Privacy Policy | Good Post Co

This explains what Good Post Co knows about you, why, who else sees it, and how long we keep it. It covers goodpostco.com, every club page hosted on it, and the emails we send.

Short version: we hold your name, your email address and the address your mail goes to. We do not hold your card. We do not store your IP address. We do not sell anything about you, and there are no advertising or tracking scripts on any page a subscriber sees.

Who is responsible for your information

Sendero Origen, LLC d/b/a Good Post Co, an Oklahoma limited liability company, 3126 S Boulevard St #154, Edmond, OK 73013. Write to us at support@goodpostco.com about anything on this page.

Good Post Co is the seller for every club, so we decide how the information below is handled. The creator of the club you joined also uses your name and address, to put on your envelope, and makes their own decisions about their own copy of their subscriber list — see "Who sees it" below.

What we collect

When you join a club

Your name, and the name that goes on the envelope if it is different.
Your email address.
Your mailing address.
Which club, which plan, and the price you agreed to.
That you ticked the consent boxes, when you ticked them, and which version of the terms was on the screen.
If the club sends updates by email and you left that box ticked, the exact words beside it and when you agreed.
If it is a gift: the recipient's name and address, the note you wrote, and their email address if you gave us one.

While you are a member

Your payments, as records held by Stripe — the amount, the date, the tax, and the receipt. We keep Stripe's reference numbers, not your card.
What has been mailed to you and when, and the address it was sent to.
Any address changes, and who made them.
Replacements you asked for, and returned mail that came back to us.
Notes the creator writes about your subscription — usually a delivery problem or a request.

When you sign in

A one-time sign-in link, stored only as a fingerprint of itself. The actual link exists in your email and nowhere else, so nobody reading our database could sign in as you.
A session, so you stay signed in while you are using the page.

If you buy Jennifer D. Ashford's guide

The name and email address you type on the guide's page. Both are printed at the bottom of every page of your copy, so it is plainly yours, and the email is where we send your download link.
What you paid, the sales tax on it, when, which version of the Guide Licence and Terms you agreed to and when you ticked it, and whether it was refunded.
How many times you have downloaded it, and your download links, stored only as a fingerprint of themselves, like sign-in links.
Stripe asks for your billing address on its own checkout page, because a digital product is taxed where the buyer is. Stripe keeps it with the payment; we do not copy it into our database.

If you sign up for a club's updates without joining

Your email address, which club, the words you agreed to, when, and when you confirmed by pressing the button in our email. If you stop them, when. Nothing else: not your name, and not your IP address.

If you join a club's waitlist

The same as for updates: your email address, which club, the words you agreed to, when, and when you confirmed. Also when you joined the waitlist (your place in line), when we last told you a spot was open, and whether you asked for the club's updates as well.

If you ask us about running a club

What the form at goodpostco.com/start asks: your name, your email address, your club's name if it has one, its website if it has one, what you plan to mail, roughly how many subscribers you expect, and anything else you choose to tell us. Nothing else — not your IP address, and not which browser you used.

What we deliberately do not collect

Your card number. You type it into Stripe's payment form — Stripe's own secure box on our checkout page, or Stripe's own checkout page — and it goes straight to Stripe. It never passes through our servers, and there is no card data in our database. What we hold is a reference that lets us charge the card again for a renewal, and refund it, and nothing else.
Your IP address. It is not on your account, not on the sign-in record, not in the audit log, not anywhere. Cloudflare, who serve the site, see it as any web host must, and use it to block attacks — we do not store it or attach it to you.
Anything about you from anywhere else. We do not buy lists, enrich profiles, or look you up.
Tracking of any kind. No analytics, no advertising pixels, no session recording, no third-party scripts on any subscriber-facing page. This is a rule the code is built around, not a setting. Two scripts on the page where you subscribe are not ours, and both are there to take your payment safely. One is a check: Cloudflare's Turnstile, which makes sure the form is being filled in by a person and not a program. To do that, Cloudflare looks at your connection and your browser, as it already does to serve the site, and uses what it sees for that check alone. We are told whether the check passed. We are not sent your IP address or anything else about your device, and nothing about you is sent to Cloudflare with the check. The other is Stripe's payment form, which loads only when you reach the payment step. Stripe collects information about your device and how you use its form, using cookies and your IP address, to prevent fraud and to provide and improve its service. Stripe handles that under its own privacy policy, at stripe.com/privacy, and none of it is shared with us. The guide's page uses the same Turnstile check on its buy form, and nothing else that is not ours; you pay for the guide on Stripe's own checkout page.

