Privacy policy

Information we collect

When you create an account, we store your name, email address, an account identifier and a hashed password. We store the travel content you save: destinations, travel dates, visits, trip plans, saved and personal places, notes, captions and photos. These records are linked to your account. Travel history can describe countries, cities and specific places you visited or plan to visit.

Optional country welcome notifications use device location services, including background country detection when you grant Always permission on iPhone or Allow all the time on Android. Apple (iPhone) or your Android device’s geocoding provider processes a location to identify the country; geocoding may use a network service. Android requests approximate location and uses low-frequency network/passive updates, not a continuous GPS service. Passportsy does not upload these coordinates to its server or save a location trail. Only the most recently detected country is kept on this device; turning welcomes off or signing out clears it. Notifications may display the detected country on your lock screen according to your device settings. No visit is created automatically. If you choose photo-date suggestions, camera dates are read on your device; suggested dates and itinerary places are saved only when you confirm them. GPS metadata is not used for these suggestions. Uploaded photos are optimized and original camera metadata is removed; the original upload is not retained.

If you contact support, we receive your email address and the information you choose to send. Please do not send passwords, sensitive travel documents or unnecessary personal details.

How we use information

We use information to provide and secure your account, organize and synchronize travel records, display your passport and map, manage shared trips, save photos, provide exports and answer support requests. We do not sell personal information, use it for advertising, or track you across other companies' apps and websites. This version has no advertising or third-party analytics SDK.

On iPhone, optional Face ID or Touch ID uses Apple’s authentication system, with device-passcode fallback. Passportsy does not receive biometric templates or store your account password on the device. When enabled, a separate device sign-in credential is protected in this iPhone’s Keychain and requires device authentication to read. The server stores only its hash, an app-generated device identifier, its account association and expiry. Signing out revokes the current session and clears downloaded app data, but keeps this explicitly enabled device sign-in so you can use Face ID again. Choose Forget this device to revoke and remove it. Password resets and account deletion revoke saved device sign-ins. Server sessions renew with successful use; device sign-in credentials renew when used to sign in. Both expire after 90 days without their respective renewal.

On Android, optional biometric sign-in requires a supported strong fingerprint or face authenticator. A separate sign-in credential is encrypted with an Android Keystore key requiring biometric authentication for each use. Biometric templates remain with Android. Android uses the same server device-grant, expiry and revocation rules described above. Password sign-in removes the previous locally enrolled biometric access so another account cannot inherit it. If biometrics become unavailable, the lock screen offers password sign-in after an explicit warning that downloaded trips and unsent memories on that phone will be discarded. You may cancel to preserve them. Your account password is never saved by the app.

Shared trips

Personal journal records and unshared trips are private to your account. A trip owner can invite an existing Passportsy account by email. Invitations appear inside the app. After accepting, partners can see and edit that trip's itinerary, dates, notes, photos and recap. Account names appear in membership and invitation information. There is no public social feed or public sharing link.

Owners can remove partners and partners can leave. Saved contributions remain in the trip. Removing access prevents future server access but cannot erase copies someone already downloaded. Deleting your account deletes trips you own for every partner. Contributions to someone else's surviving trip remain without your account attribution; text or photos you contributed may still identify you by their content.

Device permissions and storage

On supported browsers, Save for offline stores selected trips, photo thumbnails and queued memories in this browser profile. Saved trip data is encrypted with a non-exportable key kept in the same browser storage; this is not a device lock and anyone using the profile can open downloaded trips. Use a personal device. Clearing site data or browser storage eviction can remove unsent memories. The offline service worker caches only public app files, never account API responses. Signing out clears downloaded trips and account drafts after a warning about unsent work; browser sign-out requires connectivity to revoke the session.

Camera and photo-library access are used when you choose to add photos. You can manage permission in device Settings. The iOS app stores its session and downloaded-trip data using Keychain and encrypted local storage. Android stores sessions and downloaded data in encrypted, no-backup app storage protected by Android Keystore. Android country-welcome preferences and the latest country are kept locally and excluded from cloud backup and device transfer. Network requests to Passportsy use HTTPS. Passwords are hashed. No security measure can guarantee absolute protection.

Offline copies and unsent drafts stay on the device until you remove them or clear the app's data. Successful account deletion clears saved app data on the device used for deletion. Other devices lose server access, but their offline copies cannot be remotely erased. Exported or shared copies remain under the control of their recipients.

Service providers and international processing

Our application server is hosted by Hostinger in Boston, United States. Hostinger's server backups for this service are stored in the United States. Your information may be processed outside your home country. Hosting and email providers process information needed to run and protect their services; we may also disclose information when required by law or necessary to protect users and the service.

The current website , iOS build 0.5.3 (3) or later, and Android 0.6.0 (14) or later serve destination photographs and fonts as local app assets. Earlier builds may request images from Unsplash and fonts from Google, disclosing network information such as IP address to those services. Photographer/source links and other external links open third-party sites only when you follow them. Those sites have their own policies: Unsplash, Google and Hostinger.

Retention and deletion

We retain active-account records to provide the service until you remove them or delete your account. Some individual-record removal uses soft deletion, so deleting an account is the way to request removal of all private account records. In Settings & privacy, choose Delete my account, enter your current password, type DELETE and confirm. Export anything you want to keep first. If that control is unavailable in your version, use the website or contact us.

Account deletion removes the account, sessions, private records and owned trips with their photos from the active database. Shared-trip contributions are treated as described above. Passportsy-managed database backup and migration copies expire after 14 days, checked hourly. Hostinger separately keeps two rolling weekly server backups, which may include those copies. Under normal operation, deleted information may remain in these backup layers for up to 30 days. Backups are restricted to recovery and are not used to provide ordinary account access. Recovery must reconcile deleted accounts before the service is reopened.

Passportsy does not retain routine request logs or container output logs. Deployment diagnostic files expire after 14 days. Shared hosting infrastructure may retain operational or security information under its own service policies. Support correspondence is retained as needed to resolve and document your request or meet legal obligations; contact us to request its deletion.

Your choices and rights

You can edit records, manage trip access, download photos, and use Export my data in Settings & privacy for travel records and photo metadata. You can request access, correction, deletion or a copy of your personal information by contacting us. Depending on where you live, you may also have rights to restrict or object to processing, withdraw permission where processing relies on it, or complain to your local data-protection authority. We verify account ownership before acting and respond within applicable legal time limits.

Children

Passportsy is intended for people aged 13 and over and is not directed to children under 13. Contact us if you believe a child under 13 has provided personal information so we can investigate and remove it.

Contact and changes

Contact Keating Software Development at peter@cosmocrafts.net for support or privacy requests. We will update this policy and its effective date when practices change and provide additional notice when required.