Privacy Policy

• Version: privacy-2026-09-draft
• Effective date: [EFFECTIVE_DATE]
• Applies to: the Passport website and web app, and the private cloud sync behind a Passport account.
• Questions: [SUPPORT_EMAIL]

The short version

• Your diary is private. There are no public profiles, no feeds, no likes, no comments and no sharing features in Passport.
• Without an account, nothing you log leaves your browser.
• With an account, your entries, notes, place snapshots, photos and preferences are stored for you so they reach your other devices.
• Cloud sync is private but not end-to-end encrypted. See What “private, not end-to-end encrypted” means.
• We do not sell data, we do not run advertising, and we do not track you across other websites or apps.
• You can export everything as a file at any time, and delete your account yourself.

Two ways to use Passport

On this device only

Choosing Continue on this device keeps Passport entirely in your browser. Entries, places, photos and preferences are stored in this browser's IndexedDB database, and small conveniences (unfinished drafts, recent place picks, your chosen mode) in local storage. No account is created and nothing is uploaded.

Two consequences are worth knowing: the diary lives in this browser only, so clearing site data or losing the device loses it unless you exported a backup first, and it cannot reach your other devices.

With a Passport account

Creating an account means we store a copy of your diary so it can sync between your devices. That copy is private to your account. Row-level security in the database scopes every read and write to your own user id, and photo files live in a private storage bucket that is only reachable through short-lived links issued for your account.

You choose which mode you are in, and signing in never uploads a device-only diary by itself — Passport asks first and shows you what it would import.

What we store when you have an account

Account and sign-in. Your email address and a hashed password (or the details of the sign-in link you used), kept by the authentication service. We also record the versions of this policy and of the Terms you accepted and when, plus a display name, locale and timezone if you set them.

Your diary. Entries with their title, notes, dates and status (visited, planned or bucket list), and a snapshot of each place you log: its name, country and region codes, and its coordinates. Coordinates are part of an entry; a place you log is a place we store.

Photos. Images you attach. They are re-encoded in your browser before upload, which drops EXIF metadata including camera details and GPS coordinates, and are stored as a full-size and a thumbnail file in the private bucket.

Preferences. Map palette, metric, layer toggles, onboarding state and similar settings, so a new device looks like your last one.

Sync and device metadata. To merge changes between devices without losing anything, each record carries a version and a timestamp, deletions leave a tombstone, and your account has a change feed with a sequence number. We also keep short-lived mutation receipts (an id per batch of changes) so a retried request is not applied twice. This metadata describes when records changed, not what you did with the app.

Service logs. Our hosting and database providers keep ordinary request logs: timestamps, IP address, user agent, the endpoint called, the response status and a random correlation id. The correlation id lets us trace one failing request when you report a problem. Logs are retained for [LOG_RETENTION_DAYS] days.

Error reports. When something breaks, Passport can send a technical error report (stack trace, browser and app version, route name, correlation id) to our error monitoring service. Reports are scrubbed of personal data before they are sent — entry text, notes, place names, coordinates, photos and search terms are not included — and session replay is switched off, so no recording of your screen is ever captured.

Performance measurements. We collect privacy-safe web vitals — timings such as how long the page took to become interactive, tied to a route name like /welcome rather than to you. They contain no identifiers, no location data and no content.

What Passport never does

• No advertising, and no advertising or marketing cookies or pixels.
• No selling or renting of personal data, and no sharing for cross-context behavioural advertising.
• No tracking of you across other websites or apps.
• No analytics that read your entries, notes, photos, coordinates or search text.
• No profiling of your travels, and no automated decisions with legal or similarly significant effects.
• No public profiles, feeds, likes or comments — there is nothing in Passport that publishes your diary.

What “private, not end-to-end encrypted” means

Your data is encrypted in transit (HTTPS) and encrypted at rest by our storage providers. It is not end-to-end encrypted: the servers hold the keys, which is what makes features like sync, backup and account recovery possible. In practice this means Passport and its infrastructure providers are technically capable of reading the content of your account, and we may do so only where it is necessary — for example to investigate a fault you reported, to keep the service secure, or where the law requires it.

