Privacy

ImpromptuPost spots the moments worth a handwritten card, drafts the card, and mails a real one when you approve it. To do that we need a little information about the people you care about. We keep it to the minimum, we never sell it, and you can delete it at any time.

What we read

• Your contacts (from your phone or Google, if you connect them): names, birthdays, anniversaries and mailing addresses. Read only.
• Your calendar (from your phone or Google, if you connect it): event titles, dates and who was there, so we can spot dinners, visits and occasions. Read only. We don't keep event notes or descriptions.
• Your AI assistant (Claude, and ChatGPT once available, if you connect it): only the card ideas it sends us, such as a name, an occasion and a short reason (“Hosted dinner Saturday”). We never see your conversations, and we strip email addresses, phone numbers and links from what it sends.
• We never read your email or messages. ImpromptuPost has no email integration.

What we keep

• Your account: name, email address, your link (impromptupost.com/you) and your return address if you add one.
• People and dates: the names, dates and addresses above, and the occasions you add yourself.
• Your cards: messages, pictures you upload, and each card's status.
• Your signature and handwriting sample, only if you choose to give them. They are used to sign your cards and to match you to the closest handwriting style.
• Your plan and payments (handled by Stripe; we never see your full card number).

Who we share it with

Only the services that do the work, and only what each one needs:

• Scribeless writes and mails your approved cards: the recipient's name and address, the message, the picture, your signature and your return address.
• OpenAI and TypeSafe draft and check card messages: the recipient's first name, the occasion and a short context line. Not addresses.
• Stripe handles payments. Clerk handles sign-in. Supabase and Google Cloud store and run the app. Resend sends account emails. PostHog records how the app is used (which screens and buttons, not your contacts or messages) so we can improve it.
• A friend who shares their address with you through your link sees only what that page shows them.

We don't sell or rent personal information, and we don't use it for advertising.

Google data

ImpromptuPost's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use Google Contacts and Calendar data only to find moments for cards and to address them; we don't use it to train AI models or share it beyond the services listed above.

Your choices

• Disconnect Google, your phone, or your AI assistant at any time in Settings.
• Delete your contacts and moments, your signature and handwriting, or everything except receipts in Settings → Your data.
• Nothing is mailed without your approval.

Keeping it safe and how long

Data is encrypted in transit and at rest. Connection tokens are encrypted. We keep your information while your account is open. When you delete data in Settings → Your data it is removed right away from the app and within 30 days from backups, except payment records we must keep by law. To close your account entirely, write to us.

Children

ImpromptuPost is for adults. We don't knowingly collect information from children under 13.

Contact

Questions or requests: support@impromptupost.com. We'll tell you here, and by email for significant changes, before this policy changes.