Privacy policy
Last updated: October 14, 2026
Penround is made by The Open Apps, Inc., a Delaware corporation ("we", "us"). This policy covers the Penround plugin in ChatGPT, the website penround.ambientapp.ai, the cards people sign and receive there, and the printed keepsake books we sell. It explains what we collect, why, who receives it, how long we keep it, and how it is deleted.
The short version
- A card holds only what its organizer and signers choose to write: names, messages and optional photos.
- Every message waits for the organizer's approval before the recipient sees it. Signers never see each other's messages or photos.
- An automated safety check reads every message and photo. Sexual content can never go on a card.
- ChatGPT sees signers' names and message numbers, never the messages or photos themselves.
- We never sell data, show ads or send marketing email. The recipient gets one email: the card.
- Card messages and photos are deleted 12 months after the card is sent.
What we collect
| What | Where it comes from | Why we need it |
|---|---|---|
| Card details: the occasion, the recipient's name, the title, the from line, the organizer's name and note, the theme and the signing deadline | The organizer, through ChatGPT or the card view | To show the card to signers and the recipient and to print the book |
| Messages and signer names | Signers, on the sign page; the organizer, through ChatGPT or the card view | To put them on the card and, if ordered, in the book |
| Photos added to messages, and a cover photo | Signers and the organizer | To show them on the card and print them. When a photo arrives we save a new copy without its hidden details, such as where and with which phone it was taken. |
| The recipient's email address and the "From" name | The organizer, typed into the card's own form (never into the chat) | To email the card at the chosen time |
| A scrambled (hashed) form of a signer's IP address | The signer's browser | To stop misuse of sign links |
| A scrambled (hashed) form of an address that asked not to get cards | The recipient, through the link in the email, or a spam complaint | So we never email it again |
| Card, message and order numbers | Created by us | To keep cards, messages and orders together |
| A scrambled (hashed) form of the anonymous user ID that ChatGPT sends with each request | ChatGPT | So your cards are shown only to you, in any chat. We never receive your name, email address or chat history from ChatGPT. |
| Your approximate country, time zone and language, if ChatGPT shares them | ChatGPT | To send the card at the time you mean and to show book prices for your country. We keep the time zone with your card, and the country with your order and in technical logs. |
| Book order details: recipient name, delivery address, email address, phone number, number of copies, amount paid and payment status | The buyer, at checkout on our website (collected for us by Stripe) | To take payment, print and ship the book and email the buyer about the order |
| Reports about a message | Whoever reports it | To review and remove content that breaks our rules |
| Support messages: your name, email address and message | You | To answer you |
| Technical logs: the time, the page or tool used, and errors. For requests from ChatGPT, also the language and app type ChatGPT reports, your approximate country, scrambled (hashed) forms of the user, conversation and workspace IDs ChatGPT sends, and card, message and order numbers and counts | Your browser or ChatGPT | To keep the service running and secure and to find problems. Logs never contain message text, names, email addresses, photos or file links. |
| Safety-check results: whether a message or photo was flagged, and the category (for example "harassment") | Our automated safety check | To hold or block content before anyone else sees it, and to act on reports |
We don't collect payment card numbers, ChatGPT conversations, contacts or precise location. We don't use messages or photos to train AI models.
About ChatGPT. The organizer runs a card from ChatGPT, where OpenAI handles the conversation under OpenAI's privacy policy. We send ChatGPT signers' names (shortened to 40 characters), message numbers and statuses, and whether a message has a photo. Message text and photos appear only in the card view inside ChatGPT, which the organizer opens.
How we use it
- To run the card: collect messages, show them to the organizer for approval, and show approved messages to the recipient.
- To check messages and photos for abuse before they reach anyone, and to act on reports. Every message and photo, the organizer's own included, goes through OpenAI's moderation service. A flagged message from a signer waits for the organizer to look at it; sexual content, graphic violence and self-harm instructions are blocked and can't be approved.
- To deliver the card by email at the chosen time, or open the recipient's link at that time.
- To print and ship a keepsake book when one is ordered, and to email the buyer about the order.
