Privacy policy

What we collect, and why

• Waitlist signups

  If you join the waitlist for a city we have not launched yet, we store your email address, the zip code you entered, which city you signed up for, and when. Joining subscribes you to recurring marketing emails announcing new postcard launches in the area you signed up for, not a single one-time notification. Every marketing email will include an unsubscribe link. The waitlist table is write-only through our public site: the site can add your signup but cannot read signups back out.

• Buying an ad slot

  Payment happens on Stripe's hosted checkout page. Your card number and payment details go to Stripe and never touch our servers. After a successful payment, Stripe sends us the checkout session reference and the name and email you gave Stripe; we record the name (or the email, if no name was given) against the slot you bought, as the advertiser of record. We use it to run your placement: artwork, proofs, and the mailing itself.

• The zip code check

  When you enter a zip code on the front page, it is checked against the cities we cover and, if there is a match, carried in the page address to show you the right city. We do not store it and do not keep a log of the zip codes people check. It is saved only if you then join a waitlist, as described above. On the front page, our host Cloudflare also estimates your postal code from your connection so we can route you to your city automatically; we do not store that either.

• Ordinary web traffic

  The site runs on Cloudflare Workers. Like any web host, Cloudflare processes standard request metadata (IP address, user agent, requested page) to serve the site and defend it from abuse. We do not build profiles from it.

Cookies and advertising trackers

Currently: none. This site sets no cookies, runs no analytics, and loads no advertising trackers or pixels. If that changes (for example, if we add advertising measurement), this section will be updated first, before anything ships, to say exactly what was added and what it collects.

Who your information is shared with

Three service providers, each doing one job. We do not sell personal information, and we do not share it with anyone else.

• Supabase

  Hosts our database, including waitlist signups and slot records. When you check a zip code or join a waitlist, your browser talks to Supabase directly.

• Stripe

  Our payment processor. Stripe collects your payment details on its own pages under its own privacy policy: stripe.com/privacy.

• Cloudflare

  Runs the site's infrastructure and processes request metadata as described above.

How it is protected

Two concrete things, not boilerplate: the site is served over TLS, and the waitlist table is protected by database row-level security configured so the public site can add signups but cannot read them back. Reading waitlist emails requires our private service credentials.

How long we keep it

Waitlist emails are kept while you remain subscribed and removed when you unsubscribe or ask us to delete yours. Purchase records (the advertiser name and payment reference on a sold slot) are kept as business and transaction records for as long as we are required to keep them.

Access and deletion

Email privacy@hubcitymailer.com to ask what we hold about you, to correct it, or to have it deleted. Waitlist entries can simply be deleted on request. Purchase records tied to a completed transaction may need to be retained where the law requires it; if so, we will say which part and why.

California residents

If you live in California, the CCPA gives you the right to know what personal information we collect about you, to request its deletion, and to not be discriminated against for exercising those rights. This page is the disclosure of what we collect; the contact above is how you exercise the rest. We do not sell or share personal information as the CCPA defines those terms, so there is nothing to opt out of.

Changes

If this policy changes, the effective date at the top changes with it. A change that affects what we collect or who we share it with will be made before the practice changes, not after.