Privacy Policy
Last updated October 3, 2026
This is written in plain language to describe what Marlow actually does today. It was written by the Marlow team, not a lawyer, and will be reviewed by one as Marlow grows. If anything here is unclear, email hello@marlow.social.
Who can use Marlow
You must be at least 13 to create an account. Marlow isn't directed at children under 13, and if we learn an account belongs to someone under 13 we'll delete it.
What we collect
- Account: your email address, username and password. Passwords are hashed by our authentication provider (Supabase); we never see them. If you sign in with Google, Google shares your email address, and your name and profile photo if your Google account has them.
- Your page: display name, bio, status, photos (avatar, backgrounds, gallery), colors, fonts, interests, your anthem song and any social handles you add.
- What you post: wall posts and comments, Feed posts, guestbook signatures, journal entries and reactions.
- Friends and messages: friend requests and friendships, your Top 8, and direct messages.
- Postcards: the cards you send and receive, including their design and message. Photos on Polaroid postcards are stored privately: only the sender and the recipient (after it arrives) can open them.
- Postcard links: if you send a postcard as a link, anyone who has the link can read that card until someone keeps it. After that, only you and the person who kept it can read it. Unkept links expire after 30 days.
- Page visits: when you're signed in and visit someone's page, that person can see you in their recent visitors.
- Spotify (optional): if you connect Spotify, we store the connection needed to show your currently playing song. We don't read your playlists or history.
- Purchases: if you buy Marlow Plus, Stripe handles the payment. We receive a confirmation that you paid; we never see or store your card number.
- Safety: who you've blocked, and reports you send about other users.
- Notifications: if you turn on push notifications, your browser's push address; and your email preference for activity emails.
Analytics and error reports
We use two services to understand how Marlow is used and to fix bugs. We've set both up to collect as little as possible:
- PostHog (analytics): counts things like page views, sign-ups and which features get used, so we know what's working. Session recording is turned off, so it never records your screen, messages or journal. Visitors who aren't signed in stay anonymous.
- Sentry (error reports): when something crashes, it sends us the error and the page it happened on. We've turned off collecting IP addresses, cookies and request details.
Before anything is sent to either service, private codes in web addresses (postcard links, invite and saved-spot codes, sign-in codes) are removed in your browser. Analytics events are kept for up to a year and error reports for up to 90 days, under each provider's retention settings.
Who we share it with
We don't sell your data, and we don't show ads. We use these providers to run Marlow, each only for its job:
| Provider | What it does for Marlow |
|---|
| Supabase | Database, sign-in and file storage |
| Vercel | Hosts the website |
| Stripe | Payments for Marlow Plus |
| Resend | Sends activity and account emails |
| PostHog | Product analytics (see above) |
| Sentry | Error reports (see above) |
| Google | Optional "Continue with Google" sign-in |
| Spotify | Optional "now playing" on your page |
What other people can see
Marlow is built around public pages. Your page, wall, Top 8 and social handles can be seen by anyone with the link, unless you've blocked each other. Direct messages are visible only to you and the friend you're messaging. Journal entries and Feed posts are visible as described where you post them. You choose who can mail you postcards (everyone, friends or nobody) in your settings.
Your choices
- Edit or remove anything on your page at any time.
- Block anyone; you become invisible to each other.
- Turn activity emails and push notifications on or off in settings.
- Disconnect Spotify at any time.
- Delete your account from your profile settings. This permanently deletes your profile, posts, friendships, messages and uploads right away, except for copies kept briefly in backups.
- Depending on where you live, you may have the right to access, correct or get a copy of your data. Email us and we'll help.
Security
Marlow uses database rules so people can only read what they're allowed to, encrypted connections (HTTPS) everywhere, and private storage for postcard photos. No system is perfectly secure, so please use a strong password you don't use anywhere else.
Changes
If we change this policy in a way that matters, we'll update the date at the top and tell you in the app.
Contact
Questions, data requests or concerns: hello@marlow.social.