Privacy policy · Updated October 22, 2026
Postboy is a personal letter service at postboy.kumaw.at. Its browser extension brings an animated courier to the websites you use when a letter arrives.
The service stores the names or nicknames you provide, mailbox membership, letters, replies, attached images or PDFs, letter timestamps, and read status. The extension retrieves your mailbox, including letter contents and attachment information, to show unread mail and open the right letter.
Your connection code contains a private mailbox key and the address of your Postboy server. The extension stores that connection, a mailbox cache, delivery history, and your quiet-mode preference in your browser profile. The server stores a hash of the mailbox key. Treat your connection code like a password.
The server temporarily uses connection IP addresses to limit mailbox-creation attempts. Hosting and network providers also process connection information needed to deliver the service.
Postboy places its own courier and envelope on ordinary HTTP and HTTPS pages. It uses browser tab identifiers to deliver to the active tab and avoid interrupting a courier during an extension update.
It does not read the text or forms of other websites, collect your browsing history, or record your activity on those websites. While the courier is visible, pointer coordinates are used momentarily on your device so his eyes can follow your cursor. Those coordinates are not recorded or sent to the server.
Mailbox data is used to pair two people, deliver and display their letters, handle replies, prevent duplicate courier entrances, and show unread counts. Optional browser notifications announce waiting mail on pages where overlays are unavailable.
Postboy does not sell personal data, use advertising trackers or analytics SDKs, or use your letters to train AI models. Your mailbox is accessible through its private connection keys. Your paired person can read the letters in the shared mailbox.
The hosted service runs on a Hetzner server. Its operator and hosting provider can have access to stored data when operating the service. Letters are not end-to-end encrypted. The hosted website uses HTTPS for data in transit.
If you connect the extension to a different Postboy server, that server's operator and privacy practices apply to the data it hosts. The extension's local website-access behavior stays the same.
Installing through the Chrome Web Store also involves Google and your browser's extension distribution services. Their own privacy policies apply to registration, installation, and update checks.
Letters and attachments remain on the server until the operator deletes them or the mailbox. There is no automatic expiration period. Disconnecting or uninstalling the extension does not delete your server mailbox or letters.
To remove the extension's local data, open its connection settings and choose Disconnect this extension. To request deletion of data on postboy.kumaw.at, contact the developer using the contact information on Postboy's Chrome Web Store listing. Do not post your connection code publicly. For a self-hosted mailbox, contact that server's operator.
Updates to this policy appear on this page with a new date. For privacy questions, use the developer contact information on the Postboy Chrome Web Store listing.