CartolinaLenta. For any request about your data:

Email us about privacy

• Email of whoever uses the app: to sign you in. You can do so three ways, all handled by my authentication provider (Supabase, see point 3): a one-time link sent by email, valid 15 minutes (magic link), a password you choose, or "Sign in with Google", which shares with me only your Google-verified email, not other data from your Google account. Legal basis: performance of the requested service.
• Nickname, first name, last name, month of birth, city of residence: optional, shown only to you in the Account section. Legal basis: consent implied by filling them in, revocable by deleting them at any time.
• Stamps earned: if you request early access from the Account section, I record that you did and how many special edition stamps you have left to use. Legal basis: performance of the requested service.
• Notification preferences: three toggles in the Account section. "Transit notifications" isn't wired to any real sending yet. "Incoming postcard alerts" is active instead: on by default, if you turn it off you stop getting the two emails tied to an incoming postcard (when it's sent and when it arrives) — the postcard is still sent and stays visible in your Ricevute section, I just don't email you about it. "Updates and news" is off by default: only if you turn it on yourself do you get a monthly newsletter with a recap of the postcards you've sent (how many, how many km, how many cities) and a different featured city each month. Legal basis for both active toggles: consent, revocable at any time by turning the toggle off or clicking "Unsubscribe"/the link at the bottom of one of those emails.
• A recipient's preference to stop receiving these alerts: if someone you sent a postcard to clicks the "stop these emails" link at the bottom of the alert (and confirms on the page it leads to — the click alone isn't enough), I record their email address and this choice, even if they don't have a CartolinaLenta account yet — this only serves to honor their request and stop emailing them this kind of notice going forward. If they later sign up for CartolinaLenta with that same email, this preference carries over into their account's own "Incoming postcard alerts" toggle, which from then on replaces the choice made through the link. Legal basis: fulfilment of their explicit request.
• Content of the postcards you send: the written message, the sender's name, the recipient's name, city and email. Needed to create and deliver the postcard you asked to send. Legal basis: performance of the service. The recipient's name, email and city also stay saved in your personal address book (Account section), from which you can remove them at any time without deleting postcards already sent.
  The recipient never fills in anything themselves — you provide their data. Both the email that tells them a postcard is coming and the page where they read it carry a link to this same notice, so they too know what's kept and can write to me (see point 1) to ask to be removed from your address book.
• Photo uploaded for a custom postcard: if you don't find a postcard you like among the ones on offer, you can upload your own (JPG, PNG or WebP, up to 8 MB). It's stored on Vercel Blob (see point 3) and stays tied only to the postcard you uploaded it for: I delete it if you cancel the send, and if you delete your account I delete the photos of postcards that can still be cancelled. Photos of postcards already on their way stay, because they are the postcard the recipient received. Legal basis: performance of the requested service.
• Geographic location (GPS): used on your own device to check whether you're close enough to a supported city to write its postcards. While you browse, it does not leave your browser. When you send a postcard, and only then, the coordinates reach my server, which compares them with the city you claim to be in, as a defence against anyone pretending to be elsewhere, and then discards them: I never store them. If the comparison fails, what stays on record is the name of the city and the distance, never the coordinates. You can turn the location off at any time from the Account section or from your browser.
• When you're travelling and where to: from the "Off the map" screen or from Home, you can tell us your next destination and travel month. The destination name and, if you leave it, your email are sent by email to whoever runs the Service. Legal basis: legitimate interest in gathering input useful for deciding which cities to add.
• Email left on the desktop page to get the app link: if you visit the site from a computer, you can leave your email to receive the link to www.cartolinalenta.it by email instead of scanning the QR code. I use that email only to send you that one message, once: I don't save it anywhere. Legal basis: performance of the explicit request you just made. If you also tick "sign me up for updates", I instead save your email in a separate list to contact you in the future with news about the service (there's no automatic sending yet: no email reaches you until I actually turn one on). Legal basis: consent, which you can withdraw at any time by writing to the address given in point 1. A reference to this signup (never your email) may also appear in the Google Sheets spreadsheet mentioned in point 3, with the same logic already described for city requests.
• Cities you ask to add: from the Atlas's "don't see your city?" section, the city name and, if you leave it, your email are sent to whoever runs the Service and kept to maintain a list of requests. Legal basis: legitimate interest in gathering input useful for deciding which cities to add. A reference to this request (never your email) is also copied into a Google Sheets spreadsheet I use to skim through them quickly: see point 3.
• Travel reminder emails: only if you leave your email and explicitly tick the consent checkbox, I save the destination, travel month/year and your email to send you up to two reminder emails during that month, at least 14 days apart. Legal basis: consent, which you can withdraw at any time by clicking "Unsubscribe" in one of those emails. I delete this data automatically once the travel month has passed, regardless of how many reminders were sent.
• Messages written in the Contact form: the text you write, together with your already-verified sign-in email, sent to whoever runs the Service so they can reply. Legal basis: fulfilment of an explicit request from you.
• Technical and, if you accept, analytics cookies: a technical cookie to keep you signed in, plus — only with your consent — the local storage PostHog uses for analytics, and two cookies of my own tied to opening a received postcard: one just records that this browser has already opened one (to count how many people receive a postcard for the very first time), the other remembers which postcard, to link it to a registration within the following 30 days (see point 3). Details in the Cookie Policy.
• Server technical logs: IP address and request information, collected automatically by the hosting infrastructure (Vercel) for security and to run the service, not cross-referenced with a user's identity for profiling purposes.

I don't use your data for advertising, don't sell it, don't share it with anyone not listed on this page.

