Privacy Policy

Passboards, Inc. (“Passboards,” “we,” “us” or “our”) makes an iPhone app, an Android app and a website (www.passboards.com) that let a group of people put their photos, videos, music and writing from a trip, a party or a club into one shared board. This Privacy Policy explains, in plain language, what information we collect when you use the Passboards apps and website (together, the “Services”), what we do with it, who else sees it, how long we keep it, and the choices and rights you have. It is written to describe what the app and our servers actually do today. If we build something that changes it, we will update this page first. The Android app is on Google Play; where it works differently from the iPhone app, this policy says so.

The short version: we collect what we need to run a shared photo service, plus one thing we hold but do not use yet (the private capture coordinates the iPhone app sends, described in 2(d)). We do not use your phone’s location services, we do not use advertising identifiers, Passboards has no ads today, we do not sell your information and we do not track you across other companies’ apps or websites.

1. Who Is Responsible
Passboards, Inc., PO Box 127, Danville, CA 94526, United States, is the company responsible for your information (the “data controller,” in the words of European law). You can reach us at support@passboards.com.

2. What We Collect

(a) Your account. When you sign up we ask for your name, a username, your email address and a password, and you can add a profile photo, a short bio and your date of birth. Your date of birth is optional, is not shown to anyone, is not used for anything today and is deleted with your account. Sign-in is handled by Firebase Authentication, a Google service. At sign-up your password is sent to our server once so that we can create your Firebase account; we do not store it. If you sign in, or set a new password from a reset link, on passboards.com, the password you type passes through our web server on its way to Firebase; we do not store or log it. Firebase stores your email address and a hashed form of your password, and issues the sign-in token the app uses to talk to our servers. That token, or your passboards.com sign-in, also says whether your email address has been verified (with Sign in with Apple it always is); the first time it says so, we record when with your account, and we use that record only for the founding-member programme (see (j)). Firebase’s code keeps that sign-in on your phone: in the keychain on iPhone, and on Android in the app’s private storage, which is left out of backups and phone-to-phone transfers. Where the iPhone app offers Sign in with Apple, you can use it instead of a password: Apple then gives us your name (if you choose to share it) and either your email address or, if you choose “Hide My Email”, a private relay address that forwards to you, Firebase keeps an identifier for your Apple account, and you choose a username. We do not offer Google sign-in. You confirm at sign-up that you are at least 18. When you sign up on iPhone, the app also asks Apple’s Declared Age Range service whether you are 18 or over. Apple shares only an age range, never your date of birth, and only if you (or whoever manages your Apple Account) agree to share it. If the range shows you are under 18, the app does not create an account; if you decline or no answer is available, your own confirmation that you are 18 or over applies. The app uses the answer only while you are signing up: it is not stored, and it is not sent to our servers. When you sign up in the Android app, the app asks Google Play’s age signals service for your age range. Google shares only a range, never your date of birth, and only where it has one to share and the sharing has been agreed to; Google Play may show its own screen asking you to share it. If the range shows you are under 18, the app does not create an account; if nothing is shared or no answer is available, your own confirmation that you are 18 or over applies. While you are signed in, the Android app reads the same range again without asking when you open the app, normally no more than once a day, and if Google Play reports that the person using the phone is under 18 the app stops working on that phone until that changes. The answer is used only for this: it is not stored, and it is not sent to our servers.

(b) What you post. Boards, the photos and videos you post to them, post titles and captions, music posts (the Apple Music or Spotify link you share and the song, album or playlist details we look up for it; see (p)), text posts (notes and essays, including their titles, body text and any links in them), comments, @mentions and people you tag, likes and saves, follows and follow requests, club memberships, the clubs you share a post with, events and RSVPs, whether an event repeats (how often, until when, and in which time zone), for a club event how many guests you are bringing and whether your Going answer is confirmed, on the waitlist or waiting for a host’s approval, the messages an event’s hosts send to the people going, the dates you set for a board’s event, the order you arrange a board’s posts in, the framing of a board’s cover, the boards you pin and their order on your profile, the order of your club list and the clubs you pin, the look (theme, title style and effect) a host picks for a club or club board, club announcements, photos you send in a club chat and which message a club-chat reply answers, polls you create in a club and your answers to them (see (z)), your answer to “How was it?” about a club event, the posts you share to a club’s roll, a goal a host sets for a club, the name, mark and public address (handle) of a club you create, and any place you choose to attach to a post, board or event. For each club we also keep the time of its latest activity (a chat message, a post, a post shared with the club or an event change), used only to offer the “Recently Active” order of your own club list. Text-post drafts are saved only on your own device until you post: on your phone in the app, and in your browser’s local storage if you write on passboards.com/app, where a draft stays until you post it, discard it or clear the site’s data in that browser. Direct messages are covered in (i).

(c) Your photos and videos, and the files themselves. When you post a photo we make a resized copy (up to 1600 pixels on the long side) to show in the app; videos are re-encoded to a 720p-class copy. Before anything is uploaded the app strips the location, camera and device metadata (EXIF and similar) from the file, so the copies we store and show contain none of it. If you edit a photo before posting, the edit is applied on your phone and only the edited photo is uploaded; we never receive the unedited photo or the settings you chose. If you have Passboards Premium, by subscription or as a founding member, the original file is also kept, metadata-stripped, up to 4 GB per file (see Section 8). The Android app keeps originals only from version 1.0.1, and only where it can take the metadata out without re-encoding the file: for a JPEG or PNG photo you have not edited, up to 40 MB and 50 megapixels, and for a video in a common format (H.264, HEVC or AV1, with AAC sound). Extra data that some phones store inside a photo file, such as a motion photo’s video clip or an HDR gain map, is not kept. For anything else it uploads the standard copy only. The app uploads in the background, so an upload can finish after you leave the app; until it does, the prepared, metadata-stripped copy waits in the app’s storage on your phone, and it is removed there once the upload finishes or is cancelled. The same applies to photos and videos you send to a board from another app’s share sheet (on iPhone, the Photos share sheet; on Android, the Share menu of your gallery or another app). So that it can offer your boards when you share from another app, the iPhone app, and the Android app from version 1.0.1, keeps a list of the boards you can post to on your phone; it is removed when you sign out. From version 1.0.1 the Android app also gives the names and cover pictures of up to four of the boards you can post to, the most recently active first, to Android itself, which shows them as shortcuts in its share menu and when you touch and hold the Passboards icon; these stay on your phone and are removed when you sign out. In the Android app you choose photos and videos in your phone’s own photo picker, so the app is given only the ones you pick and never has access to the rest of your library. On passboards.com/app you can also post photos (not videos) and change your profile photo from a browser. The browser resizes the photo (up to 1600 pixels on the long side) and re-encodes it before it is uploaded, which removes that metadata; a HEIC photo is sent as it is and converted on our server. Our server also strips the metadata from every photo it receives before storing it. Photos posted from a browser do not send the capture coordinates described in (d).

