Privacy Policy

Passboards, Inc. (“Passboards,” “we,” “us” or “our”) makes an iPhone app and a website (www.passboards.com) that let a group of people put their photos, videos, music and writing from a trip, a party or a club into one shared board. This Privacy Policy explains, in plain language, what information we collect when you use the Passboards app and website (together, the “Services”), what we do with it, who else sees it, how long we keep it, and the choices and rights you have. It is written to describe what the app and our servers actually do today. If we build something that changes it, we will update this page first. An Android app is being prepared for Google Play; where it works differently from the iPhone app, this policy already says so.

The short version: we collect what we need to run a shared photo service, plus one thing we hold but do not use yet (the private capture coordinates the iPhone app sends, described in 2(d)). We do not use your phone’s location services, we do not use advertising identifiers, Passboards has no ads today, we do not sell your information and we do not track you across other companies’ apps or websites.

1. Who Is Responsible
Passboards, Inc., PO Box 127, Danville, CA 94526, United States, is the company responsible for your information (the “data controller,” in the words of European law). You can reach us at support@passboards.com.

2. What We Collect

(a) Your account. When you sign up we ask for your name, a username, your email address and a password, and you can add a profile photo, a short bio and your date of birth. Your date of birth is optional, is not shown to anyone, is not used for anything today and is deleted with your account. Sign-in is handled by Firebase Authentication, a Google service. At sign-up your password is sent to our server once so that we can create your Firebase account; we do not store it. If you sign in, or set a new password from a reset link, on passboards.com, the password you type passes through our web server on its way to Firebase; we do not store or log it. Firebase stores your email address and a hashed form of your password, and issues the sign-in token the app uses to talk to our servers. Firebase’s code keeps that sign-in on your phone: in the keychain on iPhone, and on Android in the app’s private storage, which is left out of backups and phone-to-phone transfers. Where the iPhone app offers Sign in with Apple, you can use it instead of a password: Apple then gives us your name (if you choose to share it) and either your email address or, if you choose “Hide My Email”, a private relay address that forwards to you, Firebase keeps an identifier for your Apple account, and you choose a username. We do not offer Google sign-in. You confirm at sign-up that you are at least 18. When you sign up on iPhone, the app also asks Apple’s Declared Age Range service whether you are 18 or over. Apple shares only an age range, never your date of birth, and only if you (or whoever manages your Apple Account) agree to share it. If the range shows you are under 18, the app does not create an account; if you decline or no answer is available, your own confirmation that you are 18 or over applies. The app uses the answer only while you are signing up: it is not stored, and it is not sent to our servers. When you sign up in the Android app, the app asks Google Play’s age signals service for your age range. Google shares only a range, never your date of birth, and only where it has one to share and the sharing has been agreed to; Google Play may show its own screen asking you to share it. If the range shows you are under 18, the app does not create an account; if nothing is shared or no answer is available, your own confirmation that you are 18 or over applies. While you are signed in, the Android app reads the same range again without asking when you open the app, normally no more than once a day, and if Google Play reports that the person using the phone is under 18 the app stops working on that phone until that changes. The answer is used only for this: it is not stored, and it is not sent to our servers.

(b) What you post. Boards, the photos and videos you post to them, post titles and captions, music posts (the Apple Music or Spotify link you share and the song, album or playlist details we look up for it; see (p)), text posts (notes and essays, including their titles, body text and any links in them), comments, @mentions and people you tag, likes and saves, follows and follow requests, club memberships, the clubs you share a post with, events and RSVPs, the dates you set for a board’s event, the order you arrange a board’s posts in, the framing of a board’s cover, the boards you pin and their order on your profile, the order of your club list and the clubs you pin, the look (theme, title style and effect) a host picks for a club or club board, club announcements, the name, mark and public address (handle) of a club you create, and any place you choose to attach to a post, board or event. For each club we also keep the time of its latest activity (a chat message, a post, a post shared with the club or an event change), used only to offer the “Recently Active” order of your own club list. Text-post drafts are saved only on your own device until you post: on your phone in the app, and in your browser’s local storage if you write on passboards.com/app, where a draft stays until you post it, discard it or clear the site’s data in that browser. Direct messages are covered in (i).

