Last updated 5 November 2026
The short version
- Postmark has no account, no ads and no tracking, and it carries no analytics or advertising code from anyone else.
- Your photos are read on your iPhone and never uploaded. Your passport is kept on your iPhone and in your own iCloud.
- To name the places in your photos and draw maps, the app asks Apple’s maps service and a public elevation service about those places. These requests carry places, not who you are.
- It sends a few anonymous counts, with no identifier. You can switch them off.
- A friend card goes only where you send it, and the passport page that opens it keeps nothing.
Who we are
Postmark is made by Loopware LLC (“we”, “us”). This policy covers the Postmark app for iPhone and the website trypostmark.com. For anything about privacy, write to [email protected].
What Postmark reads on your iPhone
All of this is read and kept on your iPhone. None of it is sent to us.
Your photos, if you allow it
For each photo or video: the date and place it was taken, its altitude and speed, its type, whether it is a favourite, and how long a video lasts. From these Postmark finds your trips, the countries and places you were in, and makes stamps and films. Photos are never uploaded. The app keeps small copies of a few on your iPhone: thumbnails of photos you pick, the motion of Live Photos in films, and pictures for your bucket list.
What a photo shows, for films
When it makes a film, the Director looks at photos with Apple’s on-device Vision framework, for example to find faces so that they are not cut off. It never identifies anyone, and nothing it sees leaves your iPhone.
Your home
Postmark works out where you live from where your photos are taken, on your iPhone, and keeps it in a file that is left out of iPhone backups. Your home is never shown, named or sent: only its country counts, as Lived.
Your calendar, if you ask
Only if you choose Flights in your calendar: Postmark reads event titles and places on your iPhone and keeps only the flights it finds.
Files you bring
Google Maps Timeline, flight lists (such as Flighty or FlightRadar24), Polarsteps and pasted lists are read on your iPhone.
The camera, when you scan
To read a friend’s passport code or the text of a real passport stamp. Nothing is recorded or sent. A picture of a stamp you scan is kept in the app.
Your location, if you allow it
To check that you are at a stamp station you scanned, and for arrival stamps, which are off unless you turn on Stamp a new country when I arrive. Location is checked on your iPhone; only the country and the day are kept, and never anything within 1 km of your home.
What leaves your iPhone
| What | Who receives it | When and what |
|---|---|---|
| Place names | Apple, through its maps service in iOS | Automatically, when the app reads your library: the centre of each stop of a trip (trips at least 50 km from home, and outings 10 to 50 km away), and up to 60 points near borders and coasts each time it runs, rounded to about 200 m and never within 1 km of home. The answers are kept on your iPhone. Apple’s privacy policy applies to these requests. |
| Maps and satellite pictures | Apple Maps | When you open a trip’s map, place photos that have no location, set your home on a map, or open a country’s stamp page (which shows a satellite picture of the country; the app also fetches this for your newest countries). The request is for the area shown. Pictures are kept on your iPhone. |
| Elevation tiles | Amazon Web Services, which hosts the public Terrain Tiles dataset | When a film needs the real ground of a trip, and to draw some stamps from the ground they show (only on Wi-Fi or another network that is not metered). Each request is for a map tile of an area about 10 km across, with no identifier. Tiles are kept on your iPhone. |
| Your passport backup | Your own iCloud account, at Apple | After each change, while you are signed in to iCloud. It holds your counting choices, your countries, stamps and their dates, records you imported (including one position from Google Maps Timeline for each stay), answers to border checks (keyed by places rounded to about 200 m), your profile (the name you set, ratings, places you want to go, companions’ names and dates) and friends’ cards. Films are not included. It is kept in iCloud’s storage for Postmark, which we cannot read. |
| Photos in iCloud Photos | Apple | If your library is kept in iCloud Photos, iOS downloads a photo’s original when the app needs it, under your iCloud settings. |
| Purchases | Apple (the App Store) | When you buy or restore Postmark Pro. Apple handles payment; we receive no name, email or payment details. The app checks your purchases on your iPhone. |
| Anonymous counts | Our counts service, on Cloudflare | A handful of events with no identifier, described below. You can switch them off. |
| A friend card | Whoever you send it to, through the app you choose | Only when you tap Send my card or show your code: the name you set, a random passport number, the day the card was made, your countries with the year you first went and, unless you turn Months off, the months you were there (never for the country you live in), your count, the list you count by and your cover. The app or service that carries the link can see it. |
| Films and pictures you share | Wherever you send them | Only what you choose to share, under that service’s own policy. Text that goes with a share can include a link to trypostmark.com. |
The anonymous counts, in full
- At most once a day: that the app was opened, with the days since it was installed (in bands), the app version, the iOS version, a broad class of iPhone and the language.
