A personal card should stay personal.

Guest cards and essential cookies

You can try 20 artwork generations without signing up. Essential signed cookies keep your guest cards and free-generation allowance available in this browser for up to 120 days. These cookies remain when you sign out so signing out does not reset the trial. Signing in claims your guest work and its generation history for your account. These guest identifiers are not used for advertising.

What we store

We store the artwork, exact message, recipient details, and approval records needed to prepare and support your card. If you sign in, we store your verified email and generation/payment history so you can recover your cards and use the 20 free generations that renew after each paid card order. Google sign-in requests only identity and email; it does not request Gmail or contacts. If you choose email updates for an order, we use your verified email to send its status and support updates through AWS SES. You can turn updates off on that order page; an email already being sent may still arrive. Emails do not include card artwork, private wording or delivery addresses. Early-access emails are stored only when you submit the signup form. Include only the information needed for your card.

How we use it

Card content is used to render the card and operate the service. We do not use recipient addresses for marketing or build recipient profiles. Mail This does not train models on card messages or artwork.

Optional catalog sharing

Approving a custom card does not publish it. If you separately opt in, a copy of the original artwork and your public catalog title enter our private review queue. Only artwork approved by the operator appears in the public catalog for others to reuse. Your card message, recipient details, and original prompt are not included. Do not submit images that contain private details. You can withdraw a submission from your card while you have access; this stops future catalog use but does not remove copies already used in other cards.

Optional website analytics

In eligible U.S. states, Website analytics starts on by default unless you have declined. Elsewhere, including when your location is unknown, it starts off until you enable it in Cookie preferences. Google Analytics measures public-page visits and, when configured, checkout starts and Stripe-confirmed purchases. Purchase reports include generic product categories, currency, amount excluding tax, tax separately, a pseudonymous transaction identifier and an anonymous browser/session identifier. Card content, recipient details, account emails and payment credentials are excluded. Google browser scripts run only on reviewed public pages; purchase reporting is sent from our server. Google Ads attribution is enabled only when Advertising measurement is also allowed; Google Signals and ad personalization remain disabled. Cookie preferences stores your choice for 180 days. Saved opt-outs are respected. Regional defaults are recorded separately from an explicit choice and rechecked when you load the website. Declining stops future reporting, including queued events, and removes analytics cookies; it does not erase data Google already received.