- To answer support requests, prevent misuse and keep the records that tax and accounting law require.
Who receives it
| Recipient | What they receive | Why |
|---|---|---|
| The organizer | Every message, name and photo sent to their card | To approve or hide each one |
| The recipient | Approved messages, names and photos, the organizer's note and the card details | It is their card |
| OpenAI | Signers' names, message numbers and statuses, the sign link, card details, the recipient's private link when the card is sent as a link, delivery status, book pages and price, and order status, tracking links and delivery dates; and, inside the card view, message text and photos for the organizer | So ChatGPT can run the card. OpenAI's moderation service also checks every message, with the signer's name, and every photo, without its location or camera details, for abuse, under OpenAI's API data terms. |
| Postmark (ActiveCampaign, LLC) | The recipient's email address, the organizer's name and the card link; buyers' email addresses and order emails | To deliver the card email and order emails |
| Stripe, Inc. | What the buyer enters at checkout: name, email, phone, address and payment details | To process payment for the book |
| Lulu Press, Inc. | The book's print files, and the delivery name, address, phone and email | To print and ship the book |
| Hetzner Online GmbH | Our servers, database and stored files | Hosting |
We may disclose information when the law requires it, including reports of child sexual abuse material to the National Center for Missing & Exploited Children (NCMEC), or to protect people from harm.
How long we keep it
| Data | How long |
|---|---|
| Card details, messages and photos | 12 months after the card is sent; 60 days after signing closed if it was never sent; 12 months after the last activity if it was never scheduled |
| A card with an ordered book | 24 months after the book is delivered, so it can be reordered |
| The recipient's email address | 30 days after the card is sent, then deleted. If they asked not to get cards, only a scrambled form of the address stays on the block list. |
| Scrambled signer IP addresses | 30 days |
| Reports | 12 months. Material reported to authorities is preserved for 1 year, as the law requires. |
| Book order contact and delivery details | 12 months after delivery; amounts and invoices 7 years for tax law |
| Technical logs | 30 days |
Deleting sooner. The organizer can delete a card at any time from ChatGPT: it is deleted at once, and files are erased within 24 hours. A signer can change or delete their own message with the link shown after signing, until the card is sent; after that, email us. The recipient can hide any message with its Report link. Anyone can ask us to delete their data at support@theopenapps.com.
Your controls. The organizer approves or hides every message, and can stop signing, cancel a delivery that hasn't gone out, or delete the card. Signers change or delete their own message. Recipients report messages and can stop all cards to their address with the link in the email; to undo that, email us.
Children
Penround is not directed at children under 13, and the sign page asks every signer to confirm they are 13 or older. For a class card, ask the parents to sign rather than the children. If you think a child under 13 has given us personal data, email support@theopenapps.com and we will delete it.
Your rights
Depending on where you live, you may have the right to access, correct, delete or export your data, or to object to how we use it. Email support@theopenapps.com and we will answer within 30 days. You can also complain to your local data protection authority.
Cookies and storage in your browser
Penround sets no advertising or analytics cookies. When the recipient opens their card, we set one cookie (pr_…, kept for a year) so that a report from their own browser can hide a message at once. After signing, the sign page keeps the link to change your message in your browser's local storage, on your device only. The checkout page loads Stripe, which sets its own cookies to process the payment and prevent fraud, as described in Stripe's cookie policy.
Security
Connections are encrypted (HTTPS). Photos are served only through signed links that expire, sign and recipient links are long random codes, and the address the recipient's card is emailed to is never sent to ChatGPT. Card payments are handled by Stripe, which is certified to the highest level of the card industry's security standard (PCI DSS Level 1).
Where data is processed
We are based in the United States. Our servers are run by Hetzner Online GmbH. Stripe, Lulu, Postmark and OpenAI may process data in the United States and other countries, each under its own privacy and security commitments.
Changes to this policy
When we change this policy we update the date at the top. If a change affects how we use data we already hold, we will say so on this page before it takes effect.
Contact
The Open Apps, Inc. · support@theopenapps.com