(c) Your photos and videos, and the files themselves. When you post a photo we make a resized copy (up to 1600 pixels on the long side) to show in the app; videos are re-encoded to a 720p-class copy. Before anything is uploaded the app strips the location, camera and device metadata (EXIF and similar) from the file, so the copies we store and show contain none of it. If you edit a photo before posting, the edit is applied on your phone and only the edited photo is uploaded; we never receive the unedited photo or the settings you chose. If you subscribe to Passboards Premium, the original file is also kept, metadata-stripped, up to 4 GB per file (see Section 8). The app uploads in the background, so an upload can finish after you leave the app; until it does, the prepared, metadata-stripped copy waits in the app’s storage on your phone, and it is removed there once the upload finishes or is cancelled. The same applies to photos and videos you send to a board from another app’s share sheet (on iPhone, the Photos share sheet; on Android, the Share menu of your gallery or another app). In the Android app you choose photos and videos in your phone’s own photo picker, so the app is given only the ones you pick and never has access to the rest of your library. On passboards.com/app you can also post photos (not videos) and change your profile photo from a browser. The browser resizes the photo (up to 1600 pixels on the long side) and re-encodes it before it is uploaded, which removes that metadata; a HEIC photo is sent as it is and converted on our server. Our server also strips the metadata from every photo it receives before storing it. Photos posted from a browser do not send the capture coordinates described in (d).

(d) Where a photo was taken — kept private. When you post a photo or video from the iPhone app, the app reads the location that your iPhone’s Photos library recorded for it (if any) and sends those coordinates to us along with the post. The Android app does not read or send them: it re-encodes photos and videos on the phone before upload, and what it sends carries no location. We store them in a separate, private table. They are never shown to anyone — not to other members, not on share cards, not on the website, and not to you inside the app — and no part of the app can read them back. They exist so that we could offer a location feature later (for example, a map of a trip); if we ever build one, we will update this policy and tell you before any of this data becomes visible. These coordinates are deleted when the post is deleted, and with your account.

(e) Places you choose. Separately from (d), you can pick a place name for a post, board or event. A place you pick — its name and, if the name resolves to one, its coordinates — is part of the post and is visible to everyone who can see that post, board or event, including on the web share card. On iPhone, place suggestions and their coordinates come from Apple Maps, which receives the text you type into the place field under Apple’s privacy policy. When a photo or video you are posting from the iPhone app has a location, the app also asks Apple’s geocoding service for the name of the town or region there, so that it can suggest it (“Use photo location”); Apple receives those coordinates under its privacy policy. If you accept the suggestion, the point attached to the post is the named place’s own, not the spot where the photo was taken. When you open a tagged place, or an event that has a location, in the iPhone app, Apple receives that place’s name or coordinates to look it up and show it on a map. On Android, place suggestions come from the geocoding service built into your phone (on most phones, Google’s), which receives the text you type under that provider’s privacy policy; a phone without one shows no suggestions. Neither app reads where your phone is.

(f) Finding friends from your contacts (optional). If you choose to find people you know, the app hashes the email addresses and phone numbers in your address book on your phone (SHA-256, one way) and sends only those hashes, at most 10,000, to our servers, which compare them against the hashes of Passboards users’ own emails and phone numbers and return the matches. Names and raw addresses never leave your phone, and we do not keep the hashes you upload. We do store a hash of your own account email (and of a phone number, if one is ever on your account — the app does not ask for one today) so that friends can find you the same way. You can turn this off with the “Findable by my contacts” switch, in Find friends in either app or in Settings on passboards.com/app; when it is off, nobody can find you through their contacts. Both apps ask first: the iPhone app through iOS’s contacts permission, and the Android app through a screen that explains this, followed by Android’s contacts permission. The app reads your contacts only when you tap “Connect your contacts”, never in the background, and keeps no copy of them, of the hashes or of the matches on your phone. You can withdraw the permission at any time in your phone’s settings. If you invite someone to a board by text message, in either app, you pick one contact in your phone’s own contact picker and the number goes straight to your messaging app; it is never sent to us.

