Privacy
Who runs Parcel
Ioseb Katsitadze, 47 Politkovskaia Street, Tbilisi 0169, Georgia, is responsible for your data on Parcel. Contact: joseph.katsitadze@gmail.com.
Parcel has no accounts, no ads and no tracking. We only keep what's needed to deliver a parcel.
What we store
- The names typed for sender and recipient. They don't have to be real names.
- What's packed: letters, photos, scratch-card text, vouchers and their images, music links, voice recordings, time-capsule messages, and checkpoint questions and answers.
- The reply sent back in a Reply-paid envelope, its photo, and the question used to seal it, if any.
- The sender's email, only if they give it, to say a reply arrived. The recipient never sees it.
- When a parcel was opened, which vouchers were redeemed, and which checkpoints were cleared or skipped.
- Reports: the reason, any details, and an email if the reporter chooses to leave one.
- A one-way code made from your IP address with a secret key, used only to stop abuse such as guessing answers. We don't store the IP address itself.
Photos are converted on our server, and their location and camera data (EXIF) are removed.
Why
We use this data only to deliver the parcel and its reply, take payment, prevent abuse and handle reports. That is the service you asked for (our legal basis is performing it, plus our legitimate interest in keeping it safe). We never sell it, use it for advertising, or train AI models on it.
Who can see it
- Anyone with a parcel's link can open it, so share it only with the recipient.
- Items behind a checkpoint, a voucher's image, a time capsule, and a scheduled parcel stay on our server until they're unlocked. They aren't sent to the device early.
- Only the sender's receipt link shows the reply. We store a fingerprint of that link, not the link.
- We look at a parcel's content only when it has been reported, or when the law requires it.
How long we keep it
- Parcels, with their files, replies, reports and our record of the payment: 90 days after sending, or 90 days after a later delivery or time-capsule date. Then they're deleted automatically.
- Parcels that were started but never sent: 24 hours.
- Abuse-limiting records: 7 days.
- Lemon Squeezy keeps its own payment records, as their privacy policy describes.
Services we use
- Supabase: database and file storage.
- Vercel: hosting.
- Lemon Squeezy: payments, as merchant of record. We never see your card details.
- Spotify and Apple Music: their players load only when the recipient presses play. Cover images load from them with the mixtape, without sending which page you're on.
- Resend: the receipt and reply notification emails.
Some of these may process data outside your country, under their own safeguards.
Cookies and storage
Parcel sets no tracking or advertising cookies. Your browser keeps your draft, your place in a parcel and your receipt link in session storage, which is cleared when you close the tab.
Your rights
You can ask us to show you, correct or delete data about you, including deleting a parcel or reply early. Write to joseph.katsitadze@gmail.com with the parcel's link or tracking number. Because there are no accounts, we may ask you to show the link to prove the parcel is yours. You can also complain to your data protection authority.
Children
Parcel isn't meant for anyone under 16. If you think a child has sent us data, write to us and we'll delete it.
Changes
If this page changes, the date at the top changes too.