Privacy Policy

Children's privacy (COPPA)

Post Elf is built for families, and we take children's privacy seriously.

• Only parents create accounts. We never collect information directly from kids.
• Kids access their letters using a simple elf name + PIN code. No personal info needed.
• The kid portal only shows letters that the parent has approved. Kids can't change anything, buy anything, or see any parent data.

What information we collect

From parents:

• Your name and email (to create your account)
• Your password (encrypted, so we can't see it)
• Mailing address (only if you want printed letters)
• Payment info (handled by Stripe, so we never see your card number)

About your children (provided by you, the parent):

• First name, age/birthday, interests, personality
• Fears, friends, favorite characters, school grade
• Dietary notes (so the elf doesn't mention certain foods positively)
• Challenges they're working through (addressed gently through stories)
• Photo (optional, only visible to you)

About caretakers and pets:

• Names, roles, descriptions, photos
• Monthly context updates so the elf can reference them in stories

Monthly updates (provided by you each month):

• What's going well, what's been tough, upcoming events
• Anything the elf should or shouldn't mention

All of this is used for one purpose: writing your child's personalized letter. That's it.

How we use your information

• Writing letters: Your child's profile and monthly updates go to our AI (Claude by Anthropic) to generate each letter.
• Audio letters: Letter text goes to OpenAI to create the audio version (paid plans).
• Printing letters: Your address and letter go to our print partner to mail it to you (paid plans).
• Emailing you: We send you letter approvals, reminders, and account updates through Resend.
• Processing payments: Stripe handles all billing. We never touch your card number.

Who sees your data

Only the services we need to make Post Elf work:

• Anthropic generates the letter content
• OpenAI creates audio versions
• Stripe processes payments
• Resend sends you emails
• Vercel hosts the website
• Supabase stores the database

That's the complete list. No one else. No data brokers. No advertisers. No "trusted partners" getting your kids' info.

About partner offers

We may occasionally show you offers from companies we think families might like, such as children's books, educational toys, or family activities.

Here's how that works:

• We choose the offers. Partners don't choose you.
• Your data is never shared with partners. They don't get your name, email, or anything about your kids.
• We show you the offer. You decide if you want to act on it. That's it.
• You can opt out of these anytime.

What you can do with your data

You're in full control. Always.

• See it: Everything we have is visible in your parent portal.
• Change it: Edit any profile, update, or setting anytime.
• Delete it: Delete any child's data permanently, including letters, updates, everything. Or delete your entire account. It's immediate and irreversible.
• Control access: Set and change your kids' access codes. Revoke portal access anytime.
• Review letters: Every letter can be reviewed and approved by you before your child sees it.

How we keep it safe

• All data travels encrypted (HTTPS)
• Passwords are hashed, so we literally can't read them
• The database is encrypted and access-restricted
• Our admin panel cannot see children's names, photos, letters, or personal details
• We don't use tracking cookies or advertising cookies

How long we keep data

As long as your account is active, your data stays. If you cancel, we keep it for 90 days in case you come back. After that, it's gone. You can delete everything immediately anytime with no waiting period.

Changes to this policy

If we change something important, we'll email you. Using Post Elf after a change means you're okay with the update.

Questions?

Email us at privacy@postelf.com. We'll respond like a real person, because we are.