Privacy Policy

Last updated: July 2026 · Reflects account-deletion and data-retention changes.

Welcome to PostBox. We value your privacy and are committed to protecting your personal data. This policy explains how we collect, use, and safeguard your information when you use our app.

1. Information We Collect

• Account data – name, email address, age, gender, and profile details you provide at registration.
• Location data – city and approximate geographic coordinates, used only to enable pen-pal matching.
• Usage data – letters sent and received, store activity, and in-app interactions, used to power features and detect abuse.
• Device tokens – Firebase Cloud Messaging tokens for push notification delivery (stored only while you are registered).

2. How We Use Your Information

• To create and manage your PostBox account.
• To match you with pen-pals and facilitate letter exchange.
• To send push notifications about letters and app events (you may disable this in Settings).
• To process in-app purchases of stamps and postcards.
• To investigate reports of abuse or policy violations.
• To improve and maintain the PostBox service.

3. Data Sharing

We do not sell your personal data. We share data only:

• With your pen-pals — your display name, city, country, and profile picture are visible to matched users.
• With Firebase (Google) for push notification delivery.
• When required by law or to protect the safety of users.

4. Account Deletion & Data Retention

You can delete your PostBox account at any time from Settings → Danger Zone → Delete Account. Deletion requires password confirmation.

Upon deletion:

• Immediate anonymisation – Your profile is replaced with anonymous placeholders. Your display name, avatar, bio, city, and location are wiped instantly. Other users can no longer see any trace of your account.
• Authentication revoked – All active sessions and push-notification tokens are invalidated immediately.
• Legal retention – Certain traceable data (email address, name at time of deletion, country, and coin balance) is moved to a secure internal retention table for 180 days to support legal obligations, abuse investigations, and fraud prevention. This data is never accessible to other users.
• Permanent purge – After 180 days the retained record is hard-deleted automatically by a scheduled process.
• Letters – Letters you sent or received are preserved because other users own them, but your identity on those letters is no longer resolvable.

If you need to delete your account but cannot access the app, contact us at support@rzstudio.online and we will process the request manually.

5. Security

We use industry-standard measures including HTTPS, hashed passwords (bcrypt), and token-based authentication (Laravel Sanctum) to protect your data. No transmission over the internet is 100% secure, but we take every reasonable precaution.

6. Children's Privacy

PostBox is not intended for users under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child has registered, please contact us immediately.

7. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data via the Edit Profile screen.
• Delete your account and data (see Section 4 above).
• Object to or restrict certain processing by contacting us.

To exercise any of these rights, contact us at support@rzstudio.online.

8. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via the app. Continued use of PostBox after changes constitutes your acceptance of the updated policy.

9. Contact

For privacy-related questions or requests, reach us at support@rzstudio.online.