postcrossing
- The documents do not say whether your data trains AI.
- Your data is used for personalized ads, including by third-party ad companies.
- Data is shared only with the providers who run the service.
- The policy describes staff access for safety and legal checks.
They need your real postal address to swap postcards, show ads via Google, and can close accounts without warning.
Agent Trust Hub uses AI and may make mistakes. Review reports and confirm their contents before relying on them.
Collected
Account details, real postal address, profile extras, posts, IP, and browser logs.
Read the exact line
Privacy policy
“To create an account on Postcrossing, we require some information from you: a username and password, email address, name and postal address, and your (approximate) location in order to place you on a world map.”
Training
They use it to send postcards, run the site, email you, show ads, and keep the site safe.
Read the exact line
Privacy policy
“Other information you provide allows us to authenticate you, create your profile, show you maps and statistics about your activities and personalize certain aspects of the Website such as the types of ads you see or your preferred units of measurement.”
Sharing
Other members get your address at random; Google and other vendors get some data for ads and analytics.
Read the exact line
Privacy policy
“Thus, it is central to our service to share your postal address so that you can receive postcards from other members.”
Kept
They say they delete you right away when you leave, unless postcards are still traveling (up to a year).
Read the exact line
Privacy policy
“When your account is terminated (either by you or by us), if you don't have any postcards traveling from your account, all your personal information is immediately deleted.”
Controls
You can edit info, change email and ad consent, or delete your account in settings.
Read the exact line
Privacy policy
“Through your account settings, you can update your information, withdraw any consent that you had previously given (for instance, about which emails you’d like to receive from us or which types of ads you’re shown) or terminate your account to erase your personal information.”
Fine print
They can close you without warning; you them; Portuguese courts; ads help pay for a free service.
Read the exact line
Terms of service
“Postcrossing is also entitled to exclude offending users from continued use of the website and the services without prior warning, and to terminate an account if it deems it necessary at its sole discretion.”
Expand “Read the exact line” to see the source alongside the explanation.
What you can turn off
The controls and opt-outs their own documents describe, and where they say to find them.
Terminate your account to erase personal data
Account settings on the Website (see “How you can access and control your information”)
Withdraw consent for personalized ads and emails
Account settings
Ask them to delete leftover data sooner
Contact form or Postcrossing Lda, Rua Dom João IV 399, 2, sala 12, 4000-302 Porto, PORTUGAL
Request extra data access or portability
Contact them so they can verify your identity
If a switch is not where they say, the deletion request above still applies.
Line by line
The lines that matter most, worst first.
Strangers on the site get your real home address so they can mail you a postcard.
Read the exact line
Privacy policy
“Thus, it is central to our service to share your postal address so that you can receive postcards from other members.”
For example, after you send a card, a random member in another country can see your street address on the envelope they mail.
They can shut your account anytime without telling you first.
Read the exact line
Terms of service
“Postcrossing is also entitled to exclude offending users from continued use of the website and the services without prior warning, and to terminate an account if it deems it necessary at its sole discretion.”
For example, they could lock you out overnight and you would not get a warning email first.
If someone sues them because of what you posted or how you used the site, you may have to pay their legal bills.
Read the exact line
Terms of service
“You hereby agree to and Postcrossing, its affiliated and associated companies, and their respective owners, directors, officers, employees, agents, representatives, independent and dependent contractors, licensees, successors and assigns from and against all claims, losses, expenses, damages and costs”
For example, if a photo you uploaded sparks a lawsuit, they can ask you to cover their lawyer fees.
Google and other ad networks run ads on the site and may use data about your visit.
Read the exact line
Privacy policy
“To be able to support the service we provide to you, we display advertising banners on our Website using third-party advertising networks and platforms such as Google Ad Manager and Google AdSense”
For example, a banner on the homepage can be chosen using Google’s ad tools based on cookies.
The permission you give them to show your uploaded content can last even after you leave.
Read the exact line
Terms of service
“The aforementioned license does not end at the time when the contract with the user is terminated.”
For example, a postcard photo you posted could still appear on their social channels after you delete your account.
Closing the account does not always wipe everything at once if mail is still in transit.
Read the exact line
Privacy policy
“If you still have postcards traveling to other members, we may keep some of your account information (name, username, email, address, profile text and IP address) until these postcards arrive or are deleted by our system.”
For example, they might keep your address for months so someone can still register a card you already sent.
Kids under 13 need a parent’s okay; there is no extra age-check described.