(d) Where a photo was taken — kept private. When you post a photo or video from the iPhone app, the app reads the location that your iPhone’s Photos library recorded for it (if any) and sends those coordinates to us along with the post. The Android app does not read or send them: the copies it uploads are either re-encoded on the phone or, for an original that is kept (see (c)), copied with the location, camera and device details taken out first, so nothing it sends carries a location. We store them in a separate, private table. They are never shown to anyone — not to other members, not on share cards, not on the website, and not to you inside the app — and no part of the app can read them back. They exist so that we could offer a location feature later (for example, a map of a trip); if we ever build one, we will update this policy and tell you before any of this data becomes visible. These coordinates are deleted when the post is deleted, and with your account.

(e) Places you choose. Separately from (d), you can pick a place name for a post, board or event. A place you pick — its name and, if the name resolves to one, its coordinates — is part of the post and is visible to everyone who can see that post, board or event, including on the web share card. On iPhone, place suggestions and their coordinates come from Apple Maps, which receives the text you type into the place field under Apple’s privacy policy. When a photo or video you are posting from the iPhone app has a location, the app also asks Apple’s geocoding service for the name of the town or region there, so that it can suggest it (“Use photo location”); Apple receives those coordinates under its privacy policy. If you accept the suggestion, the point attached to the post is the named place’s own, not the spot where the photo was taken. When you open a tagged place, or an event that has a location, in the iPhone app, Apple receives that place’s name or coordinates to look it up and show it on a map. On Android, place suggestions come from the geocoding service built into your phone (on most phones, Google’s), which receives the text you type under that provider’s privacy policy; a phone without one shows no suggestions. Neither app reads where your phone is.

(f) Finding friends from your contacts (optional). If you choose to find people you know, the app hashes the email addresses and phone numbers in your address book on your phone (SHA-256, one way) and sends only those hashes, at most 10,000, to our servers, which compare them against the hashes of Passboards users’ own emails and phone numbers and return the matches. Names and raw addresses never leave your phone, and we do not keep the hashes you upload. We do store a hash of your own account email (and of a phone number, if one is ever on your account — the app does not ask for one today) so that friends can find you the same way. You can turn this off with the “Findable by my contacts” switch, in Find friends in either app or in Settings on passboards.com/app; when it is off, nobody can find you through their contacts. Both apps ask first: the iPhone app through iOS’s contacts permission, and the Android app through a screen that explains this, followed by Android’s contacts permission. The app reads your contacts only when you tap “Connect your contacts”, never in the background, and keeps no copy of them, of the hashes or of the matches on your phone. You can withdraw the permission at any time in your phone’s settings. If you invite someone to a board by text message, in either app, you pick one contact in your phone’s own contact picker and the number goes straight to your messaging app; it is never sent to us.

(g) Push notifications and widgets. The app registers a push token for your device with Firebase Cloud Messaging (Google) and, while you are signed in, we store that token, whether or not you have allowed notifications, so that we can send notifications about activity on your boards, clubs and messages; your phone shows them only if you have allowed notifications. To issue the token, Firebase’s code creates its own identifier for this installation of the app, which Google handles under its privacy policy. When you sign out, the app asks Firebase to cancel the token. Turning notifications off in your phone’s settings (iOS Settings, or Android Settings › Apps › Passboards › Notifications) stops them being shown. In the app (Settings › Notifications) you can also choose which kinds of notification you get, set quiet hours, and mute notifications from a single board. We store these choices on our servers, together with your phone’s time zone (for example, “Europe/London”), which the app reports while you are signed in so that quiet hours follow your local time; we use them only to decide whether, and how quietly, to send you a notification. When a board has event dates, its members may get up to three notifications about it (when the event starts, a last call to add photos, and when the board is complete), and we keep a record of which of these we sent or skipped for you and why. For a club event’s board, the last call is replaced by up to two reminders to add your photos, one when the event ends and one the next morning, sent to the people who said they were going or posted to its board, and we keep the same kind of record of them. If a club’s hosts turn on the club roll, you may get one notification a week from that club asking you to share a photo or video you already posted to the club (none in a week you have already shared, and no more than two a week across all your clubs). You can turn this off with Club activity in notification settings or by muting the club, and we keep a record of which of these we sent or skipped for you and why. When a host sets a board or an event’s board to show its photos later (see Section 5), the people whose posts were waiting get one notification when they appear. If you add a Passboards widget (to the Home Screen or Lock Screen on iPhone, or to the home screen on Android from version 1.0.1), the app tells our servers which boards or clubs it shows on that device, or that it shows your recent boards, identified by the device’s push token, so that a new post can prompt the widget to refresh; these refresh messages carry no content. A Passboards Highlights widget is not reported in this way. To fill a widget, the app keeps small copies of the photos it shows, with the posts they come from and the names of the boards and clubs you can choose for it, in its own storage on your phone; they are removed when you sign out. While a widget is on your home screen and you are signed in, the Android app also refreshes it in the background a few times a day.

(h) Settings and choices. Whether your profile is private, whether you are discoverable by contact, whether read receipts are on, whether your supporter crown is shown, whether your photos are kept out of recaps (see (s)), the people you have blocked (see (t)), and your email preferences.

(i) Direct messages. The content of your one-to-one messages, reactions, posts, boards and profiles you share into a chat, and read receipts (if you have them on; turning them off also stops you seeing other people’s). Messages are stored on our servers so they can be delivered and shown on your devices; they are not end-to-end encrypted. Deleting a conversation removes it from your account; the other person’s copy stays with them.

