# Privacy Policy

> How Postbag handles personal data for account holders and for the people who submit forms built by our customers. Operated by Md Afiur Rahman.

Source: https://postbag.dev/legal/privacy/ · Last updated: 2026-08-21

Postbag processes two different kinds of personal data, for two different people: **account holders**, who sign up to use Postbag, and **form submitters**, visitors who fill in a form built by one of our customers. This policy covers both, separately.

## Account holders

### What we collect

Your name and email address; a password hash, or an identity from Google or GitHub if you sign in that way; your API keys (stored as hashes, never in plaintext); usage logs; and the IP address and country of your requests, resolved via Cloudflare.

### Why we process it

To provide the service — create your account, run your forms, deliver your submissions — to keep it secure (rate limiting, abuse prevention), and to send transactional email such as delivery notifications and security alerts.

### Legal bases

Performance of a contract (running your account) and our legitimate interest in keeping the service secure and reliable.

### Retention

For as long as your account is active, plus 30 days after closure, to allow recovery from an accidental deletion.

### Your rights

Access, rectification, erasure, portability and objection. Email [hello@postbag.dev](mailto:hello@postbag.dev) and we'll act on it.

### Cookies

The dashboard sets one session cookie so you stay signed in. This marketing site sets no cookies at all — no analytics, no trackers; the only client-side storage it uses is your light/dark theme preference.

### Who sees it

Account data is visible to Md Afiur Rahman as operator, and to the sub-processors listed on our [sub-processors page](/legal/subprocessors/) — hosting, email delivery and, on paid plans, payment processing.

### International transfers

Md Afiur Rahman operates Postbag from Dhaka 1209, Bangladesh. Data is hosted in Germany (Hetzner Online, Nuremberg — European Union). All data in transit is encrypted with TLS, and access to production systems is limited to the operator.

### Children

Postbag is not directed at, and we do not knowingly collect data from, anyone under 16.

### EU representative

We have not appointed an EU representative under Article 27 of the GDPR. Postbag is operated by one person processing personal data at a small scale, which we believe falls within the Article 27(2) exemption; we'll revisit this if that changes. If you have concerns, contact us directly.

## Form submitters

If you filled in a form built by one of our customers, Postbag is the **processor**; the site that showed you the form is the **controller**, and is generally who you should contact first.

### What arrives

Whatever fields the form submits, plus the IP address, user agent, country and timestamp of the submission.

### Where it goes

Wherever the site owner configured — typically their email, and possibly other systems they've connected.

### Retention

90 days on the site owner's Free plan; longer on paid plans (up to 730 days). The site owner can delete a submission at any time.

### We never sell it

We do not sell submission data, and we do not use it for anything except delivering it the way the site owner configured.

### Exercising your rights

Contact the website that showed you the form first — they are the controller. If you contact us instead, at [hello@postbag.dev](mailto:hello@postbag.dev), we'll forward your request to them.

## Contact

[hello@postbag.dev](mailto:hello@postbag.dev) · Dhaka 1209, Bangladesh