Last updated: October 17, 2026
Privacy Policy
This policy explains what personal data PennyPost collects, why, who helps us process it, and what you can do about it. It covers the website at usepennypost.com, the PennyPost app and API, and the emails our customers send through PennyPost. PennyPost is run by [LEGAL NAME] ("we", "us").
The short version
- We collect what we need to run PennyPost: your account, what you build in it, and the contacts you add.
- We don't sell personal data. We don't use analytics or advertising trackers.
- Emails sent through PennyPost record opens and clicks for the sender.
- A few providers host, send and process data for us. They're all listed below.
- Email hello@usepennypost.com to see, export, correct or delete your data.
Two roles
For PennyPost customers and visitors to our website, we decide how your data is used, so we're the controller.
For the contacts our customers add, the customer decides who gets email and what it says. The customer is the controller and we're their processor: we handle that data only to provide PennyPost to them. If you received an email from one of our customers, their privacy policy applies, and they're the first place to go with questions. Every email sent through PennyPost has an unsubscribe link at the bottom.
What we collect about customers
Your account. Your name, email address and password. We store the password only as a scrypt hash, so we can't read it. We also keep your workspace names, your plan, how many emails you've sent this month and today, how many AI builds you've used this month, and when the account was created.
What you set up. Your sending domains and newsletter settings: sender name, from and reply-to addresses, the postal address for your email footer, and the logo, description, social links and author bio you add. Also your campaigns, workflows, segments, and images you upload to the email editor.
The AI builder. The website address you give it and your answers (what you sell, who signs up, the action that makes users stick, the tone, any offer and the sender's name). Our server reads up to three public pages of that website. We keep the website address and the AI's explanation of its draft with the workflow.
API keys. We store a short prefix and a hash of each key. The full key is shown once, when you create it.
Payments. Polar runs checkout and billing. We never see or store your card number. Polar tells us what we need to apply your plan.
Technical data. Your IP address, which we use to rate-limit signups, logins and public forms, and which our host records in its server logs. Your browser's time zone, kept in a cookie so the dashboard counts days in your time.
Support. Whatever you write when you email us.
What we process for our customers' contacts
For each contact a customer adds, PennyPost stores:
- the email address, first and last name, tags, and any custom fields the customer sets (for example a plan name or a signup date);
- where the contact came from and their status: active, waiting to confirm, unsubscribed, bounced, complained or dormant;
- dates: when they subscribed, confirmed or unsubscribed, and when they were last sent an email, last opened one and last clicked;
- counts of emails sent, opens and clicks, plus engagement numbers imported from a previous email tool;
- events the customer's app reports, such as "trial_started", with any details the app includes;
- the workflows the contact has gone through and the steps they reached;
- a record of each email sent to them: the address, its status, the mailbox provider worked out from the address's domain, and when it was sent, delivered, opened, clicked, bounced or marked as spam;
- reports from receiving mail servers about bounces, spam complaints, delays and rejections.
Customers add contacts through the API, by importing a CSV file, or through signup forms on their public newsletter pages. A customer can turn on confirmed opt-in for a list, so that new signups get an email with a link and only join once they click it.
Open and click tracking
Most emails sent through PennyPost contain a tiny image that records when the email is opened. Their links go through PennyPost first, which records the click and sends you straight on to the page. Unsubscribe links are never tracked, and neither are signup confirmation emails or the "do you still want these emails?" check that list cleanup sends.
We store the time of the first open and the first click on each email, and the latest open and click on the contact. We don't store your IP address or browser details for opens and clicks. We look at the browser name only to ignore clicks made by security scanners. If your email app blocks images, opens aren't recorded.
The suppression list
When an address hard-bounces, or its owner marks an email as spam, we add it to a suppression list that covers all of PennyPost. After that, no PennyPost customer can email it. We keep the address, the reason and the date. The entry stays after the customer who sent the email leaves, because the point of the list is that the address is never emailed again. If you want your address taken off it, email us.
Website and newsletter pages
The usepennypost.com website has no analytics or advertising scripts and sets no cookies. It loads its fonts from Google Fonts, so Google receives your IP address and browser details when the page loads.
Public newsletter pages count how many times each issue is read. Your browser keeps a note in local storage so it's counted once a day, and the count stores nothing about you. If you subscribe on one of these pages, the newsletter's owner gets your email address as a contact.
Cookies and local storage
PennyPost uses three cookies, all needed for the service to work:
| Cookie | What it does | Lasts |
|---|---|---|
__Host-mailflow_session |
Keeps you logged in. It's signed, and scripts on the page can't read it. | 7 days |
tz |
Your browser's time zone, so the dashboard counts days and hours in your time. | 1 year |
mailflow_appsumo |
Holds a partner license code while you sign up. Only set if you arrive with one. | 1 hour |
Local storage stays in your browser and isn't sent to us. The app uses it to remember your light or dark theme. Newsletter pages use it to remember whether you subscribed or closed the subscribe prompt, and when you last read each issue.
We don't use analytics, advertising or tracking cookies. If that ever changes, we'll update this policy first.
Other services your browser loads
When you're logged in, the dashboard shows small icons and avatars that your browser loads directly from other companies:
- website icons from Google's favicon service, which receives the domain name;
- contact pictures from Gravatar, which receives a SHA-256 hash of the contact's email address, not the address itself.