(g) Push notifications and widgets. The app registers a push token for your device with Firebase Cloud Messaging (Google) and, while you are signed in, we store that token, whether or not you have allowed notifications, so that we can send notifications about activity on your boards, clubs and messages; your phone shows them only if you have allowed notifications. To issue the token, Firebase’s code creates its own identifier for this installation of the app, which Google handles under its privacy policy. When you sign out, the app asks Firebase to cancel the token. Turning notifications off in your phone’s settings (iOS Settings, or Android Settings › Apps › Passboards › Notifications) stops them being shown. In the app (Settings › Notifications) you can also choose which kinds of notification you get, set quiet hours, and mute notifications from a single board. We store these choices on our servers, together with your phone’s time zone (for example, “Europe/London”), which the app reports while you are signed in so that quiet hours follow your local time; we use them only to decide whether, and how quietly, to send you a notification. When a board has event dates, its members may get up to three notifications about it (when the event starts, a last call to add photos, and when the album is complete), and we keep a record of which of these we sent or skipped for you and why. If you add a Passboards widget to your iPhone’s Home Screen or Lock Screen, the app tells our servers which boards or clubs it shows on that device, identified by the device’s push token, so that a new post can prompt the widget to refresh; these refresh messages carry no content. The Android app has no widgets.

(h) Settings and choices. Whether your profile is private, whether you are discoverable by contact, whether read receipts are on, whether your supporter crown is shown, whether your photos are kept out of recaps (see (s)), the people you have blocked (see (t)), and your email preferences.

(i) Direct messages. The content of your one-to-one messages, reactions, posts, boards and profiles you share into a chat, and read receipts (if you have them on; turning them off also stops you seeing other people’s). Messages are stored on our servers so they can be delivered and shown on your devices; they are not end-to-end encrypted. Deleting a conversation removes it from your account; the other person’s copy stays with them.

(j) Premium subscription records. If you buy Passboards Premium (when available), Apple handles the payment and we never see your card or bank details. Apple sends us a record of the subscription: transaction identifiers, the product you bought, purchase and expiry dates, whether it will auto-renew, and status changes (renewal, cancellation, billing problems, refund). We keep this history so we know what you are entitled to and to reconcile with Apple. Neither Premium nor the Board Pass (a one-time purchase a host could make for one board) is on sale today; if we offer the Board Pass, Apple would send us the same kind of record for it (transaction identifiers, the product, the purchase date and any refund), which we would keep with the board and the account that bought it. Nothing can be bought in the Android app.

(k) Email. We use your email address to send account emails (such as a welcome email, the password-reset emails you ask for, and a one-time “welcome back” email with a password-reset link if we have had to restore your account) and occasional product updates, but only if you have agreed to them: if you sign up in the iPhone app (version 2.0.8 or later) with a US App Store account, the sign-up screen tells you we will send them and you can opt out there or at any time in Settings › Notifications › Email; everyone else, including everyone who signs up in the Android app, gets them only after turning them on (the Android sign-up screen has a box for it, which starts unticked). Product-update emails have an unsubscribe link, and mail apps can unsubscribe you with one click. If the address belongs to an account, the link opens an email preferences page on passboards.com where, without signing in, you can turn “News and tips from Passboards” and “Board activity emails” on or off, or stop all optional email; these are the same choices as Settings › Notifications › Email in the app, and we store them with your account. Our own emails are sent through Microsoft 365 (Microsoft), which receives your email address and the message in order to deliver it; we record when an email was sent and whether it was refused, and we stop sending to addresses that bounce or complain. When you ask for a password reset in the iPhone app (version 2.0.7 or later), in the Android app or on passboards.com, our server asks Firebase (Google) for a one-time reset link and sends it to you in our own email through Microsoft 365. Password-reset emails requested from earlier versions of the iPhone app, or while our own email is unavailable, are sent by Firebase (Google). From version 2.0.8, the iPhone app also tells our servers the country of the App Store account on your iPhone (for example, “USA”), as Apple reports it, and we store the latest one, and when it was reported, with your account. We use it only for email: to decide which of the two rules above applies to you before we send a product update. It is not your location, and it is removed when you delete your account. The Android app does not send a store country.

(l) Support. When you use the support form on our website we receive the name, email address and question you type, by email to support@passboards.com. If you email us directly, we receive what you send. “Contact support” in the app starts an email in your own email app with the app version and your phone model filled in (the Android app adds the Android version); nothing is sent unless you send it.

