Privacy policy
We collect the minimum of data and we do not sell it.
What we store
Nickname, email, password (only as a hash), name and mailing address, country, the "about" text, optionally Telegram and VK links and a profile photo, photos of postcards and stamps, private notes on postcards, in-site notifications, time of last login. IP addresses end up in Cloudflare technical logs.
Why
Only to make the exchange work: log you in, give you a recipient address, show your address to your sender, send a message to confirm your email or reset your password, and protect the site from abuse.
Who sees what
Your name and address are seen only by the member the site asks to send you a card, and only while it is on its way. Only you can see your private note on a postcard; it is stored encrypted. Every uploaded photo is first looked at by the moderator (who sees all photos) and only then can others see it. The moderator cannot see addresses or emails. After the check, the sender and the recipient see a postcard photo (the recipient once they have registered the card). Members of the site see a photo in the public gallery only if you allowed it.
How it is protected
Addresses and emails are stored encrypted, and the key is kept separately from the database. Backups also contain only encrypted data. Passwords are stored only as an irreversible hash.
Where data is stored
The site runs on Cloudflare infrastructure. We do not choose and are not responsible for the country where the servers physically are and where the data is stored. By registering you agree to this processing. If you do not agree, please do not register.
How long we keep it
As long as you have a profile. When you delete your profile, your name, address, email, photos, notes and favorites are erased at once. Encrypted backups may still hold the data for up to 30 days. In-site notifications are kept for 60 days. Unconfirmed sign-ups are deleted after 7 days.
Your rights
You can change your details in "My details" and delete your profile with the button there. Deleting the profile means withdrawing your consent to data processing.
Public gallery and profile
The public gallery (visible to members of the site) shows the front of the postcard, the nicknames of the sender and the recipient, the countries and the time on the way. This happens only if you turned on showing photos in the gallery, and you can turn it off at any time. Your profile photo, the "about" text and (if you allow it) Telegram and VK links are visible to other members.
Contact the operator: hello@crosscard.by