Privacy Policy

1. Who is responsible for your data

The data controller for Dovely is an individual operator established in the European Union: [ПЛЕЙСХОЛДЕР: имя контролёра], [ПЛЕЙСХОЛДЕР: страна].

For any privacy question or to exercise the rights described below, contact us at [ПЛЕЙСХОЛДЕР: контактный email].

2. What data we collect and why

We collect only what the postcard-exchange service needs to function:

• Account data: your email address, used to sign you in with a one-time code and to send service emails.
• Profile data: your nickname, name, country, languages, and an optional avatar and preferences, shown to other members so they can address a card to you.
• Mailing address: the postal address a matched sender needs in order to mail you a postcard. This is the core purpose of the service (see section 4).
• Exchange data: the postcards you send and receive, their status, and optional photos you upload to the community gallery.
• Consent records: the version and timestamp of the Terms & Conditions you accepted, and any newsletter opt-in.
• Technical data: a session cookie that keeps you signed in, and short-lived cookies used only during Google sign-in (see section 8).

3. Legal bases for processing

We rely on the following legal bases under the GDPR:

• Performance of a contract: operating your account and the postcard exchange you ask us to facilitate, including sharing your address with a matched sender.
• Consent: sending the optional newsletter, and processing you authorise when you accept the Terms & Conditions. You may withdraw consent at any time.
• Legitimate interests: keeping the service secure, moderating uploaded content, and preventing abuse.
• Legal obligation: retaining limited records where the law requires it.

4. Sharing your mailing address

Dovely is a postal exchange. When you are matched with a sender, that member is shown the mailing address you provided so they can post a physical card to you. This disclosure is the central, intended function of the service and happens only for an active exchange you take part in.

Your address is never shown on your public profile and is not exposed to members you are not exchanging with. Your email address is never shown publicly. You control when your profile is public, and you can keep your mailing address out of any exchange by not requesting or accepting one.

5. Sub-processors and international transfers

We use a small set of trusted service providers (sub-processors) to run the service. Some are located outside the European Economic Area, so your data may be transferred internationally under appropriate safeguards such as the EU Standard Contractual Clauses or an adequacy decision.

• Railway - application and database hosting.
• Resend - delivery of transactional and newsletter emails.
• Cloudflare R2 - storage of images you upload (such as gallery photos and avatars).
• Google - only when you choose to sign in with Google, to authenticate you.

6. How long we keep your data

We keep your account and profile data for as long as your account is active. Exchange records and uploaded photos are retained while they remain relevant to the exchange history shown in your account. When you delete your account, we remove your personal data within a reasonable period, except where we must keep limited records to meet a legal obligation.

7. Your rights

Under the GDPR you have the right to:

• Access and export the personal data we hold about you.
• Rectify inaccurate or incomplete data, which you can largely do yourself from your account settings.
• Erase your account and personal data.
• Withdraw consent you have given, such as the newsletter opt-in, at any time.
• Object to or restrict certain processing.
• Lodge a complaint with your local data protection authority.

How to exercise your rights

You can update much of your data directly in your account settings. For access, export, erasure, or any other request, contact us at [ПЛЕЙСХОЛДЕР: контактный email] and we will respond within the time limits set by the GDPR.

8. Cookies

Dovely uses only strictly necessary cookies. We do not use analytics, advertising, or cross-site tracking cookies, so no cookie consent banner is required.

• pc_session - keeps you signed in. Lifetime: up to 365 days.
• pc_oauth_state - protects the Google sign-in flow against forgery. Lifetime: about 10 minutes.
• pc_oauth_terms - carries your Terms acceptance through the Google sign-in redirect. Short-lived and cleared once sign-in completes.

9. Age limit

Dovely is not intended for children. You must be at least 16 years old, or the minimum age of digital consent in your country, to create an account.

10. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes we will update the date above and, where appropriate, notify you. Continued use of the service after an update means you accept the revised policy.