Privacy policy

Last updated: October 29, 2026.

VRCPostcard runs on your PC. It reads VRChat's local log and your photos folder, and uses OSC. It never reads VRChat's memory.
Webhook URLs, Discord access and keys are stored encrypted on your PC (DPAPI). They are never sent to our servers.
Photos you share by DM or chatbox are uploaded to Catbox, 0x0.st or ImgBB (depending on your settings) and stay there under each service's rules. vrcp.app only stores the short link to the photo.
"Send logs" sends an anonymized report that you review before sending. It is stored in our database and deleted after 30 days.

The contact form stores your name, email and message so we can reply. They are deleted 90 days after the conversation is closed.
To prevent abuse we count submissions per day using a hash of your IP that changes daily; we don't store the IP.
We use no tracking cookies or third-party analytics.

Payments are processed by the provider you choose, on their own site. We only receive the amount, the date and, if you leave them, your name and message.

Write to us from the contact page to ask us to delete your data.