Lantern Post
A card is between two people.
That’s the whole design. Here is exactly what we keep, what we count, and what we will never do — in plain language, because the promise only works if you can read it.
We count lanterns, not lives.
To know whether Lantern Post is working, we keep simple tallies. Here is all of them — the complete list, not a sample: a card was created · a link was shared · a card was opened · a lantern was tapped · the light burst played · a reveal was clicked · a song preview started · a light was passed on, and completed · a step of the card-maker was viewed, and completed. Eleven counters. Nothing more. We never log or analyze what a card says, which reveal was chosen by whom, or who received what.
The one number shown back to a sender: the secret manage link a sender may keep shows an anonymous count of how many times their card was opened — no who, no when. Nobody is ever notified. That is why Lantern Post sends no read receipts: nothing is pushed to anyone; the count only sits behind a link the sender chose to hold.
We never email your recipient.
Lantern Post has no way to email the person you’re sending to. There is no “send it for me” — you copy your card’s link and share it yourself, in your own text or your own email. No recipient address is collected, stored, or transmitted, because none is ever requested. The only emails Lantern Post sends are a sign-in link, to whatever address is entered on the sign-in form, and our own operator alerts. It never emails a card recipient.
Recipients are never tracked. Ever.
If someone sends you a light, you are a guest here. No account, no cookies, no fingerprinting, no being asked who you are. When you open a card, an anonymous counter on that card ticks up by one. That is the entire footprint of your visit.
Your words stay yours.
The personal touches you write — your P.S. line, your name if you sign it — are message content between you and one other person. We store them for exactly one purpose: rendering your card. They are never analyzed, never fed into metrics, never in our logs.
Senders: the minimum for the service.
If you send cards, we keep your email (so the magic sign-in link has somewhere to go) and the cards you’ve made. That’s the list. Ask us to delete it and we will.
What we check instead.
The scrutiny goes on the links, not on you. Every reveal destination is verified against a strict allowlist and checked for safety before it can travel, and rechecked when it’s opened. The link you send never carries the destination — it opens the card.
No ad trackers. No cookies. The only site measurement is a cookieless, anonymous page-view counter on our public pages (home, blog, how-it-works) — how many visits, from where in the world, never who. It cannot identify anyone or follow anyone across the web, and it is switched off entirely on card pages: a card stays between two people. No selling, sharing, or “partners.” If any of this ever changes, this page changes first — as it just did for that counter.