Privacy Policy

Operator (data controller): Individual Entrepreneur DARYA DUSHKEVICH, Georgia. Address: Georgia, Batumi, Tbel Abuseridze street, N 38, apartment N63 (ID 100349428).

Data contact: privacy@slowpigeon.com

1. What this is

Slow Pigeon (slowpigeon.com) is a service where a person sends a friend a digital postcard with their own photo; it «flies» as a virtual pigeon, the recipient watches the flight on a map and opens the postcard on arrival. This policy explains what personal data we process and what rights you have.

2. What data we collect

From the sender (when creating a postcard):

• sender's email and name;
• the recipient's name. We do not ask for their email: the sender passes the flight link on themselves. An address appears only if the recipient replies with a postcard of their own, or the sender enters it manually on the manage page;
• a photo (the front of the postcard) and a short message;
• the cities of departure and destination.

Technical data:

• IP address (for abuse protection and sending limits);
• an anonymous cookie identifier and funnel events — for basic product analytics.

3. Where the recipient's data comes from

We receive the recipient's name from the sender — a friend who is sending a postcard. This is a private message between people who know each other (the service is friends-only).

By default we do not store the recipient's email at all: the sender passes the flight link on themselves, by messenger or email. An address appears in two cases: the recipient replies with a postcard and gives their own email, or the sender enters it manually so that we send a message. In any such email the recipient always sees who sent it, and how to unsubscribe or delete their data.

4. Why we process it (purposes and legal bases)

• Deliver the postcard and flight/arrival notifications — email, names, photo, cities. Basis: for the sender, performance of the service they requested; for the recipient, legitimate interest (delivery of a personal message from a friend).
• Abuse protection and photo moderation — IP, photo. Basis: legitimate interest.
• Basic product analytics — anonymized events. Basis: legitimate interest.

We do not sell personal data and do not use it for third-party advertising.

5. Photo moderation

Uploaded photos are automatically checked for inappropriate content (Google Vision SafeSearch). A photo is stored privately and is available to the recipient only after «arrival».

6. Who we share with (processors)

We use third-party processors strictly to operate the service:

• Vercel — application hosting;
• Neon — database;
• Vercel Blob — private photo storage;
• Resend — email sending;
• Google Cloud (Vision) — automated photo moderation;
• ImprovMX — receiving email at privacy@.

7. International transfers

Data is processed on our providers' servers in different regions: database — Neon (United Kingdom); email sending — Resend (Ireland, EU); application and photo storage — Vercel (USA); automated photo moderation — Google Cloud (USA).

Transfers to the United Kingdom are covered by the EU adequacy decision. Transfers to the USA are made on the basis of Standard Contractual Clauses (SCC) and/or EU-US Data Privacy Framework certification under our data processing agreements with these providers.

8. Retention

• Postcard photo — deleted 90 days after arrival.
• Email and names — kept while the pair of friends is active, and deleted on request.
• Analytics — in anonymized form.

9. Your rights

You can access your data, correct it, delete it, restrict or object to processing, request portability, and lodge a complaint with a supervisory authority. To exercise these rights, write to privacy@slowpigeon.com; we will delete data within 30 days.

The postcard recipient can, at any time:

• unsubscribe from emails for a specific flight (link in the email);
• delete their data (email to privacy@).

10. Children

The service is not intended for persons under 16.

11. Changes to this policy

We may update this policy; the current version is always on this page with its update date.