(j) Premium subscription records. If you buy Passboards Premium (when available), Apple handles the payment and we never see your card or bank details. Apple sends us a record of the subscription: transaction identifiers, the product you bought, purchase and expiry dates, whether it will auto-renew, and status changes (renewal, cancellation, billing problems, refund). We keep this history so we know what you are entitled to and to reconcile with Apple. Neither Premium nor the Board Pass (a one-time purchase a host could make for one board) is on sale today; if we offer the Board Pass, Apple would send us the same kind of record for it (transaction identifiers, the product, the purchase date and any refund), which we would keep with the board and the account that bought it. Nothing can be bought in the Android app. If your account is one of the first 1,000 founding members (see Section 8, and Section 8(o) of our Terms), we store your founding-member number with your account, with when it was given and how: when we first numbered the accounts that already existed, automatically once a newer account had both a verified email address (other than a disposable or temporary one) and a post that had stayed up for at least 24 hours, or by our staff. A founding membership gives you Premium without a subscription, so Apple sends us nothing about it.

(k) Email. We use your email address to send account emails (such as a welcome email, the password-reset emails you ask for, and a one-time “welcome back” email with a password-reset link if we have had to restore your account) and occasional product updates, but only if you have agreed to them: if you sign up in the iPhone app (version 2.0.8 or later) with a US App Store account, the sign-up screen tells you we will send them and you can opt out there or at any time in Settings › Notifications › Email; if you sign up in the Android app (version 1.0.1 or later) on a phone whose SIM card or mobile network is in the United States, the sign-up screen tells you the same thing; everyone else gets them only after turning them on (the sign-up screen then has a box for it, which starts unticked). Product-update emails have an unsubscribe link, and mail apps can unsubscribe you with one click. If the address belongs to an account, the link opens an email preferences page on passboards.com where, without signing in, you can turn “News and tips from Passboards” and “Board activity emails” on or off, or stop all optional email; these are the same choices as Settings › Notifications › Email in the app, and we store them with your account. Our own emails are sent through Microsoft 365 (Microsoft), which receives your email address and the message in order to deliver it; we record when an email was sent and whether it was refused, and we stop sending to addresses that bounce or complain. When you ask for a password reset in the iPhone app (version 2.0.7 or later), in the Android app or on passboards.com, our server asks Firebase (Google) for a one-time reset link and sends it to you in our own email through Microsoft 365. Password-reset emails requested from earlier versions of the iPhone app, or while our own email is unavailable, are sent by Firebase (Google). If you sign up in the iPhone app (version 2.0.12 or later) with an email address and a password, the app asks Firebase (Google) to send you an email with a link that confirms the address is yours: once right after you sign up, and again whenever you tap Send or Resend in the app (on Home or in Settings › Account). That email is sent by Firebase, not through Microsoft 365, and confirming your address is optional. The link opens passboards.com, which passes it to Firebase’s own page to confirm the address. While the address is unconfirmed, the app asks Firebase whether it has been confirmed when you open the app, when you tap Check again and when you open Settings › Account; once it has, the app refreshes its sign-in token, and we record the verification as described in (a). Accounts that use Sign in with Apple are never askedFrom version 2.0.8, the iPhone app also tells our servers the country of the App Store account on your iPhone (for example, “USA”), as Apple reports it, and we store the latest one, and when it was reported, with your account. We use it only for email: to decide which of the two rules above applies to you before we send a product update. It is not your location, and it is removed when you delete your account. The Android app (version 1.0.1 or later) has no store account to read. Instead, when you sign up or sign in, it tells our servers the country of the SIM card in your phone or, if there is none, of the mobile network it is connected to (for example, “USA”), and we store the latest one, and when it was reported, with your account, in the same place and for the same single purpose. If the phone has neither, or its SIM, network and language setting disagree about whether it is in the United States, the app sends no country and shows the unticked box. It is not your location, the app does not use GPS or your IP address for it, and it is removed when you delete your account.

(l) Support. When you use the support form on our website we receive the name, email address and question you type, by email to support@passboards.com. If you email us directly, we receive what you send. “Contact support” in the app starts an email in your own email app with the app version and your phone model filled in (the Android app adds the Android version); nothing is sent unless you send it.

(m) Technical data. Our servers see your IP address with each request and use it to rate-limit sign-ups, prevent abuse and diagnose problems. Requests reach us through Cloudflare, which sees the same connection data as a network provider. We keep ordinary server logs for up to about 30 days.

(n) Usage analytics. The app tells our own servers how it is used, so that we can see what works and what does not. It records events such as opening the app, starting or finishing sign-up or signing in, opening an invite link or entering an invite code (where in the app, and whether it was pasted or typed), being shown the join screen for an invite and whether you joined, an invite that did not work (a short reason), joining or creating a board or club, posting (whether it was a photo, video, music or text post, and how many items), an upload starting, finishing or failing (with a rough duration and a short failure reason, never the file), sharing photos to a board from the Photos share sheet (how many), the first-run steps (which board template you picked, whether you invited anyone and how, which checklist steps you finished, how many boards a welcome-back screen showed), being shown the tutorial and whether you skipped or finished it (how many pages you saw), sharing a link or a story card (2(w)), switching between the main tabs, searching (how many characters you typed, never the words), following someone, answering an event, the notification permission prompt and your answer to it, being shown the card that says an update is available and whether you tapped Update or Not now, being shown the store’s rating prompt (2(q)), setting up a Passboards widget (whether it shows a board, a club or recent posts, and its size), changing a notification setting (which setting, and whether it was turned on, off or changed), opening a notification (which kind it was), saving or exporting a board (to Photos or as a file, how many items, and whether it finished), making, sharing or posting a board recap (its length, and whether you shared it to Photos, Instagram, Messages or somewhere else), viewing Premium or the Board Pass or buying one (which product), and how many times the app crashed (a count only, from Apple’s MetricKit; the app sends no crash reports, see 2(v)). The posting, Photos share sheet, upload, Premium and crash-count events come only from the iPhone app. The widget and recap events come from the iPhone app and, from version 1.0.1, from the Android app. Each event carries its time, a few short labels like these, the app and operating system version, a random identifier the app creates, and the account you were signed in to when it happened, if any. The random identifier is not an advertising identifier, is not shared with other apps and is not synced to your other devices. On iPhone it is kept in the keychain, so it stays on your iPhone if you delete and reinstall the app. On Android it is kept in the app’s private storage, is left out of backups and phone-to-phone transfers, and is erased when you uninstall the app or clear its data. Turning analytics off stops it being sent but does not delete it. We link an event to your account only if it was recorded while you were signed in to that account; events from while you were signed out carry only the random identifier. Events never include what you post or write, names, email addresses, your messages, your contacts, your location, or which posts, boards or people you looked at. No analytics company is involved: the data goes only to our servers, and we do not share it with advertisers or anyone else. While you are offline, the app keeps unsent events on your phone for up to 7 days (at most 1,000 of them) and then discards them. Analytics are on by default, and you can turn them off at any time in Settings › Privacy › Share usage analytics; the app then stops recording and sending them and deletes the unsent events on your phone. Our servers also record three kinds of event of their own, linked to your account: a Premium subscription changing status (for example, it renews, expires or is refunded, with the plan and its new status), an email being sent to you (the kind of email and the service that sent it, not its content or your address), and a board-gathering notification being sent to you (which one it was and whether the board belongs to a club, not which board). These are part of running the Services, so the setting does not turn them off. All of these events are kept for 180 days (see Section 7). This is separate from the subscription history in 2(j) and the email records in 2(k).

