Privacy Policy

This Privacy Policy describes how MailQSL (“MailQSL,” “we,” “us”) collects, uses, shares, and protects information when you use the MailQSL service (the “Service”). By creating an account or using the Service, you agree to the practices described here.

1. Information we collect

Account information

When you sign up we collect your email address, a password (stored as a salted hash by our authentication provider), and your amateur radio callsign. If you sign in with Google, we receive your Google account email and a unique identifier from Google; we do not receive your Google password.

Profile and mailing information

To mail QSL cards on your behalf, we collect your name and return mailing address (used as the sender address on outgoing postcards), and any QSL card artwork or template content you upload or design within the Service.

Log and contact data

When you upload an ADIF, CSV, or Excel log file, we collect the contact records contained in that file — including callsigns, contact dates, frequencies, modes, signal reports, and any names, addresses, or other fields included in your file. For callsigns without an address, we may query third-party lookup services (HamQTH and Callook.info) to find a publicly listed mailing address. You may also enter contact addresses manually.

Payment information

Payments are processed by Stripe. We do not store your full credit card number or CVC. We receive and store limited transaction metadata from Stripe (such as a customer ID, payment intent ID, card brand, last four digits, and payment status) to record what you paid for.

Usage and device data

We collect basic technical information about your interaction with the Service, including IP address, browser type, pages visited, and error/diagnostic data, used to operate, secure, and improve the Service.

2. How we use information

We use the information described above to:

• Create and maintain your account and authenticate you.
• Design, render, print, and mail QSL postcards on your behalf — including transmitting your sender information, recipient addresses, and card content to our print-and-mail provider.
• Look up mailing addresses for callsigns via third-party lookup services, when an address is not already supplied in your file.
• Process payments and prevent fraud.
• Send transactional messages (account confirmation, password reset, job status, billing receipts).
• Diagnose problems, monitor uptime, and improve the Service.
• Comply with legal obligations.

3. Third-party service providers

MailQSL is built on a small number of trusted third-party services. Your information is shared with them only as needed to operate the Service:

• Supabase — database hosting and user authentication.
• Vercel — application hosting and traffic delivery.
• Google — optional sign-in (OAuth) if you choose to use it.
• Stripe — payment processing. Stripe’s own privacy policy applies to card data they handle directly.
• Lob — printing and mailing of physical postcards. We share each recipient’s name and mailing address, your sender information, and the rendered card content with Lob so they can print and mail the card.
• HamQTH and Callook.info — public callsign lookup services we query to find listed mailing addresses for callsigns. We send only the callsign being looked up.
• Resend (or our configured email provider) — delivery of transactional email such as account confirmations and password resets.

We do not sell your personal information, and we do not share it with advertisers.

4. Recipient (third-party) addresses

To mail a QSL card to one of your contacts, MailQSL processes the recipient’s name and mailing address. You are responsible for ensuring you have a lawful basis to mail postcards to the people in your uploaded log. We retain recipient address data associated with completed jobs as part of your job history; you can request deletion of this data at any time (see Your choices below).

5. Data retention

We retain account information, uploaded logs, designed templates, job history, and transaction records for as long as your account is active, and afterwards as needed for tax, accounting, fraud prevention, and legal-compliance purposes. When you delete your account, we delete or anonymize your personal data on a rolling basis, except records we are required to retain by law (for example, payment records).

6. Your choices

You may, at any time:

• Access and update your profile and template content from your dashboard.
• Delete uploaded logs and template designs from your dashboard.
• Request deletion of your account by emailing mailqsl-support@googlegroups.com. We will delete your account and associated personal data, subject to the retention exceptions described above.
• Request a copy of the personal information we hold about you.

Depending on where you live, you may have additional rights under applicable law (for example, the GDPR or the California Consumer Privacy Act). Contact us at the address above to exercise those rights.

7. Security

We use industry-standard encryption in transit (HTTPS) and rely on our infrastructure providers (Supabase, Stripe, Lob, Vercel) for encryption at rest and access controls. No system is perfectly secure; we cannot guarantee absolute security, but we work to protect your information and will notify you of any incident affecting your data as required by law.

8. International users

MailQSL is operated from the United States. If you access the Service from outside the U.S., your information will be transferred to, stored, and processed in the U.S. and other jurisdictions where our service providers operate.

9. Children

MailQSL is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us and we will delete it.

10. Changes to this policy

We may update this policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you by email or in the app.

11. Contact us

Questions, requests, or complaints about this policy can be sent to mailqsl-support@googlegroups.com.