Privacy Policy

Last updated: October 14, 2026

1. Overview

This Privacy Policy explains how Posthouse (also operating as Shiny Object) collects, uses, and protects personal data when you use our service.

We collect only what's needed to run mail clubs correctly.

In short: We only collect what we need. No more.

2. Data Controllers

Posthouse is the data controller for platform data — account information, login credentials, and how you use Posthouse.

Artists are independent data controllers for subscriber data they receive through Posthouse. When you subscribe to a mail club, the artist receives your name, email, and mailing address, plus any optional details the club asks for (such as phone number or birth month). The artist is responsible for how they use and store this data.

This means both Posthouse and the artist have responsibilities for your data, but we operate independently. If you have questions about how an artist uses your data, contact them directly.

In short: Posthouse manages platform data. Artists manage subscriber data they receive.

3. Information We Collect

From Artists:

  • Name and email address
  • Club information (name, description, pricing)
  • Stripe account connection details
  • Photos and other content you upload

From Subscribers:

  • Name and email address
  • Mailing address
  • Optional details a club asks for at checkout, such as phone number or birth month
  • Subscription status and history
  • Lost-mail reports you submit

Gifts and Waitlists:

  • Gift buyers: email address and any gift message
  • Gift recipients: name, email, and mailing address, entered by the recipient when they claim the gift
  • Waitlists: the email address you join with

Collected Automatically:

  • Usage data, such as pages viewed and actions taken, collected through our analytics provider
  • How you arrived at a club page (for example, the referring site or campaign link)
  • Your approximate country, based on your IP address, so we can show the right pricing
  • Basic device and browser information

Payment Information:

Payments are processed by Stripe. Stripe acts as an independent processor and is governed by its own privacy policy. Posthouse does not store or access full payment credentials.

In short: We collect names, emails, addresses, and basic usage data. Stripe handles payment info.

4. Data Shared with Artists

When you subscribe to a mail club, the following data is shared with the artist:

  • Your name
  • Your email address
  • Your mailing address
  • Any optional details the club asked for (such as phone number or birth month)
  • Your subscription status (active, canceled, payment failed, etc.)

For gifts, the artist sees the gift's details and, once the gift is claimed, the recipient's name, email, and mailing address.

Mailing addresses are shared with the artist running the club for the sole purpose of sending physical mail.

Artists need this information to send you mail and manage their club. By subscribing, you are directing us to share this information with the artist.

Artists are responsible for how they use your data. Posthouse cannot control what artists do with subscriber information outside our platform. If you have concerns, contact the artist directly.

In short: When you subscribe, the artist gets your name, email, and mailing address — for the sole purpose of sending mail.

5. How We Use Information

We use personal data to:

  • Manage subscriptions and batch assignments
  • Generate mailing lists and address views for artists
  • Send transactional emails (confirmations, status updates)
  • Process payments through Stripe
  • Understand how Posthouse is used so we can improve it
  • Maintain platform security and prevent fraud, abuse, and harassment

We do not use mailing addresses for marketing unrelated to your subscription.

In short: We use your data to run the service. Not for unrelated marketing.

6. Data Sharing

We share personal data only as necessary:

  • With Artists — subscriber data as described above
  • With Stripe — payment processing
  • With service providers — only as needed to operate the service: Supabase (database), Vercel (hosting), Resend (email delivery), Mixpanel (product analytics), and Upstash (abuse prevention)
  • When required by law — legal obligations, court orders, etc.

We do not sell or rent personal data.

In short: We share with artists, Stripe, and essential service providers. We never sell your data.

7. Cookies & Analytics

Posthouse uses essential cookies to maintain your session and keep you logged in.

We also use Mixpanel, a product analytics service, to understand how people use Posthouse (for example, which pages are visited and where visitors come from). Mixpanel stores an identifier in your browser's local storage. You can clear or block it in your browser settings.

We do not use advertising cookies, and we do not track you across other websites for advertising.

In short: Essential cookies, plus basic analytics to improve Posthouse. No advertising tracking.

8. Data Retention

We retain data as follows:

  • Active accounts: Data is retained while the account is active
  • Financial records: 7 years after the transaction (for legal/accounting requirements)
  • Inactive accounts: May be deleted 1 year after the account becomes inactive

You may request deletion of your data at any time by emailing posthouse@shinyobject.co, subject to legal retention requirements.

In short: We keep data while you're active. Financial records for 7 years. Inactive accounts may be deleted after 1 year.

9. Security

We use reasonable technical and organizational measures to protect personal data, including encryption in transit and at rest. No system is 100% secure, but we take care to minimize risk.

In short: We take reasonable steps to protect your data.

10. Your Rights

You have the right to:

  • Access — Request a copy of your personal data
  • Rectification — Correct inaccurate or incomplete data
  • Deletion — Request deletion of your data
  • Portability — Receive your data in a portable format
  • Object — Object to certain types of processing
  • Withdraw consent — Where processing is based on consent

To exercise these rights, email us at posthouse@shinyobject.co. We will respond within 30 days.

In short: You can access, correct, or delete your data. Just email us.

11. International Transfers

Posthouse is based in the United States. If you are located outside the US, your data may be transferred to and processed in the US. By using Posthouse, you consent to this transfer.

In short: Data may be processed in the US.

12. Children's Privacy

Posthouse is not intended for children under 13. We do not knowingly collect data from children. If you believe a child has provided us data, please contact us.

In short: Not for kids under 13.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of significant changes. Continued use of Posthouse means you accept the updated policy.

In short: Policy may change. We'll let you know about big updates.

14. Contact

Privacy questions? Email us at posthouse@shinyobject.co