Optional advertising measurement

Advertising measurement covers Google Ads, TikTok, Meta (Facebook and Instagram), OpenAI (ChatGPT ads), and AppLovin. It starts on by default in eligible U.S. states unless you have declined or your browser sends Global Privacy Control. Elsewhere, including unknown locations, we ask before enabling it. Older advertising grants do not automatically authorize newly added providers; eligible regional defaults are recorded separately. You can turn either measurement category off in Cookie preferences at any time. Accept all enables both configured categories unless your browser privacy signal keeps advertising off. When configured, we report checkout starts and confirmed purchase amounts using generic product categories, currency, anonymous event identifiers, advertising click and browser identifiers when present, and browser/network information including IP address and user agent. These providers can use the permitted signals to measure advertising. When Advertising measurement is allowed, Google Ads receives validated advertising click identifiers and Stripe-confirmed card purchase amounts through our server, including guest checkout. Available buyer email, phone number and billing names are normalized and SHA-256 hashed before reporting; billing country and postal code are sent in the format Google requires. Card recipient information is never used for matching. Google Analytics attribution additionally requires Website analytics. We do not enable Google ad personalization or Google Signals. Meta receives only the website origin as the source URL, never private checkout or order links. When Meta advertising measurement is allowed, checkout starts can include a SHA-256 hashed buyer email supplied for the current saved card or from the buyer’s verified signed-in account. Guests who first supply their contact details in Stripe provide those matching fields on confirmed purchase instead. An optional browser pixel can measure reviewed public-page visits when separately configured; no advertising script runs in private editors or account/order pages. For confirmed Meta and AppLovin purchases, we briefly load their SDKs in a separate, sanitized receipt document containing only public commerce details and permitted hashed buyer identifiers. Browser and server reports share a deduplication ID. Our server advertising events do not include card wording, private artwork, prompts, recipient details, raw account emails or payment credentials. OpenAI Automatic Advanced Matching is enabled on reviewed public pages: its pixel may detect and hash contact information you enter in public-page forms, such as a newsletter email, and use it to match activity. Hashing does not make that information anonymous. The OpenAI pixel does not run on sign-in, account, card editor, checkout or order pages. OpenAI receives public visits, checkout starts and confirmed card purchases; generation-pack purchases are excluded from its card sales goal. AppLovin receives reviewed public-page and product views, successful catalog card starts (reported as add-to-cart), checkout starts and Stripe-confirmed card purchases, including subtotal, tax and zero additional shipping cost because postage is included. When advertising measurement is allowed, we also send Meta and AppLovin normalized SHA-256 hashes of the buyer’s Stripe checkout email and phone number (when supplied) with the confirmed purchase for matching. Meta also receives normalized SHA-256 hashes of the Stripe buyer name and billing city, state, ZIP code and country when supplied. Facebook Login ID and date of birth are not collected for advertising. Public catalog design identifiers and public product images describe the purchased card; private customer artwork is excluded. Raw checkout contact details are not included in this advertising payload; hashing makes it pseudonymous, not anonymous. Recipient details and card content are excluded. Pending matching hashes are encrypted. These identifiers also work for guest checkout without a Stripe Customer or website login. Browser-return hashes are removed after the SDK queues the event or within 48 hours if the browser never returns; a slow or blocked SDK may retry the same event identifier up to three times; server-reporting hashes are removed when reporting finishes or is skipped. Generation-pack purchases are excluded from its card sales goal. Its public-page pixel may detect and hash contact information entered in public forms for matching. It does not run on sign-in, account, card editor, checkout or order pages. We opt our OpenAI measurement events out of future user-level personalization. Your browser choice lasts 180 days. Global Privacy Control disables this advertising reporting. Cookie preferences lets you withdraw consent for future collection and queued events; it cannot delete data already sent. First-party attribution and matching information is encrypted and removed after 30 days without activity. Delivery retries stop within 47 hours; completed delivery records keep only non-sensitive event identifiers and status. New permission does not revive events from an earlier consent choice.

Optional Google Customer Reviews

After a confirmed physical card purchase, Google may display an invitation to review your shopping experience. To show that invitation, we share the buyer’s checkout email, order identifier, delivery country and estimated arrival date with Google. Google sends the survey only if you opt in. We do not send your card artwork, wording, recipient name or street address to this review service. Generation packs and simulated orders do not receive review invitations.

Keeping it private

Stored card records and image files are encrypted. Preview links expire, and access to card and order records is checked against the owner. Payment details are entered directly on Stripe’s secure checkout page.

Your account data

From My cards, open your account to download your account details, card messages, order records, saved designs and available artwork. Downloading requires a recent sign-in. Expired images may be unavailable. The ZIP contains private messages and delivery addresses, so keep it somewhere private. We stream the archive to your browser without storing an extra copy on our servers. Downloading does not delete your account or change your orders.

Card storage and permanent sending records

Card artwork, print files and previews are kept for 120 days: from creation for unused uploads and unsubmitted cards, from saving for private saved designs, and from the first confirmed mailing for ordered cards. Orders closed without mailing use the closure date. Active orders, unfinished prepaid cards and open support cases retain the artwork needed to complete the work. Artwork separately submitted for the shared catalog remains while awaiting review or published. Declined or withdrawn catalog artwork follows the 120-day period from creation. Other active references can extend storage; already deleted images cannot be restored by saving or opening a support case. Sending records are retained permanently for auditing, including order identifiers, recipient and delivery details, the approved message and composition references, payment and refund records, approvals, and status history. Expiring artwork does not delete these records. Account and generation/payment records also preserve entitlement history. Retired images become inaccessible; backup copies may remain temporarily under the storage backup lifecycle. Contact support to request account deletion or discuss privacy rights. Permanent sending and financial audit records are retained as described above.