Cookies

There is one cookie: the one that keeps you signed in after you click your sign-in link. It holds a reference to your session and nothing else, it is set only when you sign in, and it goes when you sign out.

That is the entire list of ours, which is why there is no cookie banner on this site. There is nothing to ask you about. If that ever changes, there will be a banner and it will let you say no. Stripe's payment form sets cookies of its own when you reach the payment step, for fraud prevention, as described above; they are Stripe's, and they are needed to take a card payment safely.

Good Post Co staff signing in to the admin area have cookies of their own: one that keeps them signed in, and one that lasts an hour while they sign in. Neither has anything to do with subscribers.

Why we hold it

To take your payment and send your receipt. This is the contract between us.
To get the mail to you. The address is the point of the whole thing.
To work out and collect sales tax, and to keep the records the tax authorities can ask for.
To email you about your membership — the welcome, receipts, a failed payment, a renewal reminder, a change of address confirmation, a note that your mail is on its way.
To send you a club's updates, if you agreed to them, until you stop them.
To answer you when you write to us, or when you ask about running a club. We write back to the address you gave us, about the club you asked about, and that is all we use it for.
To stop fraud, and to defend a card dispute if one is filed.

Apart from a club's own updates, when you agreed to them, we do not use any of it to advertise to you.

Who sees it

Your creator. The person who runs the club you joined can see your name, the name on the envelope, your address, what you bought, what has been mailed to you and any notes about your subscription. They can download that list. This is how your envelope gets addressed, and it is also a deliberate promise: a creator's subscriber list belongs to the creator, and we will never hold it hostage. They cannot see your card, and they cannot see anything about any other club you belong to.

If you start a checkout and do not finish it, the club's creator sees your name, the day you started and the plan you chose. They do not see your email address or your mailing address.

Us. Good Post Co staff, when there is a reason — a support email, a refund, a payment problem, an investigation. Every time a member of staff looks at a creator's studio as that creator, it is recorded.

If you signed up for a club's updates, the club's creator can see your email address, as part of their list.

If you joined a club's waitlist, the club's creator can see your email address, when you joined, and when you were last told a spot was open.

If you asked about running a club, only Good Post Co sees what you told us. It is emailed to support@goodpostco.com and kept in our own records, and no creator or subscriber can see it.

Our processors, listed below, each doing one job for us.

Nobody else. We do not sell your information. We do not share it for anyone's advertising, including our own. We do not trade it, rent it, or hand it over because somebody asked nicely.

We will hand information to a court or a law-enforcement agency if we are legally required to. If that happens and we are allowed to tell you, we will.

If Good Post Co is ever sold or merged, subscriber information goes with the business, and the buyer is bound by this policy until they give you notice of a new one.

The companies that help us run this

Each of these handles a specific piece, under a contract that limits them to doing that piece for us:

Stripe, Inc. — payments, card storage, receipts, tax calculation, and paying creators. Stripe holds your card details; we do not. Sales tax depends on where the mail is delivered, so Stripe is given the mailing address to work it out, including a gift recipient's address, and keeps it as part of the tax record.
Cloudflare, Inc. — hosting, the database the site runs on, protection against attacks, and the check on the subscribe page that stops automated sign-ups. Your name and address sit in a Cloudflare database in the United States.
Resend (Plus Five Five, Inc.) — sending our emails. They handle your email address and the content of the email.
Google LLC — the mailbox behind support@goodpostco.com. If you email us, that email is in Google Workspace.
An address-checking service, once we add one, to catch typos before an envelope is printed. We have not chosen it yet; when we do, this list will name it before it sees a single address.

We keep this list current. A company that leaves the list stops receiving anything about you from the day it leaves.

How long we keep it

Your mailing address is deleted 90 days after your membership ends. That is the period your club is set to; a club can choose a different one, and this sentence shows whichever one applies to the club whose page you are reading. When the time is up, the address and every previous address on your record are deleted, and the address printed on each past envelope is stripped out of the mailing history. The fact that a mailing happened stays, because it is a business record. Where it went does not. The copy Stripe holds for working out the tax on renewals is deleted at the same time. The one exception is Stripe's record of the tax already charged, which notes the address it was worked out from and is kept with the payment and tax records below.

Your name and email address stay while you have an account, so you can sign in, see your receipts, and rejoin without starting over. Ask us to delete them and we will, subject to the records below.

If you signed up for a club's updates, your address stays on that club's list until you stop them. After that we keep only the note that you stopped, so you are never sent another. A sign-up nobody confirmed is deleted after 30 days.

