Privacy

Last updated 1 October 2026

PostFinder (postfinder.io) is a directory of post offices, parcel lockers and post boxes. This policy says what the website keeps about you, who else sees it, how long it is kept and how to have it deleted. Reading the site needs no account, and we would rather not know who you are.

The short version

There is no analytics, no advertising, no tracking pixel, no session recording and nothing that follows you to other sites. We never sell or share what we keep for anyone else's use. What we do keep is listed below, with how long, and you can delete your account yourself at any time.

When you read the site

Our servers see what any web server sees: your IP address, the page you asked for including anything in its address such as a search or a postcode, your browser's user agent and the time. These go into server logs, which are kept for at most 30 days and then deleted. We use them to keep the site running and to deal with abuse, and for nothing else.

If you use "near me", your browser asks you first. The position is rounded to about 100 metres before it leaves your device, and is only used to find what is nearby.

Who else is involved

These services handle data for the site, each for one job:

Cloudflare sits in front of the site, so every request passes through it and it sees your IP address. It also runs Turnstile, the check that a person rather than a script is sending a form, and tells us which country a request came from so a page can offer the right one. We do not store that country.
DigitalOcean runs our servers, database and photo storage, in Sydney.
Resend delivers our emails: sign in and confirmation codes, and messages from the contact form.
Google Workspace holds our mailbox, so an email you send us directly is stored there.
OpenFreeMap serves the map tiles. Your browser fetches them directly, so it sees your IP address and which part of the map you are looking at.
Have I Been Pwned is asked, when you choose a password, whether it has appeared in a known breach. Only the first five characters of a hash of the password are sent; never the password, and nothing that identifies you.

Some of these process data outside Australia, including in the United States. Each is bound by its own terms to use it only to provide its service.

If you write to us

The contact form asks for your name, email address and message. It sends them to us as an email through Resend, together with the IP address the message came from, so we can deal with abuse. We keep the email for as long as it takes to answer you, and to keep a record if you told us something on the site was wrong.

If you review a place or add a photo

Everything a visitor adds is checked by a person before it appears on a page. The review, fix and new place forms are protected by Cloudflare Turnstile.

A review needs no account. It keeps what you wrote, the name you gave or one we made up for you, and the time. A reviewer cookie, pf_reviewer, holds a random token for one year, so your next review carries the same name; the name itself is kept on our side, against that token. To stop one address sending hundreds of reviews, we keep a hash of your IP address rather than the address itself, made with a key that changes every day, so it cannot be matched to you or across days. A review we decline is never shown, but it is kept, so the same review sent again is recognised.

A photo needs an account, because it is credited. It shows your handle if you set one, or "a PostFinder contributor" if you did not, and never your email address. Before a photo is stored we make a fresh copy of the picture alone, so the camera's details and any GPS location in the file are removed. Waiting photos are kept privately and seen only by the person checking them; a photo we decline is deleted.

If you suggest a fix, it needs no account either. It keeps what you said should change, the same daily hash of your address, and an email address only if you gave one, so we can ask a question. That email is never published and is deleted when the fix is decided, whichever way it goes.

If you add a missing place, the same is true: no account, what you told us about the place and where you put the pin, the daily hash of your address, and an optional email that is deleted once the place is decided. If you used your location, the position is only the place's; we do not keep where you were standing apart from it.

If you have an account

Nothing on this site needs an account to read. An account keeps your email address, the handle you choose, and a hash of your password made with Argon2, never the password itself. If you set up two factor sign in or a passkey, those credentials are kept too. Your photos are linked to your account.

PostFinder takes no payments and has nothing to sell you, so there is no card or billing data to keep.

Cookies and what your browser keeps

There are no advertising or analytics cookies. These are all there are:

postfinder_session keeps you signed in, for up to 90 days. Sign in also sets short lived cookies that protect the forms against cross site requests.
pf_reviewer holds the random token behind your reviewer name, for one year, once you post a review.

These stay in your browser's own storage and are never sent to us: theme, your light or dark choice; pf.country-hint.dismissed, that you closed the note about another country; pf:mastodon-instance, the Mastodon server you last shared to; pf-add-place, a draft of a place you are adding, including the email if you typed one, removed once it is sent; pf-sent, which places you have sent something about, for 14 days; and postfinder.api.key, an API key you pasted into the API reference, until you close the tab. Clearing your site data removes them.

How long we keep things

Server logs: at most 30 days.
Your account and photos: until you delete the account.
Reviews, and the daily hash kept with them: for as long as the place's page exists.
An email given with a fix or a new place: until it is decided.
Contact form messages: as long as it takes to deal with them.

Deleting your account

Delete it yourself from /account/delete. That deletes your email address, password, passkeys, photos and every session straight away. Reviews and fixes are not tied to an account, so they stay; write to us to have one removed.

Your rights

Wherever you live, you can ask us for a copy of what we hold about you, to correct it, to delete it, or to stop using it, and object to how we use it. Write to or use the contact form. We answer within 30 days, at no cost, and you do not need to give a reason. If you are in the United Kingdom or the European Union, you can also complain to your data protection authority.

Children

The site is not meant for children, and we do not knowingly keep anything about a child.

Data about places, not people

Almost everything on this site is a fact about a building: where a post office is, when it opens, when a box is emptied. That comes from the sources we credit, not from anyone who visits. If a page shows a phone number or an address that belongs to you and should not be here, write to us and we will take it down.

Changes

When this policy changes, the date at the top changes with it.