Privacy

How your content is protected

Your browser encrypts your text and files before upload, using a method called AES-256-GCM. Your device creates the key. You can write an optional public teaser. Prediction and reveal templates add a one-word public label. Matching wording typed or pasted into your draft can add the same label; review shows it before posting. We store your teaser and any label you keep without encryption. They can appear before your Postdate opens. The page explains this where you write the teaser. You see both during review and can remove the label.

For Basic messages, we hold the key and release it at your chosen opening time. We promise not to read your content before then. We can decrypt it early, but our policy forbids it.

Timelock encrypts the key using drand, a public network that releases random numbers. When we say "we can't see it early", we mean encryption prevents early access. This protects access through the link, assuming drand and the encryption remain secure. It cannot erase originals or keys retained by the sender.

If you use the Google Calendar link, the Postdate link goes into your Google account. For a Basic Postdate that link opens the message after its time.

What we store

For each message link, we store the encrypted data, opening time, expiry time, and key. For Timelock, that key is itself encrypted for a future drand release. We store your public teaser without encryption until expiry cleanup. It stops appearing on the Postdate page at expiry. We store any prediction or reveal label you keep the same way. The label lets the page suggest the matching template. Anyone with the link can see your teaser and label, including in link previews. We serve teaser preview images while the message exists, unless it is blocked for review. Servers near visitors keep temporary preview copies, sometimes until the message expires. We cannot control previews saved by other services. If you add a celebration, we store which animation, colors and emoji you chose, without encryption, and send that choice to the reader's browser only once your Postdate is open.

An unfinished checkout retains its encrypted upload, key, settings, teaser, and label for up to four days. It also records whether you started from someone else's message page and, when available, a broad landing-page category, first landing language, and traffic-source category (one of the categories listed under Cookies and analytics below). Pending records expire after four days; scheduled cleanup removes abandoned large uploads. When the message is created, we count those categories in daily totals. We never store them on the finished message link or send them to Stripe.

Filenames are inside the encrypted data. We do not store filenames separately or inspect them.

We use hashing to turn IP addresses into codes. We use these codes to limit requests and handle abuse reports. Report records also hold a hashed network identifier and remain for 60 days. Hashes of encrypted uploads used to detect repeated uploads remain for 30 days. Our application stores these hashes rather than raw IP addresses. Cloudflare processes your IP address to serve requests and run the bot check.

When a message expires, we stop access. Scheduled cleanup removes expired keys and public fields; delays or outages can postpone cleanup. You can no longer open it through Postdate. Copies people already opened or saved remain. We keep a small record of the expired link for about 30 more days. This lets the page say "this expired" instead of "never existed". That record has no key.

We keep a small moderation record for links reported or removed for abuse. The record includes the link identifier, report counts, reasons, times, content type, and an approximate size range. Removed links also leave a persistent record so they stay marked as removed. It never includes the content, key, or raw IP address. We keep it as long as needed to handle abuse and legal requests.

Payments

Stripe processes payments for paid messages and add-ons. Your full card number and security code go directly to Stripe. Our application does not receive them. Stripe sends checkout and payment information to our server, which can include an email address and billing details supplied at checkout. Our application uses payment status, amount, currency, and random references to confirm the purchase. It does not save a customer profile.

Our checkout requests do not send Stripe your Postdate link, content, or key. We send Stripe random references and match them to your link ourselves. One reference returns you to Postdate after payment. Scheduled cleanup deletes it after about five days. We keep the payment confirmation reference for about 45 days. This lets us match late confirmations to the right message and fix payment issues. Neither reference contains your content or key.

Cookies and analytics

To restore an unfinished draft, this browser saves your text, teaser, and settings locally without encryption. Attached files are not saved with the regular draft. When you choose another language while composing, your browser temporarily saves the complete draft, including attached files, on your device without encryption so the next page can restore it. We remove that temporary copy when it is read. An interrupted handoff is valid for five minutes; expired copies are removed the next time a language handoff is saved, or when you clear this site’s browser data. After a successful post, we clear the draft text. This tab also stores your sharing receipt and, for Basic, your private delete link. Clear this site’s browser data to remove locally saved information.