(o) The website. Our public web pages set no cookies and run no analytics. The only cookies on passboards.com are the sign-in cookie for signed-in members using passboards.com/app, a guest-pass cookie for each guest link you join, as a guest or with your account (see (x)), which works only on that link and lasts up to 30 days, an appearance cookie (pb_theme) that the web app sets if you choose Light or Dark in its settings, which stores only that choice for up to one year and is removed if you choose System, and a sign-in cookie for our staff on the private admin console. A club calendar link (see (y)) is not a cookie: it is a private web address that your calendar app keeps and uses to fetch the feed. The web app also keeps an unposted text-post draft in your browser’s local storage (see (b)). To show music artwork and club covers, our web pages fetch them through our own server, and we draw preview images for shared text posts on our server from the post’s public excerpt. What someone without an account can see of public boards, profiles and posts on the website is described in Section 5.

(p) Music links. When you share an Apple Music or Spotify link, our servers look up that item’s public details from Apple (the iTunes Search and Lookup services, and public Apple Music playlist pages) and from Spotify (its oEmbed service and public page data). For a Spotify song or album, we also search Apple’s catalog by its title and artist to find a matching preview. These requests carry only the link, the catalog ID or the title and artist, not who you are. We store the title, artist, album, artwork address and preview address. Details that came from Spotify are refreshed daily, and if they can’t be refreshed for 7 days, their title, artist, album and artwork are removed. In the app, artwork and song previews load directly from Apple’s and Spotify’s servers, which see your device’s IP address. On passboards.com, artwork loads through our own server, so they don’t. Your choice of music app (Settings › Music) is stored only on your phone. To decide which of the Apple Music and Spotify buttons comes first, the Android app checks whether those two apps are installed on your phone; the answer stays on the phone.

(q) Rating prompts. Now and then the app may ask you to rate Passboards using the store’s standard rating prompt (Apple’s on iPhone, Google Play’s on Android), after a moment such as a board you are on reaching several contributors: never in your first few days or sessions, never more than three times a year, and never right after something went wrong. Your rating or review goes to Apple or Google under that company’s privacy policy; neither tells us whether or how you rated. The app keeps on your phone when it last asked, and records that the prompt was shown in usage analytics (2(n)). On iPhone you can stop these prompts in iOS Settings (App Store › In-App Ratings & Reviews).

(r) Safety checks and reports. When you upload a photo, video, club cover, club-chat photo or profile photo, our servers compute a short numeric fingerprint of the picture (for a video, of several frames) with PDQ, a perceptual-hashing method. The fingerprint cannot be turned back into the picture; it is kept with the file and deleted when the file is. Fingerprints let us compare uploads with lists of fingerprints of known child sexual abuse imagery that child-safety organizations share with online services. We do not hold such a list yet; when we add one, new uploads are compared with it as they arrive, and earlier uploads are checked against it once. A match hides the post and withholds its files from everyone straight away, and goes to our staff for review. When someone reports a post, comment, board, club, person or conversation, our staff can see the reported item, the reports about it and the account behind it — including content that is otherwise private, such as a post on a private board or the most recent messages of a reported conversation. Every action our staff take in our moderation tools is recorded with its reason, and every time they view media there, it is logged. When our staff take a post down, its files are withheld from everyone until the post is restored or deleted. If our staff confirm apparent child sexual abuse material, we preserve that material and the related account records for a year (longer while a report is being made), even if the post or account is deleted, and report it as described in Section 6. Comments our staff remove are kept in our moderation records.

(s) Recaps. The iPhone app, and the Android app from version 1.0.1, can make a short recap video of a board, with music that comes with the app. The recap is made on your phone from the photos and videos you can see on that board; our servers only send the app the list of those posts. Other members of a board you share can make recaps that include your photos and videos from it. A recap someone posts back to the board is a video post like any other, visible to the board’s members; for each posted recap we record which posts it was made from and who posted them, so that if one of those posts is deleted or removed, the recap is taken down, and if two people have blocked each other, a recap containing one’s posts is hidden from the other. If you turn on Settings › Recaps › “Keep my photos out of recaps”, your photos and videos are left out of the recaps other people make from then on (they still count in a recap’s totals); we store that choice on our servers. Earlier versions of the Android app cannot make recaps. A recap someone posts to a board is a video post, so members using an earlier Android version or the web see it like any other, and the “Keep my photos out of recaps” switch is in every version of the Android app. On Android a recap goes on being made if you leave the app, with a notification you can cancel it from. The Android app keeps a finished recap in its cache on your phone; it is removed when you sign out, or the next time the app starts after the recap is two weeks old. Clubs have recaps too: a club’s members can see a recap of the club’s month, season or year, made from the club’s boards, and when a club event’s board closes, a recap of up to six of its photos goes into the club chat, chosen separately for each person who sees it. Club recaps follow the same rules: blocks apply, and if you keep your photos out of recaps, they are left out of what other people see (they still count in the totals).

