Your privacy.

Your drafts are private and temporary.

Choosing a PDF first opens it on your device. When you select “Save & add addresses,” the file is uploaded to private Cloudflare storage. Addresses and email are saved when you select “Save & review.” These records are used only to let you preview and resume your letter. Saving a draft does not send it to a printing company.

Postal address checks are optional during preview.

Choosing “Check both addresses” sends the saved street, unit, city, state and ZIP for the recipient and return address to Lob’s live address-verification service. It does not send your PDF or collect a payment. Suggestions are saved with your private draft and applied only when you accept them. An unavailable check never marks an address as verified. Postal confirmation does not identify the recipient or guarantee delivery.

Optional provider tests use sample data only.

Choosing “Create test print proof” sends your PDF and both addresses to Lob’s test service, which renders a print proof without printing or mailing. Opening test checkout sends your saved email and test order amount to Stripe. Stripe’s payment fields send payment details directly to Stripe; OffToPost does not receive card numbers. Use only non-sensitive sample documents, fictional addresses, and test payment details.

Proof-only test records expire with your draft. Opening checkout creates a separate, immutable order snapshot and a separate copy of the document. Deleting the draft does not delete that order or erase records already created at Lob or Stripe. Those providers retain their own test records under their policies. Stripe scripts load only when you open test checkout and may process device, connection, and fraud-prevention information.

You control your saved drafts.

Each draft expires 24 hours after its original upload; editing does not extend that time. Access stops at expiry. An hourly cleanup removes expired documents and details; a storage lifecycle rule also removes leftover PDF files after two days, with provider processing delays possible. Use My drafts to delete a document sooner. Deleted drafts cannot be restored. Keep your own copy of anything important.

Orders have a separate retention period.

Unpaid checkout documents and contact details are kept for 24 hours. After a verified test payment, the order document, mailing addresses, email, and private receipt previews are kept for up to 30 days. Unresolved fulfillment or cancellation issues can extend document retention while support investigates. Access to normally expired documents stops immediately; scheduled cleanup removes the stored copies. Minimal order history, provider references, payment/refund status, and operations audit records are kept for up to 90 days in this test service. Provider retention is separate.

Contact [email protected] to request earlier removal of a resolved order’s document and contact details. Removal does not cancel an order or erase records held by Lob or Stripe. Do not email the document itself.

A private cookie remembers this browser.

An essential, HTTP-only cookie gives this browser access to its drafts for up to seven days. It contains a random access token, not your name, address, email, or document. The server stores only a hash of that token. Drafts still expire after 24 hours. Clearing cookies removes your access but does not delete a saved document immediately. Delete drafts first, especially on a shared device. Private order links can grant access on another device and create a separate seven-day order cookie. These links are secrets: anyone with one can access its order. The link token is read from the URL fragment, exchanged securely, and removed from the address bar. Links expire with the order record and can be revoked by support. Confirmation emails are currently preview-only.

Limits help protect the preview.

We limit upload size, page count, active drafts, and request frequency. Daily, keyed hashes of connection addresses are used for temporary abuse counters; the application does not store raw IP addresses in those counters. Expired session records and counters are removed by the scheduled cleanup. Provider backups and operational logs may follow separate provider retention schedules.

When enabled, Cloudflare Turnstile checks new draft sessions to reduce automated abuse. Cloudflare may process device and connection information for this security check. Owner operations use a separate private login, a two-hour session cookie, and an audit trail for support actions. Order references alone do not grant access.

A small amount of demo data stays in this tab.

Earlier versions created demo orders. If you used one, session storage may still hold an anonymous reference, page count, illustrative price, and creation time. It does not contain your name, addresses, email, filename, or document. Up to ten demo orders are kept, generally until you close the tab. Browser session restoration may preserve them. You can remove them here.

No advertising cookies or analytics scripts.

This application does not install advertising cookies or general website analytics. Optional Stripe checkout may use its own security and fraud-prevention cookies. Fonts are served with the website. The hosting provider may process connection information, such as IP addresses and request logs, to serve and protect the site. URLs and anonymous demo references may appear in browser history or hosting logs.

Before real mailing begins.

OffToPost is a service from Dhoble Labs, operated as a sole proprietorship. Questions and privacy requests can be sent to [email protected]. There is no phone support. Real payments, physical mailing, and outgoing transactional emails remain disabled. We will update this notice before live processing or materially changing data use. This notice describes the current test service.