Third-party services

After you enter the To and From names for a new website card, we prepare a first wording draft using its occasion, greeting recipient name, selected design title and, for your custom artwork, the description used to generate that artwork. This context is sent to OpenAI. When you use a tone or length button, your current wording and requested adjustment are also sent to OpenAI. Custom feedback you enter in the writing helper or supply through the API is sent as well. Delivery addresses and account details are not sent. The helper provides up to 300 successful drafts per card without sign-in; failed requests do not count, and writing does not use image credits. Suggestions and usage records stay with your private card. The first draft fills the editor after you submit the names. You can edit or replace it, undo a rewrite, and approve the final wording before printing. Existing edited cards are not automatically rewritten. When you request custom artwork on this website, your visual description and selected style are sent to OpenAI to generate the image. We do not include recipient addresses or your separately entered card message in that generation request. Before a card can proceed to checkout, its front, inside and back preview images and exact printed wording are sent to OpenAI for content screening. The screening request excludes delivery addresses, private generation prompts and account details; personal details that you include in the printed card itself are necessarily included. Flagged compositions are held for merchant review. Screening decisions and any review response are stored with the card, without duplicating the message or images in general logs. Google verifies Google sign-ins. AWS SES delivers requested sign-in codes; signing in does not subscribe you to marketing. Your AI assistant has its own privacy policy. Using Mail This does not grant it access to your other cards or private address books. Private merchant reports use aggregate counts of card creation, orders, generation and support activity. Those reports omit customer identities, card content and delivery addresses. Optional Google Analytics, Google Ads, TikTok, Meta and OpenAI advertising measurement are described above. Measurement follows the regional defaults and saved preferences described above. We estimate only country and state from your IP using a local DB-IP database to select these defaults; this lookup does not send your IP to a geolocation service. Location can be inaccurate, particularly with a VPN. You can always turn measurement off through Cookie preferences. Unknown locations use opt-in settings.

Saving a card by email

At checkout, your card and a private resume link are saved automatically. If you choose Save for later and provide your email, we send the link and up to two reminders, at 24 and 72 hours while the card remains unpurchased. Reminder wording can include the recipient name and occasion you supplied. You can stop reminders from any of these emails. Private links let their holder access only the saved card, so keep them private. Artwork follows our existing 120-day retention period. The email address, recipient details, wording, and private links are not included in saved-card advertising events.

Printing and mailing

We send the approved four-page card artwork, recipient name and confirmed delivery address to Cardly to print and mail your card. Cardly also receives our merchant return details. We retain supplier references and status updates with your sending record. Contact support for questions about a mailed card or your data.

Checking delivery addresses

The address you enter for a live order is sent to Google Maps for validation. We request only the mailing details, without your name or card message. We automatically check completed addresses. If a correction is needed, you review and accept the suggested address before it is used for your card. You approve the delivery details and total when continuing to payment. We retain your confirmed delivery details and our confirmation event with the sending record. Unconfirmed suggestions stay in browser memory for up to 15 minutes and are not saved in our database. Address checks do not guarantee delivery. Use a real address when checking; fictional test addresses must stay in the sandbox.

Address checking is subject to the Google Maps/Google Earth Additional Terms of Service. See the Google Privacy Policy for how Google processes this information.

Facebook sign-in and data removal

If you choose Facebook sign-in, we use its account identifier to connect your MailThisNow account. We verify your email ourselves when you first connect. We do not request your posts, friends, photos or advertising account. Facebook credentials stay on the server and are discarded after sign-in.

You can disconnect Facebook from your account page and continue signing in by email. To request removal of your Facebook connection or eligible account data, email support@mailthisnow.com from your account email. We verify the request before making changes. Sending and audit records are retained permanently; disconnecting Facebook does not erase orders or cancel them.

Contact us

MailThisNow is operated by Topps Solutions LLC.

For help with your account, a card, or a privacy request, email support@mailthisnow.com. For an existing order, you can also open a support request from its order page.