Privacy

Effective November 10, 2026

Who we are

Show & Tell Prints (“we”, “us”) is run by Crystal Bay Creative, LLC, 106 W 3rd Ave, Suite 101, Trappe, PA 19426, USA. We run online shops for schools, teams, churches, clubs and other groups, each at its own web address, where anyone can order photo cards, holiday cards and photo prints. We take the order and the payment, print it on our own printers in Pennsylvania, and mail it or deliver it. This policy covers every one of those shops and showandtellprints.com. Grams for the Fam, which we also run, has its own policy at gramsforthefam.com.

What we collect

For a card

• Your photo, exactly as it is on your phone, including what is stored inside the file: usually when and where it was taken and the camera.
• Your message (typed, or a photo of a note you wrote) and how you sign it, and an optional voice note of up to 60 seconds.
• Who it goes to: each recipient’s name and mailing address. We check addresses with USPS records through Smarty before you pay. For holiday cards that can be a whole list, typed in or emailed to us.

For prints

• Your photos as they are on your phone, how you framed each one, and how many copies.
• Mailed prints: the name and address you give in Stripe’s checkout. Dropped off with the group: the name for the envelope and the place it goes (a classroom, say). If it’s a child’s name, a first name is plenty.

About you

• Your email address, from Stripe’s checkout, or earlier only if you ask us to save a card for later. Your name, for the receipt, and printed where you sign a card.
• Signing in. There are no passwords. We email you a one-time code and link that work once, for 30 minutes, and set one cookie on that shop that keeps you signed in for up to 90 days. It does nothing else.
• Technical information. Our servers and Cloudflare, which carries our traffic, see your IP address and basic details of each request, in logs used to keep the service running and secure. We count page views with our own copy of Plausible, which sets no cookies and keeps no personal identifiers.

What is printed on the back

A card’s back carries your message and signature, the QR code, and, if the photo says where and when it was taken, a small map with the town and the date. A print’s back carries the place and the date it was taken. Both say which shop they came from. You can turn the map and place off for a card, and for each print. We never print a street address from your photo. Anyone holding the card or print can read its back.

The card page

Every card has a QR code linking to its own page, which shows the photo and the message and plays the voice note. There is no sign-in: the long random code in the link is what protects it, so anyone who scans the card or is sent the link can see and save the photo and hear the voice note. The recipient can leave a reaction or a reply there, which we keep with the card.

The photo page for a print

Every print has a QR code on its back linking to a page with that photo. As with a card, there is no sign-in; the random code in the link protects it, so anyone holding the print can open it. At checkout you choose whether they can save the photo and order more prints of it (the default) or only see a smaller copy. Sign in with the email you ordered with, on that page, to change your mind or to remove the photo: the page then says it was removed and we delete our copy of your upload straight away. The printers’ copy goes with the order’s print files (below).

Shops for schools and groups

• What the group sees. Not your photos, your email address or what you paid. A shop’s page can show a running total of what it has raised, and we tell the group what it has earned. Neither says who bought what.
• Drop-off. The envelope carries the name and place you gave us with the group’s address, and anyone there who handles it can read that label.
• Your details stay with us. Ordering doesn’t sign you up to the group’s mailing list; we don’t give the group your details.

How we use it

To make, print and deliver your order; to email you about it (the receipt, a link to a card you saved, a reminder if you leave one unfinished, and news that it’s on its way); to show you your past orders when you sign in; to help you if something goes wrong; and to keep our records for tax and accounting. Before a card is mailed we photograph it, front and back, as a record of what was sent. If you’ve ordered from a shop, it may email you before a holiday; every one has an unsubscribe link that stops them for good.

Who else sees it

The servers and database that hold orders are our own. Beyond them, these companies handle your information on our behalf:

• Stripe: the checkout, payments, refunds and sales tax. It receives your payment details, email, address and order total.
• Cloudflare: stores the photos, voice notes and print files, and carries all traffic to and from our sites.
• Smarty: checks recipient addresses against USPS records and suggests them as you type. It receives the address only.
• Postmark: sends our emails. It receives your email address and the message.
• OpenStreetMap services: to name the place and draw the map on a back, we send the photo’s coordinates, and nothing else, to OpenStreetMap’s map and place-name servers.
• EasyPost and USPS: for postage and delivery. They receive the name and address on the envelope.
• Slack: our own team chat, where we get a note when an order comes in.

Otherwise we share information only with the people you send cards and prints to, through what is printed on them and the card page; when the law requires it or to protect someone’s safety; or with a buyer if Show & Tell Prints is sold, who would remain bound by this policy. Orders from our shops for schools and groups are not shared with Meta or any other advertiser.

How long we keep it

• Cards. The photo, message and voice note are kept for as long as the card exists, so its QR code keeps working years later. Ask, and we’ll delete them; the QR code will then lead nowhere.
• Prints. The photos you upload are kept with your order, so the QR code on each print keeps working, until you remove them on the photo page or ask us to delete them; the code will then say the photo was removed.
• Print files. The copies we print from, and the photographs of finished cards, are deleted 30 days after the order is mailed; the 30 days let us reprint anything lost in the post.
• A card you saved for later and never sent is deleted 60 days after you last touched it. Addresses you asked us to save stay until you delete them.
• Order records (what was bought, what was paid, where it went) are kept as long as tax and accounting law requires.

Your choices

Email [email protected] from the address you ordered with to get a copy of what we hold about you, or to have photos, voice notes, orders, or everything deleted. Records that live in Stripe’s systems are covered by Stripe’s own policy.

Security

Photos are in private storage; our own tools reach them through signed links that expire. Card details never touch our servers, and sign-in codes are stored only in scrambled form. No system is perfectly secure; if something goes wrong that affects you, we will tell you.

Children

Our shops are for grown-ups ordering for their families. We don’t knowingly collect information from children under 13, except a first name a parent gives us for a drop-off envelope.

Changes

If we change this policy we’ll update the date at the top, and email recent customers about anything significant.

Contact

Crystal Bay Creative, LLC (operating as Show & Tell Prints)
106 W 3rd Ave, Suite 101, Trappe, PA 19426
[email protected]