(t) Blocking and removals. When you block someone, we store the block. Neither of you then sees the other’s posts, comments, likes and other content in the app or on passboards.com/app, and this works in both directions whoever made the block. A like count shows only the likes you can see, so two people can see different counts on the same post. When a board’s host or admin, or a club’s host, removes someone, we remember the removal so that an old invite link can’t bring them straight back; the removal is forgotten if they accept a direct invitation back. Someone who leaves on their own is not remembered this way. A club’s host or co-hosts can remove a message from the club chat. It then shows as removed by a host, and we keep a record of who removed which message and when.

(u) Saving and exporting a board. In versions of the apps that include it, anyone who can see a board can save its photos and videos to their phone’s photo library or gallery, or export them as a file. The file is a zip that also lists, for each post, its title, caption, text, date and place and the name and username of the person who posted it. Our servers send the app a list of the posts that person can see (leaving out posts across a block) with short-lived download links; the app does the downloading, and apart from the usage analytics event in (n) we store nothing about the export. On Android, saved items go to a Passboards album in your gallery. In both apps, an export in progress or a finished export file stays in the app’s private storage on your phone until you start another, clear it or sign out.

(v) Crash reports (older iPhone versions only). The iPhone app from version 2.0.11 and the Android app send no crash reports. The iPhone app sends us only the crash count described in 2(n). iPhone versions before 2.0.11 include Google Firebase Crashlytics. Each time one of those versions is opened it contacts Google’s Crashlytics service, and if it crashes it sends Google a crash report so we can find and fix the problem. A report contains the technical details of the crash (which part of the app failed and the steps leading to it), your device model, iOS and app version, and a random identifier for this installation of the app. It does not include your name, email address, username or posts, we do not attach your account to it, and it is not used for advertising. Updating the app stops this.

(w) Story cards. In versions of the apps that include it, you can turn a post or a board into a picture to share to your Instagram Story or through your phone’s share sheet. The card is made on your phone. When you share it, your phone hands the picture to Instagram or to the app you pick, under that app’s privacy policy; for a short video post you can send the video itself to Instagram instead. To Instagram the app also passes Passboards’ public Meta app identifier, which is the same for everyone. We do not receive the card, we send nothing to Meta ourselves, and neither app contains Meta software. You can also save the card to your photos or copy its link. The app sends our servers only a usage event (2(n)): that you chose to share or save a card of a post or of a board, or copied its link, where in the app you started, the card’s style, and where the card went (to Instagram, to the share sheet, to your photos or as a copied link, and, if a card meant for Instagram went to the share sheet, why, for example that Instagram is not installed). The event never says which post or board.

(x) Guests without an account. A host can share a guest link (passboards.com/g/<code>, or its QR code) for a club event or a board with dates, so that people without the app can add photos to it. To join as a guest you give a first name and an email address and confirm that you are 18 or over and agree to our Terms of Service; for an event you can also say whether you are going. We store your first name, your email address, your answer, when you made that confirmation and which version of the Terms you agreed to, and the IP address you joined from. We do not verify the email address, we send nothing to it, and we do not show it to anyone, including the host. Your browser keeps a guest pass, a random code, in a cookie that works only for that guest link, and we store only a one-way scrambled (hashed) form of it. The pass ends after 30 days, when you choose Leave, when you keep your photos on an account (below), or for every guest at once when the host turns guest access off. Photos you add are sent from your browser as you picked them, without being resized (a HEIC photo is converted on our server to a JPEG of up to 1600 pixels on the long side); our server removes the location, camera and device details (EXIF and similar) before storing them and runs the safety checks in (r), and we keep the IP address each photo was sent from. We use these IP addresses only to prevent abuse and to support the safety reports described in Section 6. A guest can add up to 100 photos. Unless the host has turned approval off, a guest photo is visible only to the guest and to the hosts of the event or board (for a club event, the club’s host and co-hosts; for a board, its owner and admins), who see it with the first name the guest gave, until a host approves it. A host can approve it, decline it, or decline it and report it to us. Once approved, a guest photo appears on the event’s or board’s page to everyone who can see it, as a post from “Guest”, without the guest’s name or email address. On the guest page a guest sees only the event’s or board’s own details (its name, its club’s name, its time, place and description, and how many people are going), never the names or photos of its members, and only their own photos. If you later sign in to a Passboards account in the same browser and choose to keep your photos, the photos you added that were not declined move to that account as your own posts, and we erase your guest details at that moment; for an event, the host who shared the link may then invite your account to the club, which you can accept or decline in the app. If you are signed in to a Passboards account, you can join a guest link with that account instead of as a guest. We then don’t ask for a name or email address; we record which account joined, when, and the IP address you joined from, and the hosts see your account’s first name (or, if it has none, its username) while they review your photos. Photos you add this way are posts from your account, held for review in the same way, and once approved they appear with your account’s name and picture, like any other post. For a club event, after a host approves one of your photos, the host who shared the link may invite your account to the club. If you joined as a guest in the same browser first, continuing with your account moves those photos to it and erases the email address you gave. Deleting your account removes these photos with your other posts. How long guest details and photos are kept is in Section 7.

(y) Club calendar feeds. If you choose Subscribe to Calendar in a club, we create a private link (webcal://passboards.com/cal/v1/…) for you and store only a scrambled form of it. Your calendar app fetches the club’s events through that link: their titles, details, places, times and whether they were canceled, and the club’s name, but never who is going or who hosts. Anyone who has the link can read that feed, so treat it like a password. It stops working when you choose Stop Calendar Feed, leave or are removed from the club, the club is deleted, or you delete your account. We record when a link was last used.

(z) Club polls. When you answer a poll in a club, we store your answer so you can change it. In a poll that is not anonymous, the club’s members can see who chose each option. In an anonymous poll, nobody sees who answered, not even the person who asked or the club’s hosts: members see only the totals, and while the poll is open, the count for each option stays hidden until enough people have answered. Your answers are deleted if you leave the club or delete your account. A Find a time poll is never anonymous: answers to a Find a time become your RSVP to the event a host picks (Yes becomes Going, and Maybe stays Maybe).