How we use data, and our legal basis
Under the GDPR and UK GDPR we need a legal basis for each use.
| What we do | Legal basis |
|---|---|
| Run your account and PennyPost: store your content, send the emails you publish, show reports | Contract with you |
| Write AI drafts when you ask for them | Contract with you |
| Bill you and apply your plan | Contract with you; legal obligation for tax records |
| Rate limits, abuse checks, the suppression list, bounce and complaint limits, account holds | Legitimate interests: keeping PennyPost secure, protecting recipients and protecting our sending reputation |
| Emails about your account, security, billing and changes to our policies | Contract with you |
| Occasional product news to customers, with an unsubscribe link in every one | Legitimate interests |
| Answer support emails | Contract with you; legitimate interests |
| Comply with the law, and set up or defend legal claims | Legal obligation; legitimate interests |
For our customers' contacts, we act only on the customer's instructions: storing contacts, sending the customer's emails, tracking opens and clicks, and reporting results. We also use contact data for the security purposes in the table above, such as the suppression list.
We don't sell personal data or share it for advertising. We don't use your data or your contacts' data to train AI models.
AI processing
When you use the AI builder, our server fetches the public website you name. It only reads https pages and refuses private network addresses. It then sends the page text, your answers and your list's name to Anthropic's API, which writes the draft. No contact data goes to Anthropic. Anthropic says that by default it doesn't use inputs or outputs from its commercial products to train its models. The draft comes back to you, and nothing is sent to anyone until you publish it.
Who processes data for us
| Provider | What it does for PennyPost | Data it handles |
|---|---|---|
| Amazon Web Services | Sends every email and reports deliveries, bounces and complaints back to us | Recipient addresses, email content, sending domains, delivery reports |
| MongoDB Atlas (MongoDB, Inc.) | Our database, hosted on Amazon Web Services in the US East (N. Virginia) region | Everything PennyPost stores: accounts, workspaces, contacts, emails, events |
| Vercel | Hosts the website and the app, and stores images uploaded to the email editor | Every request to PennyPost, including IP addresses and server logs; uploaded images, which are public by URL |
| Upstash | Runs background jobs (QStash) and rate-limit counters (Redis) | Internal IDs of emails, workflow runs and scheduled campaigns; IP addresses and API key IDs as short-lived counter keys |
| Anthropic | Writes AI drafts | Website text, your AI builder answers, your list's name |
| Polar | Checkout, billing and sales tax, as our merchant of record | The name, email address, billing address and payment details you enter at checkout |
Polar sells PennyPost plans as a reseller, so for the purchase itself Polar is also responsible for your data under its own privacy policy.
We may also disclose data when the law requires it, to protect people from harm or fraud, or to a buyer if PennyPost is sold. A buyer would have to keep following this policy.
Where your data is stored
Our database and email sending run in Amazon Web Services' US East (N. Virginia) region, so your data is stored in the United States. Our other providers may process it in the United States and other countries. If you're in the EU, the UK or Switzerland, this means your data leaves your country. For those transfers we rely on our providers' data processing terms, including the European Commission's standard contractual clauses where they apply.
How long we keep data
| Data | How long |
|---|---|
| Your account, workspaces and everything in them | While your account is open, then deleted within 30 days of closing it |
| The record of each email sent | 180 days, then deleted. Only totals remain. |
| Events your app reports about contacts | 180 days |
| Bounce, complaint and delivery reports | While the customer's account is open |
| Suppression list entries | Until you ask us to remove one, so those addresses are never emailed again |
| Rate-limit counters with IP addresses | A few hours at most |
| Login session | 7 days |
| Server logs | A short time, set by our host |
| Payment records | Kept by Polar for as long as tax law requires |
Security
- Passwords are stored as scrypt hashes and API keys as hashes.
- The login cookie is HTTP-only and only sent over HTTPS.
- Links in emails (unsubscribe, confirmation, open and click tracking) are signed, so they can't be forged or used to redirect people elsewhere.
- A workspace can only send from domains it has verified, and each workspace's sending reputation is kept apart from every other customer's.
- Only the people who run PennyPost can open the admin area.
No system is perfectly secure. If a breach affects your personal data, we'll tell you and the relevant authorities as the law requires.
Your rights
Depending on where you live, including under the GDPR, the UK GDPR and California's privacy law, you can ask us to:
- show you the personal data we hold about you;
- correct it;
- delete it;
- give you a copy in a portable format;
- stop or limit using it where we rely on legitimate interests.
Email hello@usepennypost.com from your account's address and we'll answer within 30 days. You can also complain to your local data protection authority. We won't treat you differently for using these rights. We don't sell or share personal information as California law defines those terms.
If you're on one of our customers' lists, you can unsubscribe with the link in any of their emails. For anything else, such as access or deletion, contact the business that emailed you, since they control that data. If you can't reach them, email us and we'll pass your request on or help where we can.
Children
PennyPost is for adults running a business. We don't knowingly collect personal data from children under 16. If you think a child has given us personal data, email us and we'll delete it.
Changes to this policy
When we change this policy, we'll update the date at the top. If a change matters, we'll email customers before it applies.
Contact
[LEGAL NAME]
[POSTAL ADDRESS]
hello@usepennypost.com