If you would rather no server ever held a copy of a particular trip, use Passport on this device only, or keep that trip out of the app.

Where your data is stored

Passport is built on a small number of providers, each acting as a processor on our behalf:

• Supabase — the account database (managed PostgreSQL), authentication, and the private storage bucket that holds your photos.
• Vercel — hosting and content delivery for the website and app.
• Sentry — error monitoring, receiving the scrubbed technical reports described above.
• [EMAIL_PROVIDER] — transactional email only: confirming your address, resetting a password, notifying you that a security-relevant setting changed. No marketing email is sent.

Data is processed in the regions those providers are configured to use, and may therefore be transferred internationally. [Counsel: confirm the transfer mechanism and the regions before this goes live.]

Place search

If your copy of Passport is configured with an optional map search provider, the text you type into the place search box is sent to that provider so it can suggest matches. Nothing else goes with it — no entries, notes, photos, coordinates you have logged, or account identifiers. Without a provider configured, search runs entirely against the place list bundled with the app, offline.

How long we keep things

• Your diary, while your account exists. Entries, places, photos and preferences are kept until you delete them or delete your account.
• Deleted records. When you delete an entry, a place or a photo, it is removed from your diary immediately and a tombstone stays in the change feed so your other devices delete their copy too. Tombstones, change feed rows and mutation receipts are purged after 30 days.
• Account deletion. Deleting your account removes your database rows, the photo objects in storage, and the authentication user itself. Devices that were signed in lose their cached copy when they next sign out or are removed manually.
• Infrastructure backups. Our providers keep backups for operational recovery, which may contain copies of deleted data for up to [BACKUP_RETENTION_DAYS] days before they expire.
• Logs and error reports. See the retention stated for each above.

Your choices and your rights

• Export. Settings → Backup writes a .travelog file: a ZIP containing your entries as JSON and your photos as image files. It works in both modes and needs no account.
• Correct. Every entry, place, note and photo can be edited or deleted in the app.
• Delete your account. Account → Danger zone → Delete account. You confirm with your password; the deletion removes your rows, your photos and your sign-in.
• Delete a device-only diary. Settings → Danger zone → Delete everything.
• Switch modes. You can use Passport without an account at any time.

Depending on where you live, you may also have statutory rights of access, correction, deletion, portability, restriction or objection, and the right to complain to a supervisory authority. Write to [SUPPORT_EMAIL] and we will help. [Counsel: complete this section with the rights, response windows and identity checks that apply in the jurisdictions we serve, and name the controller and any representative.]

Cookies and local storage

Passport sets no advertising, marketing or analytics cookies, and uses no third-party trackers. What it does use is strictly necessary to make the app work:

• Local storage for your session token when you are signed in, your chosen mode, unfinished drafts and recent place picks.
• IndexedDB for the diary itself when you use Passport on this device only, and as an offline cache for your account.
• A service worker cache so the app opens offline after the first visit.

Because none of this is used for advertising, analytics or profiling, there is no consent banner to click through. Clearing site data in your browser removes all of it.

Children

Passport is not directed at children, and an account may not be created by anyone under [MINIMUM_AGE]. If you believe a child has created an account, write to [SUPPORT_EMAIL] and we will delete it.

Security

Accounts are protected by the authentication service's password hashing and short-lived access tokens; every database statement is scoped to your own rows by row-level security; photos are served from a private bucket through links that expire. No service can promise perfect security, but a breach affecting your data would be handled under our incident process and notified where the law requires. [Counsel: confirm the notification wording and timelines.]

Changes to this policy

When this policy changes we will update the version identifier at the top, show the new version in the app, and — for changes that matter to you — ask you to accept it or tell you by email before it takes effect. The version you accepted is recorded with your account.

Contact

Questions, requests or complaints: [SUPPORT_EMAIL].