3. What We Do Not Collect
- Your phone’s location. Neither app asks for or uses your phone’s location services. The only location data we hold is what is described in 2(d) and 2(e), and the country described in 2(k).
- Advertising identifiers (Apple’s IDFA or the Android advertising ID) or any advertising SDK. Passboards has no ads today.
- Your address book in readable form (see 2(f)). Neither app reads your contacts unless you choose to find friends from them, and then only hashes leave your phone.
- SMS or text messages.
- Data about you from data brokers or other companies.
We do not sell your personal information, we do not “share” it for cross-context behavioral advertising, and we do not track you across other companies’ apps or websites.

4. How We Use Your Information
- To run the Services: show your boards and posts to the right people, deliver messages and notifications, match contacts you ask us to match, and keep your Premium entitlements right.
- To order your Home feed and Explore: we use your activity on Passboards (who you follow, the boards and clubs you belong to, and the posts you like, comment on and save) and how much people post and are liked and commented on across public boards, to decide the order in which you see posts you can already see. It never shows you anything you could not otherwise see, and it does not use which posts you have viewed. You can ask us to turn it off for your account at support@passboards.com, and we then show you posts newest first.
- To keep the Services safe: prevent spam and abuse, enforce our Terms of Service, respond to reports and flags, and protect our systems.
- To communicate with you: account emails, replies to support requests, and product updates you have agreed to.
- To improve the Services, using the usage analytics described in 2(n), unless you turn them off.
- To meet legal obligations.

5. Who Can See Your Content
- Public boards and public profiles can be found and viewed by anyone with a Passboards account, through the search and Explore features of the app and, signed in, on the web at passboards.com/app. Without an account, a link to a public board or public profile opens a page on passboards.com that only offers to open it in the app or to sign in; it does not show the board’s or profile’s posts. The link’s preview (its title, a short description where there is one, and a preview image) can be read by anyone who has the link. A link to a post on a public board works the same way; for a music post the page also shows the song, album or playlist and its artwork, and for a text post it shows the note, or an essay’s title and excerpt, with the author’s username. When a share link to one of them is pasted into a message or social app, it shows the board or profile title and a preview image. Public clubs can be found through the app’s search and viewed on the web at their address (passboards.com/c/<address>), which shows the club’s name, mark, cover, description and member count. A private club’s address shows only an invite-only card to anyone without a valid invite, and never confirms the club exists.
- Private boards are visible only to the people who have been added to them, except for the invite-link preview described next. Private profiles are visible only to approved followers. Private clubs are visible only to their members, and can be joined only by invitation — an in-app invite, or an invite link created by the club’s host or co-hosts.
- A board’s owner or admins can create invite links (passboards.com/b/<code>). Anyone who has a link — including anyone it is forwarded to — can open it without an account and see the board’s title, its cover (on a private board, only a cover the host chose; on a public board, its latest post if no cover was chosen), how many members it has, and the first names of up to three members, starting with the person who made the link (or their username, if they have not given a first name); for a public board, also its caption. When a link is pasted into a message or social app, its preview shows the title, the cover and the member count. The link lets that person join the board with the role it grants, and nothing else about a private board is shown until they do. Hosts can make a link expire or stop after a number of uses, and can turn it off at any time; after that the page says only that the link is no longer active and does not reveal whether the board exists. Invite-link pages are kept out of search engines.
- Posts you make to a board that belongs to someone else are visible to that board’s members, and stay on the board if you leave it. Messages you send in a club chat stay in the chat if you leave the club. Deleting your account removes your posts and comments everywhere; messages you sent remain visible to the people you sent them to, attributed to a deleted account.
- If you share a post with a club, that club’s members can see the post, its comments and its likes; only members see the tag. A club’s hosts can remove it from their club.
- A club’s owner can hand the club over to another member, who becomes its owner when they accept (the former owner becomes a co-host). The club is then treated as theirs, including if either account is deleted.
- For a club event, its hosts (the club’s host and co-hosts, the person who created the event, and a co-host picked for it) see who is going, who is on the waitlist, who is waiting for approval and how many guests each person brings. Members see who answered Going or Maybe, unless a host chooses to show members only the counts; hosts always see the names. People who have blocked each other are left out of each other’s lists. Messages an event’s hosts send to the people going (or to Maybe or the waitlist) are seen by the people in those groups and by the event’s hosts, and are kept like club-chat messages.
- Club members can see how many of the club’s events each member has been to (counted from confirmed Going answers and posts to an event’s board). It is not shown between people who have blocked each other.
- Hosts can see the totals of answers to “How was it?” for a club event, never who gave which answer, and only once enough people have answered.
- If a club’s hosts turn on the club roll, a photo or video you share to it is shown on the club’s page to members who can already see that post. A club goal shows only the club’s total, never how much any one person added.
- In the app, links in text posts open only after the reader confirms where they go.
- In versions of the apps that include board export (2(u)), anyone who can see a board can save or export the photos and videos on it, including yours; an exported file also lists each post’s caption and date and the name of the person who posted it. Members who have Premium (by subscription when it is available, or as founding members) can download posts on boards they belong to, including yours, at the best quality available.
- Anyone who can see a public board can make a story card (2(w)) of it or of a post on it. For a private board, or a public board owned by a private account, only people in it can, and the app asks them first: the owner or an admin (on a club board, a host of the club) can make a card showing its photos and members’ faces, or a card of any post with its author’s name; another member’s card shows the board’s name and only their own photos; an author can make a card of their own post. Whoever shares a card decides who sees it.
- Other members of a board can make recaps that include your photos and videos from it, and post them back to the board, unless you keep your photos out of recaps (2(s)).
- A host who shares a guest link (2(x)) lets anyone who has the link see the event’s or board’s name, time, place and how many people are going, and add photos as a guest. Guests never see the names or photos of its members. Hosts see the first name a guest gave (or, for someone who joined with their account, that account’s first name or username) next to each guest photo while they review it; approved guest photos appear to the board’s members as posts from “Guest”, or from the account of someone who joined with one.
- A host can set a board or an event’s board to show its posts at the end of the event, or at a set time, instead of straight away. Until then, each person sees only their own posts there and how many posts there are; at that time the posts appear to everyone who can see the board.
- A supporter crown on a profile means only that the account has Premium, by subscription or as one of the first 1,000 founding members. It is not a verification of identity.
Please use care before revealing anything that identifies you in the real world in a public board or profile.

