Postel

Appearance

ThemeSystemLightDark

System follows your device. Saved in this browser.

Privacy policy

Effective: 1 October 2026

Postel is operated by GENFORGE (OPC) PRIVATE LIMITED (“we”, “us”). This policy covers our mobile apps, linked browser app, website and administrator dashboards. Our initial app-store release is intended for India.

Information we handle

• Account and profile: your verified email address and/or phone number, name, username, optional profile picture, account identifiers and enterprise memberships. Some identifiers are stored in hashed or encrypted form; this does not make them anonymous.
• Messages and shared content: messages, attachments, voice notes, reactions, replies, group information and delivery/read status. Private messaging uses end-to-end encryption. The service stores and routes encrypted content and associated delivery metadata.
• Link previews: when a message containing a web link is displayed, the app can send its URL to Postel to retrieve a title, description and thumbnail. This URL is visible to our preview service even for an end-to-end encrypted chat. The service fetches the page without your website cookies or credentials, so the linked website sees the service’s network address rather than yours for this preview. Preview metadata is cached briefly in memory. Opening a link connects your browser to that website under its own privacy policy.
• Enterprise announcements: large enterprise announcement groups use server-managed delivery, with encryption in transit and storage protection, rather than end-to-end encryption. Their messages and attachments are processed by our servers. Do not assume every enterprise group uses the same encryption model.
• Profile and directory information: names, usernames and profile pictures are available to people who can find or communicate with you. Enterprise directory information can include work email, phone, description and role/policy information supplied by your organization.
• Contacts: with contact permission, the app reads phone-book information to find Postel users. Contact discovery processes lookup information on our servers. You can deny contact access and switch off “Find me by phone number” in Settings; phone discoverability defaults on for new accounts.
• Location: only when you choose to share a location pin or live location. Live sharing can update while the app is in the background where supported and permitted. Recipients can retain information you share. Map previews and external map services can receive coordinates and network information needed to display a map.
• Calls and devices: call participants, timing, state and duration; device identifiers, public cryptographic keys, linked-device records, push tokens and authentication/session information. Voice and video media are encrypted in transit, including when relayed. We do not provide server-side call recording.
• Operations and support: IP addresses, request/security logs, error information, reports, appeals, administrator audit records, and information you send to support.

Why we use information

We use information to verify accounts, provide messaging and calls, deliver notifications, discover contacts, administer enterprise membership and policies, prevent abuse, respond to support and deletion requests, and meet applicable legal obligations. Camera, microphone, photos/files, contacts, notifications and location permissions support the features you choose. Denying a permission may prevent that feature from working.

Who receives information

Your correspondents and group members receive content you share. Enterprise administrators manage membership, invitations, enterprise profiles and policies and can see relevant administrative activity. Dashboard access does not by itself grant general access to private end-to-end encrypted conversations. Your organization may have its own privacy and acceptable-use notices.

We use Amazon Web Services for hosting, storage, email and SMS delivery, Firebase Cloud Messaging for Android notifications, and Apple Push Notification service for iOS notifications. Telecom carriers process SMS delivery. Map providers and external apps receive information when used for previews or when you open content with them. Infrastructure is primarily hosted in AWS Mumbai; provider operations and global content delivery can process information outside India. We may disclose information when legally required, to address abuse or protect safety, or in a business transfer subject to appropriate protections.

Postel does not use advertising trackers or sell personal information. Essential browser storage and cookies keep you signed in and store linked-browser state. We do not use marketing cookies on these website pages.

Storage, retention and security

We use access controls, encryption and device/session authorization. Private encryption keys are held on your devices. End-to-end encryption does not protect messages displayed on an unlocked screen or copies saved by recipients. Screenshot restrictions vary by platform and cannot prevent every capture.

Retention depends on the data and feature. Account and enterprise records remain while needed to provide the service. Delivery/media storage has expiry and cleanup mechanisms; the production media bucket currently has a 30-day object-expiry policy. Local chat copies can remain on devices until deleted or expired. Disappearing-message timers are optional and do not erase copies independently retained by recipients. Operational logs normally have 30-day retention; rolling database backups can persist for up to 35 days. Expiry processing and provider cleanup may not be instantaneous.

Deletion does not remove every shared record: minimal deleted-account markers, public verification history, relevant enterprise/audit or abuse records, and information needed for legal or security purposes may remain for those purposes. We do not promise immediate erasure from backups or other people’s devices.

Your choices and requests

You can manage notification previews, contact permission and discoverability, location sharing and linked devices in the app. You can request access, correction or deletion of your information, or raise a privacy concern, by contacting admin@genforge.co. We may ask you to verify ownership before acting. We never need your OTP, authenticator code or private encryption keys in a support email.

To delete your account, use Settings → Delete account or follow our account-deletion request instructions. Enterprise removal and full account deletion are different actions.

Children and updates

Postel is not designed or marketed specifically for children. Contact us if you believe a child’s information has been provided without appropriate authorization. We may update this policy as the service changes; the current version and effective date are published here.

Contact

GENFORGE (OPC) PRIVATE LIMITED
Privacy and support: admin@genforge.co