Read the exact line
Terms of service
“The Website Services are available only to individuals who are either (i) at least 13 years old, or (ii) under 13 years old and authorized to access the Website by a parent or legal guardian.”
For example, a 12-year-old could sign up if they tick that a parent allowed it, with no ID check mentioned.
Personalized ads need your consent, and you can turn that off.
Read the exact line
Privacy policy
“Where required, if the ads we show you collect, share and/or use your information for ad personalization, we will request your consent prior to showing them to you, and you can withdraw your consent at any time.”
For example, you can refuse personalized Google ads in account settings and still use the site.
If nothing is in the mail, they say they wipe your personal data as soon as the account ends.
Read the exact line
Privacy policy
“When your account is terminated (either by you or by us), if you don't have any postcards traveling from your account, all your personal information is immediately deleted.”
For example, after you hit terminate with no cards in transit, your address should not stay in their live database.
They host on Amazon in the EU and describe encryption, firewalls, and backups.
Read the exact line
Privacy policy
“Amazon AWS follows industry best practices, adheres to globally known compliance programs in both security and data privacy, and maintains several recognized certifications assessed by independent auditors.”
For example, your account data sits in EU Amazon data centers with encryption and access controls.
Words to know
Legal words from the lines above, in plain English.
- personal data
- Any information that is about you or can be linked to you, from your name to your phone's ID. For example, your email, your IP address and the list of apps on your phone are all personal data.
- consent
- Your clear agreement to something, given by an action like ticking a box or tapping Accept. For example, a pop-up asking if the app may use your location is asking for consent.
- indemnify
- You promise to pay the company's legal costs and losses if your use of the service gets it sued. For example, if you post a song you do not own and the label sues the app, you owe the app's lawyer bills.
- service providers
- Outside companies that handle your data on the app's instructions, such as a cloud host or an email sender. For example, the company that stores the app's files in the cloud sees your data but only does what the app tells it.
- third parties
- Any company or person other than you and the app, such as advertisers, partners or analytics firms. For example, an analytics company that receives a record of every screen you tap is a third party.
How we got here · grade B · score 55/100 · 14 of 15 policy answers backed by a verified quote · 1 not stated
What does the app collect beyond what it needs to work?
They collect account details, your real postal address, optional profile fields, posts, IP, browser logs, and analytics cookies—more than login, but the address is needed to mail cards.
Does it record your voice, face or body, and what happens to that?
The documents do not describe recording voice, face, or body data.
Are your chats and uploads used to train AI models, and is that off by default?
Not stated in the documents.
Can employees or contractors read your conversations, and when?
They say they may access or disclose account info and content for law, enforcing the terms, safety, or support—not routine sampling of private chats.
Are you profiled or tracked for advertising?
They run Google Ad Manager and AdSense banners; personalized ads need consent you can withdraw.
Do they sell or share your data, and can you opt out?
They share with members for mailing, and with vendors like Google Analytics and ads, saying they only send what those vendors need. They do not say they sell data to brokers.
What rights do they take over what you type and what the AI makes?
You keep rights to uploads; you give them a free, non-exclusive, revocable license to display and share it, including off-site, and that license does not end when you leave.
How long do they keep your data after you delete it, and can you delete it in the app?
You can terminate in account settings; they say personal data is deleted immediately unless cards are still traveling, which can last up to a year.
Does it build a lasting memory or profile of you, and can you see, edit or turn it off?
There is a public profile you can edit, but no AI memory or hidden lasting profile of chats is described.
Do they commit to basic security, and have they leaked data?
They describe passwords, EU Amazon hosting, firewalls, encryption, access controls, and encrypted backups. No breach history is mentioned.
Is there a real age gate, and are teens protected?
You must be 13, or under 13 with a parent’s authorization. No extra age-check is described.
Will they tell you when the rules change, and is the policy specific?
The privacy policy is dated May 25, 2018. They post changes and give extra notice if significant; terms allow 14 days to object after written notice.
Can they close your account without warning, and can you get your data out first?
They can exclude users and terminate accounts without prior warning at their sole discretion.
If something goes wrong, who pays?
The service is as-is with limited liability, and you must indemnify them for claims from your content or use.
Do subscriptions renew on their own, and can you get a refund?
The terms say the service is free. Payments are only mentioned as records they must keep if you pay them.
The privacy policy is 2,225 words at a college level (Flesch reading ease 46.9); the terms are 2,557 words at a college level.