6. Who We Share Information With
We share information only with the service providers we need to run Passboards, each under a contract that limits what they may do with it:
- Google (Firebase Authentication and Firebase Cloud Messaging, and Firebase Crashlytics in iPhone versions before 2.0.11): sign-in and email verification, push notifications and, in those older iPhone versions, crash reports.
- Microsoft (Microsoft 365) — sending our emails, including password-reset emails; it processes your email address and the message.
- Cloudflare — the network in front of our servers (content delivery, DNS and tunneling); it processes connection data such as your IP address.
Apple processes your App Store purchase of Passboards Premium under its own privacy policy and sends us the subscription record described in 2(j). Apple (Apple Music / iTunes) and Spotify receive lookup requests from our servers when a music link is shared, and serve artwork (and, from Apple, song previews) to your device in the app, under their own privacy policies (see 2(p)). Apple Maps and Apple’s geocoding service provide place suggestions and maps in the iPhone app under Apple’s privacy policy, and your phone’s geocoding service provides place suggestions in the Android app (see 2(e)). If you share a story card to Instagram (2(w)), your phone gives it to the Instagram app at your request; Meta is not one of our service providers, and we send it nothing. Your data is otherwise stored on servers we operate ourselves in the United States. If our staff confirm apparent child sexual abuse material (2(r)), we report it, with information about the account that uploaded it, to the National Center for Missing & Exploited Children (NCMEC), as US law requires; NCMEC may share reports with law enforcement. We may also disclose information if the law requires it, to protect the safety of a person, to enforce our Terms, or as part of a merger, acquisition or sale of the company, in which case we will tell you before your information becomes subject to a different privacy policy. We do not sell personal information.

7. How Long We Keep It, and Deleting Your Account
- Content you post stays until you delete it or your account. Deleting a post also deletes its private capture coordinates (2(d)) and any stored original.
- You can delete your account in the app under Settings › Account Deletion (or by emailing support@passboards.com from your account email). The steps for both phones, and for deleting without the app, are at passboards.com/delete-account. In the app, deletion is immediate; by email it can take up to 30 days, because we first confirm that the request is yours. Either way it is permanent: your profile and photo, the boards you own and everything on them, your posts and comments on other people’s boards and on club boards, your likes, saves, follows, notifications, push tokens, email preferences, your date of birth if you added one, and any stored originals are removed from our live systems; your contact hashes stop being matchable; and your username and email address become available again. Your text posts (with their titles and body text) and music posts are deleted like your other posts, and so are your posts’ tags in clubs. Clubs you own are deleted, and their addresses (handles) are retired: they are not given to another club. A board or an event you created inside a club you do not own belongs to that club and stays; your posts on it are deleted. Text-post drafts on the phone you delete your account from are removed too. Direct messages and club-chat messages you sent remain with the people you sent them to, shown as coming from a deleted account, so that their side of the conversation is not lost. Photos you sent in a club chat stay with the club like your other club-chat messages, and so do messages you sent to an event’s people as its host. Your poll answers, your answers to “How was it?” and your club roll shares are deleted. Deleting your account also deletes your calendar feed links, and repeating events you set up stop making new events (the events already made belong to the club and stay). Your subscription records and any founding membership are deleted too (Apple keeps its own record of your purchases, and a founding-member number is never given to anyone else), and so are the usage analytics events linked to your account (2(n)); we keep only an anonymous log that emails were sent, with the address and content removed.
- Guest details (2(x)). A guest’s email address and IP addresses are erased 90 days after the guest last used the guest page. The first name stays, for the hosts’ review list only, while the guest still has photos on the event’s or board’s page. A guest photo a host declines is deleted 7 days after the host’s decision, and a guest photo no host reviews within 30 days is treated as declined; a declined photo that was reported to us is kept until our staff have reviewed the report, and a photo that matched our safety checks is kept as described in 2(r), with the IP address it was sent from. An approved guest photo stays on the event’s or board’s page until a host deletes it or our staff remove it. Guest details are also erased at once when a guest keeps their photos on an account. To have your guest details or photos removed sooner, email support@passboards.com from the address you gave as a guest.
- Usage analytics events (2(n)) are kept for 180 days. After that we keep only daily totals (for example, how many times the app was opened that day, and by how many devices and accounts), which identify no one. Events recorded while you were signed out are not linked to your account, so deleting your account does not delete them; they expire after 180 days like the rest.
- The ordering scores we compute for your Home feed and Explore (Section 4) are rebuilt every night. We never use scores more than two days old, we do not include them in our backups, and we delete them when you delete your account, or for everyone if we stop personalised ordering.
- Material and account records preserved after a confirmed child-safety match (2(r)) are kept for the period described there, even after the post or account is deleted.
- Records of the moderation actions our staff take (2(r)), and the log of our staff’s access to our moderation tools, are kept after the content or account they concern is deleted, so that we can show how a report was handled and protect the Services.
- If your email address ever bounced or you reported one of our emails as spam, we keep that address on a suppression list so we never email it again, even after account deletion.
- Backups. We back up our database every night. Daily backups are kept for 14 days and weekly backups for up to 8 weeks. Copies are also exported to offline drives we keep ourselves, not to any cloud service; on those drives daily backups are removed after 90 days and weekly backups after a year, and media files you delete are held for 30 days before removal. Something you delete can therefore remain in a backup for up to about two months, and on an offline copy for up to a year, before it is gone everywhere. Backups are used only to recover from a failure, never to restore deleted accounts.
- Deleting your account does not cancel a Passboards Premium subscription; cancel it in your Apple Account (formerly Apple ID) subscription settings.

