Privacy Policy

Effective 2026-05-05. Last updated 2026-05-05.

What stays on your device

Everything Postcard creates from your recordings is stored locally on the device that captured it. That includes:

• Voice recordings — saved to Postcard's local storage on your iPhone or Apple Watch.
• Transcripts — generated on-device by Apple's Speech framework. Postcard requires Apple's on-device recognition mode and never sends audio to Apple's cloud Speech service.
• Summaries — generated on-device by Apple's FoundationModels framework (Apple Intelligence).
• Search and Ask — powered by Apple's NLContextualEmbedding model, which runs on-device. Apple may download the model assets to your device the first time the feature is used.
• Photos and titles you attach to a moment.

Permissions Postcard may request

Postcard asks for permissions only at the moment you opt into a feature that needs them. You can revoke any of them in iOS Settings at any time.

• Microphone — to record your voice.
• Speech Recognition — required by Apple's API for on-device transcription.
• Location (While Using) — when granted, Postcard reads your location at the moment of capture so a moment can be tagged with a place name. The coordinate is sent to Apple's reverse-geocoding service to translate it into a human-readable name (e.g. "Riverside Park"); the name is then stored on your device. Postcard does not share location with anyone else.
• Location (Always) — only requested if you turn on the optional Place prompts feature (a Postcard Pro feature). Postcard then asks the operating system to wake the app when you arrive at a place you have explicitly saved on a map (e.g. "Home", "Office"). iOS only invokes the app when you cross one of those boundaries; Postcard does not run continuously and does not record a track of your movements. The list of saved places is stored on your device.
• Calendar — when granted, Postcard reads your active or upcoming calendar events to tag a moment with a meeting name and to power the optional post-meeting capture prompt. All reads are local.
• Photos — when granted, lets you attach a photo to a moment (a Postcard Pro feature).
• HealthKit (Apple Watch) — when granted, the Watch reads workout end times to offer the optional post-workout capture prompt (a Postcard Pro feature). Reads are on-device only.
• Notifications — when granted, Postcard schedules local notifications. No remote push servers are used.

What Postcard does not do

• We do not operate any servers or backends. Postcard ships without one.
• We do not collect analytics or telemetry of any kind.
• We do not include third-party SDKs for advertising, tracking, attribution, crash reporting, or social media.
• We do not sell, share, or rent any data, because we have no data to sell.

Apple Watch sync

Audio recorded on your Apple Watch is transferred to your paired iPhone using Apple's WatchConnectivity framework, which moves files locally between the two devices over Bluetooth or peer-to-peer Wi-Fi. The transfer never goes through any server.

Sharing postcards with friends

Postcard offers several share variants from a moment, and what travels depends on which one you pick:

• Send to a friend and Postcard both share a rendered postcard image only — no audio, no transcript, no embedded place coordinates. The recipient sees a picture.
• Postcard file (with audio) exports a self-contained .postcard file attached to a regular iMessage (or AirDrop, Mail, etc.). Before sending, Postcard shows you exactly what will be included; you can withhold the audio, the photo, the place name, or the transcript individually. Whatever toggles you turn off are simply absent from the file — they are never sent in any other way.
• Audio recording, Text summary, and Full transcript each share that single component on its own.

Apple delivers all of these between your device and the recipient's. Postcard runs no servers in this path either.

The only sender-identifying information in any postcard is the display name you typed in Settings. Postcard does not include your account ID, device ID, IP address, contact handle, location coordinates, or any other identifier.

The iMessage you send also carries a link to a small page on this site so recipients who don't have Postcard installed can find it on the App Store. The page is static — it knows nothing about you, the recipient, or the postcard you sent.

When you receive a postcard from a friend, the contents are saved into your Postcard library only after you tap "Save to timeline." Received postcards are marked visually so you can tell them apart from your own captures, and they are excluded from Ask retrieval and the streak counter by default. You can opt them in to Ask in Settings.

Purchases

Postcard Pro is sold as either a monthly auto-renewable subscription or a one-time non-consumable in-app purchase, both via Apple's StoreKit. Apple processes the transaction; we receive only the entitlement status and never see your payment details.

Children's privacy

Postcard is not directed at children under 13 and does not knowingly collect personal information from them. Because Postcard does not collect personal information from anyone, this is largely moot.

Changes to this policy

If Postcard ever changes how it handles data — for example, if a future version adds optional iCloud sync — we will update this page, bump the effective date above, and surface the change inside the app before it takes effect.

Contact

Questions or concerns? Email gwolny@me.com.