We use no third-party tracking analytics and set no tracking cookies. We keep daily totals for page entries, composer starts, review openings, first sight of the $3 price, Timelock selections, celebrations added, checkouts, created links, paid creations, and grants, grouped by a small set of landing-page, first landing-language, and traffic-source categories. We also keep a daily count of links created with a celebration. These totals contain no visitor identifiers, message links, content, filenames, full referring URLs, or search terms. Your tab keeps only these categories, an expiry time, and per-tab flags for the steps it has already counted, in session storage for a measurement window that ends 30 minutes after your last activity on the page; they are not used to identify you across tabs or visits. Browser measurement respects Do Not Track and Global Privacy Control. Server totals still count successful creations and checkouts, with missing attribution recorded as unknown. The create page uses Cloudflare Turnstile to block bots. Turnstile may set its own functional cookie during the check. See Cloudflare's privacy policy for details. Postdate runs on Cloudflare. Cloudflare processes requests to serve the site.

We recognize search engines, AI assistants, X, and Product Hunt from the referring site or a recognized utm_source value in a shared link. Search engines include Google, Bing, DuckDuckGo, Yahoo! Japan, Qwant, and Startpage. AI assistants are ChatGPT, Perplexity, Gemini, Microsoft Copilot, Claude, Grok, DeepSeek, Meta AI, Le Chat, and Duck.ai. A link an AI assistant builds to fill in the create page also counts as an AI assistant visit. For AI assistant visits, we also keep a daily total by assistant. A visit that starts from a link on a Postdate someone shared with you counts under the source category "Shared Postdate". Your browser reduces this information to a source category before measurement. Other query parameters are ignored by this measurement. Landing language describes the page, not your nationality or location. Measurement requests from automated crawlers that name themselves, such as search engine bots, are counted by crawler type and kept out of visit totals. Other referring sites are grouped as social networks, forums, web mail, or messaging apps, or counted as other referral; a shared link may also carry utm_source=email, newsletter, hn, hackernews, reddit, or linkedin. When a visit arrives with no referrer, your browser keeps only how it began: direct (a typed address, a bookmark, or a link opened from an app), a new tab from another page of this site, a link from a site that hides its referrer, an in-app browser, or the installed app. Browsers tell our server whether a page request came from no site, from this site, or from another site; the server passes that one word back to the page and keeps no record of it, and only the resulting category is counted. Visits from browsers that identify themselves as automated, and measurement requests from hosting-provider networks (the network is derived from the request's address), are counted as automated traffic and kept out of visit totals; our application reads the network for that decision and stores neither the network nor the address.

On a Postdate someone shared with you, we count weekly totals of countdown views, openings, and presses of the button to make your own Postdate, by page language only. Your browser counts each of these once per Postdate. It remembers on your device which Postdates it has counted and never sends that record. These totals contain no link, content, or visitor identifier, and they respect Do Not Track and Global Privacy Control.

When an app such as WhatsApp, iMessage, Slack, or Discord fetches one of our pages to show a link preview, we add one to a weekly total for that app and page category. Every Postdate link counts in the same category, with no language; our public pages count by type and language. We never record which Postdate was previewed, who shared it, or any network address.

After you create a Postdate, or when you come back from a canceled payment, we may ask optional one-tap questions with fixed answers. If you tap an answer, we add it to a daily total by question, answer, and page language. For the question about how you heard of Postdate, we also add the traffic-source category described above, unless your browser sends Do Not Track or Global Privacy Control. Without those signals, we also count how often each question is shown and how often someone taps "Not now". You cannot type an answer, and these totals are not linked to your Postdate or payment. Your browser remembers on your device which questions you answered or closed, so we do not ask again. This tab also notes that it has already asked one. Neither record is sent to us. The invitation to talk with Tony is a plain email link; Postdate collects no address.

If something fails on the create page or a Postdate page, such as creating or opening a Postdate, the page may send us a fixed error code and which of the two pages it was. We add it to a daily total. These reports contain no message content, link, error text, or visitor identifier, and they respect Do Not Track and Global Privacy Control.

When our server refuses a request to create a Postdate, start a checkout, or upload a paid message, it adds the kind of request, a fixed refusal code, and whether the request came from a browser to a daily total. This total contains no message content, link, network address, or visitor identifier, and it counts refused requests whatever privacy signals your browser sends.

Contact

Email privacy@postdate.io with privacy questions. Report abuse to abuse@postdate.io.