Who we are
Cheernote is a postcard service operated from Karachi, Pakistan. You pick a design on thecheernote.com, write your message, and we print the card, hand-paste a postage stamp on it and post it to whoever you're sending it to. We're not an e-card site, so there's real paper, a real stamp and a real address involved — and that's why this page is more specific than most.
We run our own database rather than renting space on someone else's shop platform, so the details described below sit in systems we control.
For anything to do with privacy — a question, a correction, a request to delete something — email support@thecheernote.com. That's our only support channel; we don't have a phone line, so email is the quickest way to reach a person here. You'll also find us on Instagram as cheernote_postcards, though please don't send personal details there.
When you're just browsing
You can look at every card design, browse the postage stamps and read about gift cards without telling us anything at all. We don't ask for a name or an email to let you look around, and we don't build a profile of what you clicked.
Our web host delivers the pages to your browser, and like any web host it handles the technical request details needed to do that. We're not running advertising trackers, and we don't pass anything about your visit to ad networks.
If you open an account
An account is optional for browsing and required to check out — you'll need to sign in before you can pay. It's also what lets you keep drafts, addresses, favourites and reminders between visits. If you open one, here's what we hold:
- Your first name, last name and email address, plus a phone number if you choose to add one.
- How you sign in: email and password, a one-time code sent to your email, or a sign-in you already hold with another provider if you choose that option.
- Your address book — a label for each entry, the recipient's name, two address lines, city, region, postal code, country, and which address is your default.
- Your favourites: which card designs you've saved.
- Your drafts: the design you chose, the occasion, the message you've typed so far, and a thumbnail of how the card looks.
Drafts exist so you can walk away mid-message and come back to it. The words in a draft are yours — nobody else using the site can read them.
You can change your email address and edit or delete any of this yourself from your dashboard.
When you order a card
Here's the honest bit: to print and post a card, we need the recipient's details as well as yours. A card can't be delivered without a name and an address on it, and it can't be printed without the message you wrote. There's no version of this service that works without both.
For each order we store the design you chose, the occasion, the recipient's name and postal address, the message you wrote, the amount, the currency, the time you placed it, and where the order has got to. If you added a gift card or used a discount code, we store that too. Discount codes are checked on our server rather than in your browser, and that check involves nothing beyond the code itself.
Once the card is printed, your message is ink on paper. It travels inside a sturdy case envelope, so the postal service sees the address on the outside, not what you wrote.
If someone sends a card to you
This is the unusual part of running a postcard shop: we hold details about people who have never visited our site. If a friend sends you a Cheernote, we hold your name, your postal address and the message they wrote to you — because they gave those details to us so we could print and post your card.
We use them for that card and for sorting out anything that goes wrong with its delivery. That's all. We don't add recipients to our newsletter, we don't build a marketing list out of them, and we don't share them with anyone beyond what's needed to get the card to your door.
If the card carries a gift card, it's printed onto the card as a QR code. Scanning it starts the redemption steps for that brand. Anything you hand over to redeem the gift card goes to that brand, under their own privacy policy, not to us.
Received a card and want your details removed? Email support@thecheernote.com with your name and the address the card arrived at, so we can find the right record. If a card is already in the post we can't recall it, but we can clear your details from our records afterwards.
Reminders
Reminders are the nudge that stops you missing a birthday. For each one we store the person's name, the occasion (or your own label for it), the day and month it falls on, whether it repeats every year, how many days' warning you want (seven unless you change it), any notes you added, and whether notifications are switched on.
Worth saying plainly: we store the day and the month, not the year. There is no date of birth in our database, because posting a card doesn't require knowing anyone's age.
Reminder emails go out through our email provider. You can edit or delete any reminder, or turn its notifications off, from your dashboard.
Paying for your card
Your card number is typed into secure fields provided by our payment provider, and it goes straight to them. It doesn't pass through our website's code and it never reaches our database.
What we keep is the unglamorous part: the amount, the currency and the provider's reference for the payment. When they confirm the money has arrived, they tell our site and we mark your order paid.
We couldn't lose your card number, because we never have it. The only payment details in our records are the amount, the currency and the payment provider's reference.
How we keep it safe
Rather than promising you we take security seriously, here's what's actually in place:
- Every table in our database has row-level security switched on. Your rows can only be read and written by you, not by other customers, and that's enforced by the database itself rather than by our website code remembering to be careful.
- Admin sign-in is by one-time code only, and only for email addresses on an approved list. There's no admin password sitting around to be guessed or stolen.
- Admin actions are written to an audit log, so there's a record of who did what.
- Card details never touch our systems, so there's no card data here to lose in the first place.
- Most records are removed by marking them deleted rather than being wiped on the spot, so an accidental deletion can be put right.
No setup is perfect, and we'd much rather hear about a problem than not. If something looks wrong or insecure to you, email support@thecheernote.com.
If something goes wrong
If something happens to the details we hold — a breach, a mistake at our end, a card sent to the wrong address — we'll tell the people affected what we know, what it means for them and what we're doing about it. We'd rather apologise plainly and early than stay quiet and hope.
How long we keep things
The principle is simple: we keep something for as long as we need it, and not longer.
- Order records — kept while we need them for our accounts and to answer questions about a card we've already sent.
- Drafts, favourites and saved addresses — until you delete them, or until you ask us to close your account.
- Reminders — until you delete them.
- Newsletter records — if you unsubscribe, we keep the fact that you unsubscribed, so you aren't added back by mistake.
- Recipient details — removed whenever a recipient asks; otherwise they stay attached to the order for that card.
If you want your account closed, email support@thecheernote.com and we'll do it. We may need to keep a bare record of orders you've already paid for, because that's part of our accounts, but it won't be used to contact you.
What you can ask us to do
You don't need to give a reason for any of these. Email support@thecheernote.com and tell us what you'd like:
- See what we hold about you.
- Correct anything that's wrong — most of it you can fix yourself in your dashboard.
- Delete your account and the details attached to it.
- Get a copy of your details in a form you can take somewhere else.
- Stop the newsletter, or turn reminder emails off.
- Object to something we're doing with your details, and have a person genuinely look at it.
- If you received a card rather than sent one: have your name and address removed.
Please write from the email address on your account where you can. It helps us be sure we're talking to the right person before we hand anything over or delete it.
Children
Cheernote isn't aimed at children. Ordering means paying for something and giving us a postal address, so accounts are for people old enough to do that. We don't knowingly collect details from children, and if you think a child has opened an account, email support@thecheernote.com and we'll remove it.
A child's name will sometimes appear as a recipient — a birthday card for a six-year-old is a perfectly normal thing to send. We treat those details exactly like any other recipient's: used for that one card, and removed if a parent asks us to.
Changes to this page
We'll update this page when what we do changes — a new email provider, a new payment method, a new feature that stores something we haven't described here. When we do, we'll update the date shown at the top.
If a change actually matters to you, we'll say so clearly rather than quietly rewriting a sentence. The version you're reading is the one that applies right now.