Privacy Policy
Last updated: June 2026
Overview
Pippy Post is operated by Zebbly LLC ("we," "us," or "our"). This policy explains what information we collect when you use the Pippy Post greeting delivery service, how we use it, and your rights regarding that information. By using Pippy Post, you agree to the practices described here.
Information we collect
Account information
When you register, we collect your name, email address, and password (stored as a secure hash). You may optionally provide a phone number for SMS-based notifications.
Contact information you provide
To use the greeting delivery service, you add contacts with their names, phone numbers, and birthday or anniversary dates. This information is stored securely and used only to schedule and deliver greetings on your behalf.
Payment information
Subscription billing and artist payouts are handled by Stripe. We do not store your full card number or CVV. Stripe's privacy policy applies to payment data: stripe.com/privacy.
Usage data and cookies
We collect standard server logs (IP address, browser type, pages visited, timestamps) to operate and improve the service. We use Plausible Analytics, a privacy-friendly tool that does not place tracking cookies and does not identify you across sites.
We also use session cookies to keep you signed in. These are strictly necessary to operate the service and are not used for advertising or cross-site tracking.
SMS consent record
When you create an account, we record the date and time you agreed to the SMS consent disclosure. We retain this record for legal compliance purposes.
How we use your information
- Deliver greeting messages to your contacts via SMS/MMS on scheduled dates
- Send you preview notifications before a greeting is delivered
- Process subscription payments and artist payouts
- Maintain a record of your SMS consent for Telephone Consumer Protection Act (TCPA) compliance
- Provide customer support
- Improve and maintain the service
- Comply with legal obligations
SMS and MMS messaging
Pippy Post delivers greeting messages to your contacts' phone numbers via SMS/MMS using Twilio. By adding a contact's phone number to your Pippy Post account, you represent and warrant that you have obtained that person's prior express consent to receive SMS/MMS messages on their birthday or other scheduled occasions.
Message frequency: Contacts receive one message per scheduled occasion per year, plus any one-time greetings you initiate. Message frequency may vary by account.
Message and data rates may apply.
To opt out: Reply STOP to any message to stop all future messages. Reply START or UNSTOP to re-enable messages. Reply HELP for help or contact us at hello@pippypost.com.
We do not sell, share, or rent phone numbers or message content to third parties for their own marketing purposes. Phone numbers and message content are shared with Twilio solely to deliver messages you schedule through the service.
You (as the account holder) may receive preview SMS notifications before a greeting is delivered. You can disable these in Settings → Notification preferences.
Message frequency: Contacts receive one message per scheduled occasion per year, plus any one-time greetings you initiate. Message frequency may vary by account.
Message and data rates may apply.
To opt out: Reply STOP to any message to stop all future messages. Reply START or UNSTOP to re-enable messages. Reply HELP for help or contact us at hello@pippypost.com.
We do not sell, share, or rent phone numbers or message content to third parties for their own marketing purposes. Phone numbers and message content are shared with Twilio solely to deliver messages you schedule through the service.
You (as the account holder) may receive preview SMS notifications before a greeting is delivered. You can disable these in Settings → Notification preferences.
Sharing with third parties
We share information only as necessary to operate the service:
- Twilio — SMS/MMS delivery (receives recipient phone numbers and message content)
- Stripe — payment processing and artist payouts
- Cloudinary — image storage and delivery (stores artist-uploaded artwork)
- Resend — transactional email delivery (preview and notification emails)
- Anthropic — AI-assisted greeting selection (receives non-personally-identifying metadata such as a contact's first name, relationship label, and occasion type — never phone numbers)
- Neon — database hosting
- Vercel — hosting and infrastructure
Data retention
We retain your account data for as long as your account is active. If you delete your account, we delete your personal information and your contacts within 30 days, except where we are required by law to retain it (for example, billing records for tax purposes, which we retain for 7 years).
Delivery logs (which phone numbers received which messages and when) are retained for 90 days for troubleshooting and compliance purposes, then deleted.
SMS consent records are retained for the life of the account plus 4 years after deletion, as required for TCPA compliance documentation.
Delivery logs (which phone numbers received which messages and when) are retained for 90 days for troubleshooting and compliance purposes, then deleted.
SMS consent records are retained for the life of the account plus 4 years after deletion, as required for TCPA compliance documentation.
Your rights
Depending on your location, you may have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate data
- Request deletion of your data ("right to be forgotten")
- Export your data in a portable format
- Opt out of marketing communications at any time
California residents (CCPA)
If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):
- Right to know — you may request a report of the personal information we have collected about you in the past 12 months
- Right to delete — you may request deletion of your personal information, subject to certain legal exceptions
- Right to opt out of sale — we do not sell personal information, so there is nothing to opt out of, but you have this right
- Right to non-discrimination — we will not discriminate against you for exercising your privacy rights
Security
We use industry-standard security practices: HTTPS for all connections, bcrypt password hashing, environment-variable secret management, and role-based access controls on our database. No system is perfectly secure. If you discover a security vulnerability, please report it responsibly to hello@pippypost.com before public disclosure.
Children
Pippy Post is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with information, contact us at hello@pippypost.com and we will delete it promptly.
Changes to this policy
We may update this policy from time to time. We will notify registered users by email for material changes at least 14 days before they take effect. The "last updated" date at the top of this page reflects the most recent revision.
Contact us
Pippy Post (operated by Zebbly LLC)
hello@pippypost.com
hello@pippypost.com