← Back to Postboi

Privacy policy

Last updated: 10 July 2026

Postboi ("we") is a messaging service operated from the United Kingdom. This policy explains what we collect when you use postboi.app, the dashboard, the sending API and hosted form endpoints, and what we do with it.

What we collect

  • Account details. Your name and email address, used to sign you in (we send magic links — there are no passwords) and to contact you about your account.
  • Session data. IP address and browser user agent for active sign-in sessions, used for security.
  • Send log. For every email sent through the service we log the sender address, recipient addresses, subject line, delivery status (sent, bounced, complained) and the message body. The body is stored to power the message preview in your dashboard; it stays inside your account's log, is never used for anything else, and is deleted with your account.
  • Form submissions. Messages posted to your hosted form endpoints are processed the same way as sent email: rendered, delivered to the team member you chose, and stored in your send log. Submissions are spam-checked (and rate-limited) before anything is stored or sent.
  • API keys. Stored as one-way hashes; we cannot read them back.
  • Usage and billing. Monthly send counts, your plan, and Stripe customer and subscription identifiers. Card details go directly to Stripe and never touch our servers.
  • Custom domains. Domain names and DNS verification records you add for sending.

Your recipients' data

When you send email through Postboi, you are responsible for having a lawful basis to contact your recipients. We process their email addresses and your subject lines on your behalf, solely to deliver mail and to track delivery status and abuse (bounces and complaints).

Who we share it with

We use a small number of processors, only for what the service needs to function:

  • Amazon Web Services (SES) — email delivery.
  • Stripe — payments and subscription billing.
  • Cloudflare — hosting and data storage.
  • Google Analytics — website analytics, only if you accept cookies. Until you do, analytics runs in cookieless consent mode and sets nothing.

We do not sell your data or share it with anyone else.

Cookies

We use a session cookie to keep you signed in (strictly necessary) and, only with your consent, Google Analytics cookies to understand how the site is used. You can decline these in the cookie banner and the site works identically.

Retention

We keep your data while your account is active. Send metadata is retained to power your message log and to prevent abuse. If you delete your account, we remove your personal data, keeping only what we must for legal, billing or anti-abuse reasons.

Your rights

Under UK GDPR you can ask for a copy of your data, ask us to correct or delete it, or object to how we use it. Email support@postboi.app and we'll sort it out. You can also complain to the ICO (ico.org.uk).

Changes

If this policy changes materially we'll note it here and update the date above. Questions? support@postboi.app.