Postlad/Privacy

Privacy

Postlad is a place you send numbers to, so unlike a page that stores nothing, this one has real substance. It states what is stored, where it is stored, how long it stays and who else receives anything — in terms you can check with the network tab open and a CSV export in the other window.

Last updated 2026-08-11. Questions, corrections and deletion requests: hello@postlad.com, which reaches a person.

1. What an account is

An email address. That is the whole of it. There is no name field, no company, no phone number, no address and no password — sign-in is a link or a six-digit code, every time, so there is no password hash to store or to lose.

Alongside it the account row holds only operational facts: which plan you are on and since when, your monthly reading count, the timezone you pick for your own charts, and the identifiers our payment provider gave us if you have ever subscribed.

2. Your readings

A stored reading is a stream number, a timestamp in milliseconds, and up to sixteen numbers. There is no device identifier in it, no location, and no room for anything else — the table has no other columns. Once a reading is older than the full-detail window it becomes an hourly minimum, maximum and average of the readings around it, and the individual readings are deleted.

The text you can attach is text you write: stream and board names, a description, the labels and units for each field, and the optional status= message a device sends with a reading. Those are free-text fields, they are shown on a share page if the stream is public, and nothing checks what you put in them. Do not put anything private in a stream name.

3. Cookies, and what your browser stores

This marketing site sets no cookies and runs no analytics. No tag manager, no session recorder, no advertising pixel, no error reporter, and it loads nothing from another domain — not a font, not a script, not an image from a CDN. That is why you have never been shown a consent banner here: there is nothing to consent to.

Every page except this site's status page makes one request to app.postlad.com/session/ping. It exists so the header can say Dashboard instead of Sign in when you are already signed in. It returns 204 or 401 with an empty body, and it records nothing.

The app at app.postlad.com sets two cookies, and only after you sign in:

• pl_s — your session. A session id and a signature, HttpOnly, Secure, SameSite=Lax, 30 days, extended as you use it. It is not readable by JavaScript and it is not sent to this marketing site.
• pl_pg — the marker the ping above reads. Its value is the character 1. It carries no identifier and no signature, and it is scoped to that one path, so it says "this browser has a session somewhere" and cannot say whose.

Signing out clears both. Nothing is kept in localStorage by either site, and embedded charts on other people's pages set nothing at all.

4. IP addresses

Postlad never stores a raw IP address. When one is recorded — on a sign-in, on a session, and on the audit row for creating an account — it is stored as a SHA-256 hash of the address plus a salt that changes every day, truncated. Because the salt rotates daily, two hashes from two different days cannot be matched to each other, which is what stops the record being a movement history.

They are there to rate-limit sign-in links and to show you your own devices on the account page. The device ingest endpoint at api.postlad.com does not read a client IP at all. Your browser's user-agent string is not stored either — it is reduced to something like Chrome/macOS so you can recognise your own laptop in a list of sessions.

5. How long things are kept

Readings, per plan, in the only wording the product is allowed to use for it:

Every reading is kept at full detail for 30 days. After that it becomes an hourly minimum, maximum and average, kept for 12 months. Older than that is deleted.

That is the Free plan. Hobby is 90 days at full detail, then hourly min/max/average to 24 months; Lab is 180 days at full detail, then hourly min/max/average to 60 months. A job runs every hour to do the deleting, and a second job runs daily whose only purpose is to check that the first one really did.

Everything else:

A magic link is a working credential for fifteen minutes, and the outbox row above keeps the text of the message. That is a deliberate trade — the alternative is not being able to answer "did my sign-in email send?" — and it is why the window is two hundred messages rather than forever.

6. Where it is stored, and who else receives anything

The database is Cloudflare D1, in Cloudflare's Eastern Europe region. Four other companies are involved, and this is all of them and exactly what each one gets:

• Cloudflare runs the code, the database, and the bucket the status page reads. Every request to api., app. and status.postlad.com passes through them, and like any host they keep standard request logs — address, time, URL, user agent — for a period they set. They also route mail sent to hello@postlad.com.
• Vercel hosts the pages on postlad.com itself, including this one, and keeps the same kind of standard request logs. Nothing about your account or your readings is on Vercel.
• Stripe takes payments. If you subscribe, Stripe receives your email address and our internal account id, and collects your card and billing address on its own pages — checkout is a full-page redirect, so card details never reach Postlad and there is no Stripe script on this site. What comes back to us is a customer id, a subscription id, a price id, and when the period ends.
• ZeptoMail (Zoho, EU cluster) delivers email. It receives the recipient address, the subject and the full text of the message — sign-in links, quota notices and billing notices. Our messages are plain text with no images, so there is no tracking pixel and no way for us to know whether you opened one.

There is no advertising network, no data broker, no CRM and no email marketing tool in that list, because there is not one in the product. Postlad sends you email about your own account and nothing else — there is no newsletter to unsubscribe from.

7. What we measure

Internal telemetry records the shape of traffic, not who made it: a stream id, an account id, how long a request took, how many readings it carried, and which limit was hit. No email address, no IP, no referrer, no user agent, and none of the values you sent. It is used to answer "is the ingest endpoint slow" and "is anyone about to hit their monthly cap".

8. What is public, and only because you chose it

Every stream and every board starts private. Nothing you store is reachable by anybody else until you change that yourself, and there are two ways to:

• A secret link. A long random token in the URL. Anyone holding the link can see the chart; nobody can guess it. Rotating the token breaks every copy of the old link, immediately.
• Public. A readable address anyone can open, with no account and no cookie banner, and an image for link previews.

A share page shows the stream's name, description, status message, field labels and its readings. It does not show your email address or your account. Making a stream public is not consent to be listed anywhere: the directory is off by default and every stream in it is added by hand.

9. Getting your data out, and getting it deleted

Export needs no request. CSV export is on every stream page, on every plan, at any time, including from a read-only stream and after a downgrade. It is the whole of your readings, and it is deliberately not something we can change our minds about.

Deleting a stream puts it in the trash for 7 days with every reading intact — restoring it brings back its share URL and its write key exactly as they were — and after that it and its readings are permanently removed.

Deleting the account itself is not yet a button. Write to hello@postlad.com from the address on the account and it will be done by hand: the account row, its streams, its readings, its sessions and its sign-in records. Saying that plainly is better than a page that implies a self-serve control that does not exist. The same address is where to write to see what is held about you or to have it corrected.

Two things survive a deletion and it is honest to say so: the payment record at Stripe, which is theirs and which tax rules require them to keep, and any message still inside the rolling 200-message send log until it ages out.

10. Changes to this page

The date at the top says when this last changed. If Postlad ever starts collecting something it does not collect today, it will be a visible change with a new date here — and a cookieless measurement tool is the only kind that would be considered.

What you are charged, what happens if a payment fails, and what the product does and does not promise are on the terms page. What is up right now is on the status page.