If you joined a club's waitlist, you stay on it until you leave (the link at the bottom of any email from the club) or join the club, which takes you off it. A waitlist sign-up nobody confirmed is deleted after 30 days.

If an email to you bounced for good, or you marked one as spam, we keep your address on a list so that no club sends you updates again. It stays there until you ask us to take it off.

Payment and tax records — what was charged, when, the tax, the refund — are kept for seven years. Tax authorities can ask us to produce them, and a record we deleted is not a defence.

If you start a checkout and do not finish it, the address you typed is deleted 7 days later. By then the payment page has long expired and no payment can still arrive.

Sign-in links work once, expire soon after they are sent, and are deleted within a day of expiring. Sessions end when you sign out.

If you bought the guide, your order (the name, email, amounts and download count above) is a payment and tax record and is kept for seven years like the others. Your copy is made fresh each time you download it and is not stored by us at all. Download links stop working after 30 days or a refund.

What you told us when you asked about running a club is kept while we are talking with you about it. At least once a year we go through what we hold and delete what we no longer need. Ask us to delete it sooner and we will.

Your rights

Wherever you live, you can ask us to:

tell you what we hold about you, and give you a copy;
correct anything that is wrong;
delete your information, except the payment and tax records above;
stop emailing you anything that is not about a membership you have.

Email support@goodpostco.com from the address on your account. We answer within 45 days, and usually within a few. We may need to check it is really you, which we do by emailing the address on the account — we will never ask you for a password, because there isn't one, and we will never ask you for card details.

Asking costs you nothing and changes nothing about your membership. We do not treat people differently for exercising a right.

If you are in California, the rights above are your rights under the California Consumer Privacy Act, as amended. The categories we collect are identifiers (your name, email address and postal address), commercial information (what you bought), and records of what we mailed you. We collect them for the purposes listed under "Why we hold it". We do not sell personal information and we do not share it for cross-context behavioural advertising — not for money, not for anything else, and we never have. We do not collect sensitive personal information, so there is nothing to limit the use of. You may use an authorised agent; we will ask them for proof.

If you are in Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, or another state with its own privacy law, you have the same rights, through the same email address, answered the same way. There is no profiling and no targeted advertising here to opt out of. If we turn you down, you can appeal by replying to our answer, and we will look again and tell you why in writing.

Children

Good Post Co is not for children. Nobody under 13 may be a subscriber, and we do not knowingly collect anything from a child under 13.

A club bought for a child is bought and managed by an adult. The adult is our customer, the adult's email address is the one on the account, and the only thing we hold about the child is a name and an address to put on an envelope.

If you believe a child under 13 has given us information, email support@goodpostco.com. We will delete it, close the membership, and refund whatever has not been mailed.

How we keep it safe

Everything travels over an encrypted connection.
There is no card data to steal, and no password to guess.
Sign-in links are stored as one-way fingerprints, are good for one use, and expire quickly.
Your address is shown only where somebody is actually addressing mail. It is never written to a log, never in an error message, and never in an export that did not ask for it.
One club's data cannot be read from another club's pages. The database enforces that, not just the code around it.
Staff access is limited to the people who need it, and looking at a creator's studio as that creator is recorded every time.

No system is perfect. If information about you is taken in a way that could harm you, we will tell you and the authorities we have to tell, without unnecessary delay and within the time the law where you live requires. We will tell you what happened, what was taken, and what we are doing about it, in plain language.

Emails you get from us

Everything we send about a membership you hold — receipts, renewal notices, failed payments, address confirmations, your mail going out — is part of the service and does not have an unsubscribe link, because turning them off would mean charging you without telling you.

Anything else — a club's updates, news, an offer — only goes to people who agreed to it: a member who left the updates box ticked when they joined (the box says exactly what the club will send) or turned updates on in their account, or somebody who signed up on a club's page and then confirmed by pressing the button in our email. Every one of those has a link that stops them immediately, and stopping them never changes your membership.

We don't record whether you open an update or click a link in one: there is no tracking pixel and no redirected link. We do learn, from our email provider, when an email to you could not be delivered or was marked as spam. After either, your address goes on a list that stops every club sending you updates (see how long we keep it, above).

When this changes

We will post the new version here with a new version date. If a change matters to you — if it changes what we collect, who sees it, or how long we keep it — we will email you before it takes effect.

Complaints

Write to us first: support@goodpostco.com, or Sendero Origen, LLC d/b/a Good Post Co, 3126 S Boulevard St #154, Edmond, OK 73013. If we cannot sort it out, you can complain to the attorney general of your state.