(m) Technical data. Our servers see your IP address with each request and use it to rate-limit sign-ups, prevent abuse and diagnose problems. Requests reach us through Cloudflare, which sees the same connection data as a network provider. We keep ordinary server logs for up to about 30 days.

(n) Usage analytics. The app tells our own servers how it is used, so that we can see what works and what does not. It records events such as opening the app, starting or finishing sign-up or signing in, opening an invite link or entering an invite code (where in the app, and whether it was pasted or typed), being shown the join screen for an invite and whether you joined, an invite that did not work (a short reason), joining or creating a board or club, posting (whether it was a photo, video, music or text post, and how many items), an upload starting, finishing or failing (with a rough duration and a short failure reason, never the file), sharing photos to a board from the Photos share sheet (how many), the first-run steps (which board template you picked, whether you invited anyone and how, which checklist steps you finished, how many boards a welcome-back screen showed), being shown the tutorial and whether you skipped or finished it (how many pages you saw), sharing a link or a story card (2(w)), switching between the main tabs, searching (how many characters you typed, never the words), following someone, answering an event, the notification permission prompt and your answer to it, being shown the card that says an update is available and whether you tapped Update or Not now, being shown the store’s rating prompt (2(q)), setting up a Passboards widget (whether it shows a board, a club or recent posts, and its size), changing a notification setting (which setting, and whether it was turned on, off or changed), opening a notification (which kind it was), saving or exporting a board (to Photos or as a file, how many items, and whether it finished), making, sharing or posting a board recap (its length, and whether you shared it to Photos, Instagram, Messages or somewhere else), viewing Premium or the Board Pass or buying one (which product), and how many times the app crashed (a count only, from Apple’s MetricKit; crash reports themselves are described in 2(v)). The posting, Photos share sheet, upload, widget, recap, Premium and crash-count events come only from the iPhone app. Each event carries its time, a few short labels like these, the app and operating system version, a random identifier the app creates, and the account you were signed in to when it happened, if any. The random identifier is not an advertising identifier, is not shared with other apps and is not synced to your other devices. On iPhone it is kept in the keychain, so it stays on your iPhone if you delete and reinstall the app. On Android it is kept in the app’s private storage, is left out of backups and phone-to-phone transfers, and is erased when you uninstall the app or clear its data. Turning analytics off stops it being sent but does not delete it. We link an event to your account only if it was recorded while you were signed in to that account; events from while you were signed out carry only the random identifier. Events never include what you post or write, names, email addresses, your messages, your contacts, your location, or which posts, boards or people you looked at. No analytics company is involved: the data goes only to our servers, and we do not share it with advertisers or anyone else. While you are offline, the app keeps unsent events on your phone for up to 7 days (at most 1,000 of them) and then discards them. Analytics are on by default, and you can turn them off at any time in Settings › Privacy › Share usage analytics; the app then stops recording and sending them and deletes the unsent events on your phone. Our servers also record three kinds of event of their own, linked to your account: a Premium subscription changing status (for example, it renews, expires or is refunded, with the plan and its new status), an email being sent to you (the kind of email and the service that sent it, not its content or your address), and a board-gathering notification being sent to you (which one it was and whether the board belongs to a club, not which board). These are part of running the Services, so the setting does not turn them off. All of these events are kept for 180 days (see Section 7). This is separate from the subscription history in 2(j) and the email records in 2(k).

(o) The website. Our public web pages set no cookies and run no analytics. The only cookies on passboards.com are the sign-in cookie for signed-in members using passboards.com/app, an appearance cookie (pb_theme) that the web app sets if you choose Light or Dark in its settings, which stores only that choice for up to one year and is removed if you choose System, and a sign-in cookie for our staff on the private admin console. The web app also keeps an unposted text-post draft in your browser’s local storage (see (b)). To show music artwork and club covers, our web pages fetch them through our own server, and we draw preview images for shared text posts on our server from the post’s public excerpt. What someone without an account can see of public boards, profiles and posts on the website is described in Section 5.