8. Passboards Premium and Stored Originals
If you have Premium, by subscription (when available) or as a founding member, the original files of the photos and videos you post (metadata-stripped, up to 4 GB each) are kept in addition to the standard copies, and you can download any post you have access to at the best quality that exists for it. Which files the Android app can keep an original of is described in 2(c). If your Premium ends (your subscription ends, or a founding membership is removed), we do not delete or downgrade the originals already stored because of that; new posts keep only the standard copy, and downloads stop until you have Premium again. Originals are deleted when you delete the post or your account.

9. Children
Passboards is for adults. You must be at least 18 to create an account, and we do not knowingly collect information from anyone under 18. If we learn that an account belongs to someone under 18, we delete it and its information. Guests (2(x)) confirm that they are 18 or over before they can add anything; if we learn that a guest is under 18, we delete their guest details and photos. The age checks described in 2(a) run on your phone and their answer is not sent to us: when one shows that the person using the phone is under 18, the app does not create an account, or stops working on that phone, and we are not told. If you believe a child is using Passboards, email support@passboards.com.

10. Your Choices
- Profile privacy, read receipts and “Keep my photos out of recaps” are switches in the app. “Findable by my contacts” is a switch in Find friends in the app and in Settings on passboards.com/app. The supporter crown switch is in Settings in either app and on passboards.com/app.
- Which kinds of notification you get, quiet hours, and muting a single board are choices in the app (Settings › Notifications, and on each board).
- A club calendar feed (2(y)) stops when you choose Stop Calendar Feed in the club.
- Your preferred music app (Settings › Music) is a choice in the app.
- Which accounts’ posts can appear in Passboards widgets (Settings › Widgets, in either app) is a choice kept only on your phone.
- Usage analytics can be turned off in the app under Settings › Privacy › Share usage analytics.
- Push notifications can be turned off entirely in your phone’s settings (iOS Settings or Android Settings).
- Product-update emails have an unsubscribe link in every message, which opens your email choices on passboards.com (see 2(k)).
- You can edit your name, bio, date of birth and profile photo in the app (a username cannot be changed in the app today; see Section 11), block and unblock people, and delete individual posts, comments, boards and conversations at any time.

11. Your Rights
Wherever you live, you can ask us to tell you what personal information we hold about you, to correct it, to delete it, or to give you a copy of it in a portable form. Most of this you can do yourself in the app; for anything else, email support@passboards.com from the email address on your account. We will verify that the request comes from the account holder before acting on it, respond within the time the law allows (normally 30 days, or 45 days for California requests), and we will never treat you differently for exercising your rights. You may use an authorized agent to make a request on your behalf; we will ask for proof that you authorized them.

California residents (CCPA/CPRA). In the last 12 months we have collected the categories of personal information described in Section 2: identifiers (name, username, email, hashed phone/email, account and device identifiers, IP address), account and subscription records, the content you post and send (including photos and videos, which may contain your image), the private capture coordinates described in 2(d), usage data from the app’s analytics (2(n)), the settings you choose, and the first name, email address and IP addresses of guests (2(x)). We collect it from you, from your device, and from Apple and Google in the course of sign-in and purchases, for the purposes in Section 4, and disclose it to the service providers in Section 6 for business purposes only. We do not sell personal information, we do not share it for cross-context behavioral advertising, and we have no actual knowledge of selling or sharing the personal information of anyone under 16. We do not use or disclose sensitive personal information for purposes other than providing the Services. You have the right to know what we collect and how we use and disclose it, to delete it, to correct it, to limit the use of sensitive personal information, and not to be discriminated against for exercising these rights. To exercise them, email support@passboards.com with “California privacy request” in the subject line, or use the tools in the app.

Residents of other US states with privacy laws have the same rights described above. If we refuse a request, you can appeal by replying to our decision, and we will tell you how to complain to your state attorney general.

European Union, EEA and United Kingdom residents (GDPR / UK GDPR). Our legal bases are: performance of our contract with you (running the Services you signed up for, including Premium, and, for a guest, adding your photos to the event or board you joined as a guest); your consent (matching your contacts, push notifications and product-update emails — each of which you can withdraw at any time in the app or in your phone’s settings); our legitimate interests in keeping the Services secure and free of abuse, in communicating with you about your account, in understanding how the app is used through the limited first-party usage analytics described in 2(n) (you can object at any time by turning off Settings › Privacy › Share usage analytics), in ordering your Home feed and Explore by your own activity (described in Section 4; you can object at any time by emailing support@passboards.com, and we then turn it off for your account), and in holding the private capture coordinates described in 2(d) so that a future location feature would not require you to re-upload your photos (you can avoid this by removing the location from a photo before posting it), balanced against your rights; and compliance with legal obligations. You have the rights to access, rectify, erase and port your data, to restrict or object to processing, and to withdraw consent, and you may lodge a complaint with your national data protection authority (in the UK, the Information Commissioner’s Office). We do not make decisions about you by automated means that have legal or similarly significant effects. We have not appointed a representative in the EU or the UK; contact us directly at support@passboards.com. Your data is processed in the United States, as described in Section 13.

12. Security
Traffic between the app, the website and our servers is encrypted in transit. The Android app refuses unencrypted connections to every host. Passwords are stored by Firebase Authentication in hashed form; our servers pass your password to Firebase only when you sign up, or sign in or set a new password on passboards.com, and never store it. Media is served through signed, expiring links. Access to production systems and backups is limited to the people who operate Passboards. No system is perfectly secure; if we learn of a breach affecting your personal information we will notify you and the authorities as the law requires.

13. Where Your Data Lives and International Transfers
Our servers are in the United States, and the providers in Section 6 process data in the United States and, in some cases, in other countries where they operate. If you use Passboards from outside the United States, your information is transferred to and processed in the United States, whose laws may differ from those of your country. Where the law requires a specific safeguard for such transfers (for example, for EU, EEA, UK or Swiss residents), we rely on the mechanisms recognized under that law, such as the standard contractual clauses in our agreements with those providers.

14. Changes to This Policy
We will update this policy when the Services change in a way that affects your information. We will post the new version here with a new “Last Updated” date and, for material changes, tell you in the app or by email before they take effect. Where a change needs your consent under the law where you live, we will ask for it.

15. Contact
Questions, requests or complaints: support@passboards.com, or by mail to Passboards, Inc., PO Box 127, Danville, CA 94526, United States.