral advertising as California law defines those terms. In the Penspoke app you can turn off product analytics with a switch in the app's settings. On penspoke.com you can turn off website analytics using the "Do Not Sell or Share My Personal Information" option on this page, and we also honor a Global Privacy Control (GPC) signal from your browser automatically. If you are a California resident, you can ask us to tell you what we collect, give you a copy, correct it, or delete it, and we will not treat you differently for asking. To use any of these rights, contact us using "How to reach us" below; we will verify your request before acting on it.

How to reach us

You can reach us through the contact form at penspoke.com/contact.

Changes to this policy

We may update this policy. If we make a material change, we will update the "Last updated" date and take reasonable steps to let you know.