• Resend (Resend, Inc., United States): sends transactional emails (sign-in, postcard announcement and delivery) and tells me if a recipient's address turns out not to exist (a "bounced" email): when that happens I only use the notice to let you, the sender, know so you can fix it. Sending happens from the verified domain cartolinalenta.it, configured on Resend's European servers (Ireland). Being a US company, a residual share of technical data may still transit under the same standard contractual guarantees set out by European regulation.
• Supabase (Supabase Inc., United States): handles sign-in (email, password, "Sign in with Google") and hosts the app's database; the servers used are in the European Union (Ireland). Being a US company, a residual share of technical data may still transit under the same standard contractual guarantees set out by European regulation.
• Google (Google Ireland Limited): if you choose "Sign in with Google", it handles that step and confirms your verified email to Supabase. It doesn't receive or see any other data I process.
• Vercel (Vercel Inc., United States): hosts the application; the chosen execution region is in the European Union (Paris), but being a US company a residual share of technical data (e.g. network logs) may transit under the same standard contractual guarantees.
• Vercel Blob (Vercel Inc., United States): hosts the photos you upload yourself for a custom postcard (the curated photos offered by the app instead remain static files of the application, they don't pass through here); files are stored on servers in the European Union (Frankfurt). Being a US company, a residual share of technical data may still transit under the same standard contractual guarantees set out by European regulation.
• Mapbox (Mapbox, Inc., United States): provides the interactive maps (Atlas and shipment routes); your browser downloads the map tiles directly from their servers, which therefore receive your IP address. The transfer of data to the United States relies on the standard contractual clauses set out by European regulation.
• Google Sheets (Google Ireland Limited): when you ask for a city that isn't supported yet, I copy the date, city name and an internal reference code into a spreadsheet I use to skim through requests — never your email, which stays only in the database (Supabase, servers in the European Union, see above).
• PostHog (PostHog Inc., servers in the European Union): only if you accept analytics from the cookie banner, it receives the steps you take in the app (see the Cookie Policy for the list) and, if you have an account and are signed in, links them to your account. Legal basis: consent, revocable at any time from that same page. It also receives, from the server rather than your browser, notice that the arrival email for a postcard you sent has been scheduled for delivery (for a Time Capsule, actually sent, since it goes out right on the expected date) — not that the recipient has opened or read it yet. This event is linked only to you as the sender (if you had accepted analytics at the time you sent it), never to the recipient, who may never have used the app.

• Account: for as long as it stays active.
• Postcards you sent: if one is still inside the brief undo window (a few minutes after sending) when you delete your account, it disappears entirely, as if it had never been sent. Once it's genuinely on its way, though, deleting your account doesn't delete it: it only detaches it from your profile. Whoever received it keeps seeing it normally in their own Ricevute section, simply without knowing which account it was once tied to.
• Postcards you received: these stay visible in the Sent section of whoever sent them to you, regardless of what you do. If you delete your own account, I keep a minimal reference (those postcards' id and your email, nothing else) for the sole purpose of stopping them from resurfacing in your own Ricevute if you sign up again later with the same email: it's how I honor the choice of having deleted your account, not extra data collected about you.
• Travel reminders: until the end of the indicated travel month, then deleted automatically — sooner, if you unsubscribe.
• Time capsules not yet opened: if you delete your account, the deletion page explicitly asks what to do with them. If you choose to delete them, they disappear along with everything else and whoever is waiting for them will never receive them. If you choose to leave them in transit, they stay scheduled and are still delivered on the expected date, even months or years later, with no link left to the deleted account.
• A recipient's preference to stop receiving email alerts: kept until it's changed, i.e. until that person signs up for CartolinaLenta and turns the option back on from the Account section (see point 2).
• Photos uploaded for a custom postcard: deleted immediately if you cancel the send, and if you delete your account I delete those of postcards that have not left yet. The others stay for as long as the postcard itself does (once delivered, deleting them would break the postcard already seen by whoever received it).
• Sign-in link (magic link): 15 minutes, then it expires on its own.
• Sign-in cookie: 400 days, or until logout.

You can ask for your account and related data to be deleted at any time, by writing to the address given in point 1.

As a data subject you can ask at any time, free of charge: access to your data, rectification, erasure, restriction of processing, portability and objection, under articles 15-22 of Regulation (EU) 2016/679 (GDPR). To exercise them, write to the address given in point 1.

If you believe the processing violates the regulation, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it).

CartolinaLenta Eventi is the separate service guests use to write a postcard at a wedding by scanning a QR code. No account is needed and none is created: whoever writes does not sign up, leaves no email address, and is not recognised on a later visit.

For a postcard written at an event I keep:

• the message and the name or signature the writer chooses to add, in order to deliver them to the couple: they are the postcard itself;
• the photograph, only if the writer chooses to take one instead of the couple's. It goes on the front of that postcard and the couple sees it. It is stored on Vercel Blob (see point 3) at an unguessable but technically public address: anyone holding that link can see the photograph without a password;
• a random identifier generated by the device, used only to avoid delivering the same postcard twice when the connection comes and goes.

For how long. Message, signature and any photograph stay for as long as the event does. If a postcard is removed from the management panel, the photograph is deleted from storage at the same moment.

Whoever writes cannot delete it themselves, having no account to be recognised by: to ask for a postcard or a photograph to be removed, write to the address in point 1, naming the wedding and the signature used.

Do not photograph other people without their agreement: that photograph is being sent to someone else.

The service isn't intended for people under 16: a choice made by this Service, more cautious than the minimum threshold set by Italian law for consent to digital services (14). If you're a parent and believe a minor provided data without your consent, write to the address given in point 1 to request its deletion.

If what I collect or how I use it changes, I update this page and the date at the top. Substantial changes will also be flagged in the app.