Privacy policy

Postforge is an email platform for ecommerce, built and run by sybdev, an independent developer in the Netherlands. Postforge is a private project for now, not a company. For anything about your data, email hello@postforge.dev.

For your Postforge account and your team, we decide what is collected and why: we are the controller of that data.

For the data of your store’s customers (their profiles, orders, consent and the emails you send them), your brand is the controller and Postforge processes it only on your instructions, to run the features you use. We never use it for anything else, never sell it and never combine it across workspaces.

When you sign up and use the dashboard, we keep:

• Your name, email address and a hash of your password (never the password itself)
• Your sessions: browser, operating system, IP address and when each was last active, so you can see where you are signed in and sign out elsewhere
• Two-factor settings and the browsers you chose to trust
• Your workspaces, roles and invitations, and which changes you made (versions record their author)
• API keys, stored only as a hash

We use this to give you access, keep your account secure and send the emails the service needs: confirming your address, password resets, sign-in codes and invitations.

When you connect a store or send data through the API, Postforge processes customers, orders, products, storefront events, email consent and the emails you send, including whether they were delivered, opened or clicked. Storefront events are only collected when the visitor gave consent through the store’s cookie banner.

People who want to see or delete their data should contact the brand they bought from. When a brand forwards such a request, or Shopify sends one, Postforge carries it out: a deletion removes the person’s profile, events, emails and consent history, and keeps only a hashed address so they are never emailed again.

The website and developer docs on postforge.dev use Vercel Web Analytics to count page views. It sets no cookies and does not track you across sites. The dashboard at app.postforge.dev has no analytics.

Postforge only sets cookies the service needs to work, and no advertising or tracking cookies:

• A session cookie that keeps you signed in, shared by the postforge.dev hosts
• A cookie that remembers the last workspace you opened
• A cookie for each browser you trust for two-factor sign-in, for 30 days
• Cloudflare Turnstile on sign-up, sign-in and password reset, which checks that you are not a bot

Data is stored in the European Union. These services process it for us, under their own data processing terms:

• Neon: the database, in Frankfurt
• Cloudflare: the API, file storage (EU jurisdiction), bot checks and the AI gateway
• Vercel: hosting of the dashboard and this website, in Frankfurt, and web analytics
• Resend: the emails Postforge sends you about your account
• Anthropic: Claude, only when you use the AI features, to draft changes you then review
• Shopify: when you connect a Shopify store

Marketing emails to your customers go through your own email provider account (such as Resend or Amazon SES), under your agreement with that provider.

• Account data: as long as your account exists
• Storefront and email events: 13 months in the database, then archived, and deleted after 26 months
• Individual emails sent: 13 months, after which only totals remain
• Unsubscribes and consent changes: as long as the workspace exists, so nobody who opted out is emailed again

To close your account or delete a workspace, email hello@postforge.dev.

Connections are encrypted. Credentials for your store and email provider are encrypted at rest; passwords, API keys and tokens are stored only as hashes. Owners can require two-factor sign-in for their workspace. Every workspace’s data is kept separate, and every request is checked against it.

You can ask to see, correct, export or delete your personal data, to limit how we use it, or object to it. Email hello@postforge.dev and we will answer within a month. You can also complain to the Dutch data protection authority, the Autoriteit Persoonsgegevens.

When this policy changes, the date at the top changes with it. If a change affects how we use your data, we email account holders before it takes effect.