I take online privacy pretty seriously in general, so it's important for me to get it right with Pastcards.
For a start: Pastcards will never sell or otherwise share your details with anyone else. Period.
Pastcards stores the minimum amount of information necessary for each user that is needed to provide the service. Pastcards doesn't even retain user email addresses — Stripe, the payment service, requires it, but it's not held in any Pastcards database.
With that in mind, here's a list of the services, components and data transactions that make up Pastcards which you might want to know about if this stuff is important to you.
- All connections from your browser to Pastcards are secured with HTTPS.
- Pastcards runs behind a CloudFlare proxy. This means that your browser communicates with CloudFlare's servers over HTTPS, and those servers communicate with Pastcards, also over HTTPS. CloudFlare's privacy and security policy is here.
- Pastcards itself runs on Google Container Engine in a data centre in Belgium.
- Pastcards itself stores the following information for each user:
- a token and user ID provided by Instagram, allowing access to a user's photos.
- a customer token provided by Stripe, allowing charges to be made to a user's credit card.
- a mailing address for the postcards.
- this information is held in a few Google Cloud SQL databases in the same data centre in Belgium.
- connections from Pastcards to the databases are made using the Secure Socket Layer (SSL) protocol.
- Google encrypts data when it's stored, transmitted across internal networks and backed up.
- all tokens and mailing addresses are encrypted by Pastcards before they're even transmitted to Cloud SQL.
- Pastcards uses Google Analytics to gather statistics on visitor numbers and which pages are getting hit on the site. This is so I can see what kind of visitor numbers the site is getting and get an idea for use patterns so I can improve things that don't work so well.
So there you go. This isn't that unusual a patchwork of interactions for a service like Pastcards; most sites and services you use every day will have a set of data requirements and third-party services at least to this level — Pastcards is small fry compared to many properties out there on the internet. Essentially, you have to be willing to trust CloudFlare, New Relic, Google and me. Hopefully this is enough information for you to make an informed choice.