How we handle your stuff.

Last updated: May 25, 2026

Mailroom exists to help you send physical postcards to people you love. To do that, we need a few pieces of information about you and about the people you're writing to. This page explains exactly what we collect, why, and what we do with it. No tricks, no fine print.

What we collect from you

• Your phone number. When you text us a photo, we save your phone number to identify your conversation, mail your card with your name on the return address, and text you back. You can ask us to delete it at any time by replying STOP.
• Your account info. If you also use the iOS app, we collect your name, email address, and (optionally) your phone number. Used to log you in, send you receipts, and contact you about your account.
• Your photos and notes. The images and text you send on postcards (via SMS/MMS or the iOS app). Stored only as long as we need to print and mail the card. We don't train AI on your photos, we don't scan them for content, and we don't share them with anyone except our printing partner.
• Your SMS conversation. The back-and-forth texts when composing a card (recipient name, address, message). Retained for our records and for customer support. Deletable on request.
• Payment information. Processed by our payment provider (Stripe). We never see or store your card number directly.
• Usage data. Basic analytics about how the app + SMS flow are used so we can fix bugs and improve the experience. Aggregated and anonymized.

What we collect about your friends

When you send a postcard, we need a mailing address. You enter the recipient's name and address either through the iOS app or by texting it to us. We use this information only to print and deliver the postcard.

We don't sell recipient addresses. We don't share them with anyone except our printing vendor (Lob) for fulfillment. We delete them on request from either you or the recipient.

SMS messaging specifically

Mailroom can be used entirely via text message. you text us a photo to start, we walk you through composing the postcard via SMS, and we text you a confirmation when the card is mailed. A few things to know about how that works:

• Opt-in: Texting a photo or message to our toll-free number constitutes opt-in to receive transactional SMS from Mailroom.
• Opt-out: Reply STOP, CANCEL, or UNSUBSCRIBE at any time to opt out. We'll send one confirmation message, then stop. We delete your phone number from active messaging within 24 hours.
• Help: Reply HELP to get support contact info via text.
• Frequency: You'll get messages only as part of conversations you started (typically 5-10 messages per postcard order). We don't send marketing SMS.
• Costs: Message and data rates may apply, charged by your wireless carrier. Mailroom doesn't bill you for SMS itself; you pay for postcards.
• Carriers: Outbound SMS from Mailroom is delivered through Twilio (our messaging service provider), and ultimately by T-Mobile, AT&T, Verizon, and other US carriers.

What we never do

• We don't sell your data. Ever.
• We don't share your photos, notes, or messages with third parties (except the printing partner who actually prints the card, who is contractually bound to delete after fulfillment).
• We don't send marketing SMS. The only texts we send are direct replies in conversations you started.
• We don't track you across other apps or websites.
• We don't read your camera roll. You pick (or text us) the photos you want to send.

Sub-processors

To run Mailroom, we use a handful of vendors who handle specific slices of your data. Each is contractually bound to handle it only on our behalf:

• Lob. our printing and USPS fulfillment partner. Receives the photo, message, sender return address, and recipient mailing address needed to physically produce and mail your card. Lob is HIPAA + SOC 2 compliant.
• Twilio. our SMS and MMS provider. Routes your inbound texts to us and our outbound replies back to you. Sees your phone number and message content for the brief moment it's in transit.
• OpenAI. when you text us a messy address ("123 main st naples FL 34101"), we send that text fragment to OpenAI's GPT-4o-mini model to parse it into a structured mailing address. We send only the fragment, not your phone number, name, or any other identifying info. OpenAI's API terms prohibit using API inputs for model training (per their March 2023 policy). We don't send your photos to OpenAI.
• Stripe. processes payments. Sees your card details, never us.
• Supabase. our database and backend infrastructure provider. Stores all account, postcard, and conversation data. SOC 2 Type 2 compliant.
• Apple App Store. handles iOS app distribution and (if applicable) in-app purchases.
• Google Places. autocomplete suggestions when entering recipient addresses in the web compose flow. Address fragments sent during typing; not tied to your identity.

Your rights

You can request a copy of your data, ask us to delete your account and everything associated with it, or correct anything we have wrong. Email hello@mailroomclub.io and we'll handle it within 30 days. If you're a California, EU, or UK resident, you have additional rights under CCPA, GDPR, and UK GDPR. same email reaches us either way.

Cookies and tracking

The Mailroom website uses minimal cookies, primarily for the session and for understanding aggregate site traffic. We don't use advertising trackers. The Mailroom app uses standard Apple analytics frameworks (which respect your iOS privacy settings).

Children

Mailroom is not directed at children under 13. We don't knowingly collect data from anyone under 13. If you believe we have, email us and we'll delete it.

Changes to this policy

If we make material changes to how we handle data, we'll email you (or text you, if SMS is your primary channel) before the changes take effect. We won't surprise you.

Contact

Questions, concerns, or requests? Write to hello@mailroomclub.io. We read everything.