- Once each: your first film, first export and first share, with how they were made (for example the look and the shape of the film, or where it was shared).
- When they happen: the Pro offer being shown, an export that fails and why, how long a film took to render, a tap on printing, and a postcard sent.
- About your passport, once a month and only after your whole library has been read: a band for how many countries you have, and a yes or no for one territory picked at random; from January to March, a band for last year’s new countries. Each answer is randomised on your iPhone before it is sent (the true band is sent only about a third of the time, and the territory’s answer is flipped one time in four), and the same answer is sent again each month, so the reports cannot be added up into the truth about you.
- No identifier of any kind goes with them: no account, no device or advertising identifier, no cookie. Our service keeps only daily totals of each event and does not read or store IP addresses. Like any request on the internet, it passes through Cloudflare’s network on the way.
- At most once a week the app also downloads one file of figures, the same for everyone, to compare your passport with other travellers’.
- To stop them: You → Privacy → Anonymous counts. The switch is on when you first install Postmark; turning it off stops the counts and the passport figures, and empties any that are waiting to be sent.
The passport page on this website
A card’s link (trypostmark.com/c or /p) opens a page that shows the passport. The passport is read from the part of the link after the #, which browsers never send to a server. The page loads nothing but itself and its world map, keeps nothing, sets no cookies, has no analytics and sends no referrer. Our host sees an ordinary request for the page, without the passport in it.
This website
trypostmark.com sets no cookies and has no analytics, trackers or third-party code: its fonts and pictures are served from this site. It is hosted by Cloudflare, which processes each request (including your IP address and browser) to deliver the pages and to protect them from abuse. We have not turned on any analytics or log storage. Links to TestFlight and the App Store take you to Apple.
What we don’t do
- No account, sign-in, email address or phone number is needed.
- No ads, no advertising identifier, no tracking across apps or websites, no data brokers.
- We don’t sell or share personal data.
- No third-party analytics or crash-reporting code. If you allow it in iOS Settings, Apple shares crash reports and usage figures with developers under Apple’s own terms.
Your choices
- Permissions. Photos, Calendars, Camera, Location and Notifications can be changed at any time in iOS Settings → Postmark. Postmark works with limited photo access and with none (you can add countries by hand).
- Anonymous counts. You → Privacy → Anonymous counts.
- Arrival stamps. Off unless you turn them on. To be sure the app uses no location at all, set Postmark’s Location to Never in iOS Settings.
- Delete all data. You → About → Delete all data removes your passport, the films kept in Postmark, your settings, any counts waiting to be sent, and the copy in your iCloud. Films you saved to Photos stay there. Some stored lookups (place names, map tiles, country pictures) stay on your iPhone until you delete the app; deleting the app removes everything it kept on your iPhone. Purchases stay with your Apple Account.
- Your rights. We hold no account or personal data about you on our servers, so there is nothing for us to look up, correct or delete. If you write to us, we use your email only to answer you.
Children
Postmark is not directed at children under 13 and does not knowingly collect information from them.
Changes
If this policy changes, the new version is published here with its date before it takes effect.
Contact
Loopware LLC, [email protected]. For help with the app, [email protected].