I'm not in the target market, but https://sendsocial.com/how_it_works doesn't really say explicitly that the sender address cannot be read from the barcode. Obviously, most humans cannot read barcodes, but that's not very good security.

This does require a bit of thought to solve, since you most likely don't want to discard the return address. A bit of crypto can solve this, but that puts quite a bit of work on the delivery service.

(On an unrelated note, what's with forcing every page to https? It doesn't hurt, but it's a bit wasteful.)