The short version
- We collect what a card needs and what an account needs. Nothing is sold, ever.
- Your recipients' addresses are used to write and post cards and for nothing else. They are never marketed to and never shared with anyone but the postal carrier.
- We do not train AI models on your data.
- Card content is deleted 90 days after the card is posted. Address-book contacts stay until you delete them.
- You can export or delete everything by emailing us, and we will do it within 30 days.
What we collect, and why
| What | Why we need it | Where it comes from |
|---|---|---|
| Your name and email | To create an account, sign you in, and email you about orders | You, at sign-up |
| Your company name and return address | It is printed on the envelope, because the post needs somewhere to return an undeliverable card to | You, in settings |
| Your recipients' names and postal addresses | To address the envelope. There is no way to post a card without them | You, or your CRM through the API |
| The message written on each card | It is what the pen writes | You, or your CRM through the API |
| Optional contact details you save — email, company, birthday, work anniversary | To power automations you set up yourself, such as a birthday card rule | You, or a CSV you import |
| Billing details | To take payment. Card numbers go straight to Stripe and never touch our servers | You, at checkout |
| Support conversations | To answer you, and to improve the answers | You, in chat or by email |
| Usage analytics — pages viewed, device type, approximate region | To see which parts of the site work. No advertising profile is built and we do not sell audiences | Your browser |
Your recipients
When you send a card, you are the controller of that person's data and we are your processor: we act on your instruction and for no other purpose. In practice that means a recipient's address is used to write an envelope and hand it to a carrier, and then it sits in your account history until you or we delete it. We do not add recipients to any mailing list, do not market to them, and do not use one customer's recipients to enrich another's.
If a recipient contacts us directly asking to be removed, we will tell them which customer sent the card and pass the request to you, because it is your relationship and your record to correct. If they ask us to delete their details outright, we will.
Who else processes it
These companies help us run Scribble. Each one receives the information needed for its role. Google also processes Customer Reviews information under its own privacy policy, as described below.
| Who | What for | What they see |
|---|---|---|
| Cloudflare | Hosting, the CDN, and image processing | Everything in transit; card artwork at rest |
| Supabase | The database and sign-in | Accounts, contacts, orders, card content |
| Stripe | Payments | Your billing details. We never see a full card number |
| Brevo | Transactional email — receipts, status updates | Your name and email address |
| Resend | A fallback email route when Brevo is unavailable | Your name and email address |
| Anthropic (via Cloudflare's AI Gateway) | The support assistant on our website | Your support messages. Not used to train models |
| Google Analytics | Website analytics | Anonymous usage, IP truncated |
| Google Customer Reviews | An optional shopping-experience survey after a store order | The buyer's email address, an order reference, the delivery country and estimated delivery date |
| Contentful | Blog content | Nothing of yours — it holds our own articles |
| USPS | Delivering the card | The recipient's name and address, on the envelope |
We are based in the United States and our infrastructure is US-hosted. If you are in the UK or the EU, sending us data means transferring it to the US; we rely on the standard contractual clauses with the processors above where those apply.
Google Customer Reviews
When available after a card order through our store, Google Customer Reviews asks whether you would like to rate your shopping experience. To show that invitation, we share your order-confirmation email address, an order reference, the delivery country and the estimated delivery date with Google. Google receives these details when the invitation is displayed, before you choose whether to take part.
If you opt in, Google may email you a survey after the estimated arrival date. Taking part is optional and does not affect your order. The invitation goes to you, the buyer. We do not give Google the card message or your recipient's name, postal address or email address for this service.
Google processes this information under Google's privacy policy. Its review tools may use cookies, web beacons or similar technologies and receive information about your browser and transaction. See the Cookies section below for ways to manage these technologies.
AI assistants connected to your account
Scribble can be connected to Claude, ChatGPT, Gemini and other assistants over the Model Context Protocol. This is worth its own section because people reasonably assume it means more sharing than it does.
- We receive only the arguments of the tool the assistant calls — a name and address, the text to write, a card code. Your conversation is not sent to us and the protocol gives us no way to ask for it.
- The assistant receives only what it asks for, for the single organization you chose when connecting, and only within the permissions you ticked.
- We do not send your data to any AI provider as part of this. Your assistant's provider sees whatever you type to it under their terms, not ours.
- Nothing is used for training. Not by us, and we do not pass your data to anyone who would.
- You can revoke it in one click, from Integrations. It takes effect immediately.
The separate support assistant on our website runs on Anthropic's models through Cloudflare's AI Gateway. It sees the support conversation you type and the public documentation, and nothing else about your account unless you tell it.
How long we keep things
| What | How long | Then what |
|---|---|---|
| Card message text and recipient address | 90 days after the card is posted | Deleted automatically. The order record survives without the message or the street address |
| Order and payment records | 7 years | Kept because tax law requires it |
| Address-book contacts | Until you delete them | Yours to manage; deleting one removes it immediately |
| API request logs | 90 days | Deleted automatically |
| Support conversations | 2 years | Deleted automatically |
| Analytics | 14 months | Deleted by Google on their schedule |
| An account you close | 30 days | Everything except the records tax law makes us keep |
Your rights
Wherever you are, you can ask us for a copy of your data, ask us to correct it, ask us to delete it, or ask us to stop processing it. Email privacy@scribblecards.com and we will answer within 30 days. We will not make you fill in a form or ask why.
If you are in the EU or UK, the legal bases we rely on are: performing our contract with you (sending the cards you ordered), legitimate interests (keeping the service running and secure), and consent (analytics, and any marketing email — both refusable with no loss of service). You have the right to complain to your data protection authority.
If you are in California, you have the right to know, delete, correct and opt out of sale or sharing. We do not sell or share personal information as those terms are defined by the CCPA, and we do not use it for cross-context behavioral advertising.
Cookies
We set cookies needed to keep you signed in and remember which organization you are looking at. Google Analytics uses cookies for website analytics. Google Customer Reviews may use third-party cookies, web beacons or similar technologies when its invitation appears on your order confirmation. We also use your browser's session storage to avoid showing the same invitation repeatedly.
You can block or delete cookies, including third-party cookies, in your browser's privacy settings. You can also manage Google technologies through Google's privacy controls. Blocking review tools does not affect your completed order; blocking sign-in cookies may stop account features from working. You can decline the Google review invitation to avoid receiving its survey email. That choice is separate from your Google Analytics preferences.
Children
Scribble is for businesses and adults. We do not knowingly collect data from anyone under 16. If you believe a child's data has reached us, tell us and we will delete it.
Changes
If we change anything material we will email account holders before it takes effect. The date at the top is the date this text last changed.
Contact
Devon Oak LLC, 5900 Balcones Dr STE 100, Austin, TX 78731, United States. Privacy questions: privacy@scribblecards.com. Anything else: hello@scribblecards.com.