(p) Music links. When you share an Apple Music or Spotify link, our servers look up that item’s public details from Apple (the iTunes Search and Lookup services, and public Apple Music playlist pages) and from Spotify (its oEmbed service and public page data). For a Spotify song or album, we also search Apple’s catalog by its title and artist to find a matching preview. These requests carry only the link, the catalog ID or the title and artist, not who you are. We store the title, artist, album, artwork address and preview address. Details that came from Spotify are refreshed daily, and if they can’t be refreshed for 7 days, their title, artist, album and artwork are removed. In the app, artwork and song previews load directly from Apple’s and Spotify’s servers, which see your device’s IP address. On passboards.com, artwork loads through our own server, so they don’t. Your choice of music app (Settings › Music) is stored only on your phone. To decide which of the Apple Music and Spotify buttons comes first, the Android app checks whether those two apps are installed on your phone; the answer stays on the phone.

(q) Rating prompts. Now and then the app may ask you to rate Passboards using the store’s standard rating prompt (Apple’s on iPhone, Google Play’s on Android), after a moment such as a board you are on reaching several contributors: never in your first few days or sessions, never more than three times a year, and never right after something went wrong. Your rating or review goes to Apple or Google under that company’s privacy policy; neither tells us whether or how you rated. The app keeps on your phone when it last asked, and records that the prompt was shown in usage analytics (2(n)). On iPhone you can stop these prompts in iOS Settings (App Store › In-App Ratings & Reviews).

(r) Safety checks and reports. When you upload a photo, video, club cover or profile photo, our servers compute a short numeric fingerprint of the picture (for a video, of several frames) with PDQ, a perceptual-hashing method. The fingerprint cannot be turned back into the picture; it is kept with the file and deleted when the file is. Fingerprints let us compare uploads with lists of fingerprints of known child sexual abuse imagery that child-safety organizations share with online services. We do not hold such a list yet; when we add one, new uploads are compared with it as they arrive, and earlier uploads are checked against it once. A match hides the post and withholds its files from everyone straight away, and goes to our staff for review. When someone reports a post, comment, board, club, person or conversation, our staff can see the reported item, the reports about it and the account behind it — including content that is otherwise private, such as a post on a private board or the most recent messages of a reported conversation. Every action our staff take in our moderation tools is recorded with its reason, and every time they view media there, it is logged. When our staff take a post down, its files are withheld from everyone until the post is restored or deleted. If our staff confirm apparent child sexual abuse material, we preserve that material and the related account records for a year (longer while a report is being made), even if the post or account is deleted, and report it as described in Section 6. Comments our staff remove are kept in our moderation records.

(s) Recaps. The iPhone app can make a short recap video of a board, with music that comes with the app. The recap is made on your phone from the photos and videos you can see on that board; our servers only send the app the list of those posts. Other members of a board you share can make recaps that include your photos and videos from it. A recap someone posts back to the board is a video post like any other, visible to the board’s members; for each posted recap we record which posts it was made from and who posted them, so that if one of those posts is deleted or removed, the recap is taken down, and if two people have blocked each other, a recap containing one’s posts is hidden from the other. If you turn on Settings › Recaps › “Keep my photos out of recaps”, your photos and videos are left out of the recaps other people make from then on (they still count in a recap’s totals); we store that choice on our servers. The Android app cannot make recaps; a recap someone posts to a board is a video post, so members using the Android app or the web see it like any other, and the “Keep my photos out of recaps” switch is in the Android app too.

(t) Blocking and removals. When you block someone, we store the block. Neither of you then sees the other’s posts, comments, likes and other content in the app or on passboards.com/app, and this works in both directions whoever made the block. A like count shows only the likes you can see, so two people can see different counts on the same post. When a board’s host or admin, or a club’s host, removes someone, we remember the removal so that an old invite link can’t bring them straight back; the removal is forgotten if they accept a direct invitation back. Someone who leaves on their own is not remembered this way.

(u) Saving and exporting a board. In versions of the apps that include it, anyone who can see a board can save its photos and videos to their phone’s photo library or gallery, or export them as a file. The file is a zip that also lists, for each post, its title, caption, text, date and place and the name and username of the person who posted it. Our servers send the app a list of the posts that person can see (leaving out posts across a block) with short-lived download links; the app does the downloading, and apart from the usage analytics event in (n) we store nothing about the export. On Android, saved items go to a Passboards album in your gallery. In both apps, an export in progress or a finished export file stays in the app’s private storage on your phone until you start another, clear it or sign out.

(v) Crash reports (iPhone only). If the iPhone app crashes, it sends a crash report to Google Firebase Crashlytics so we can find and fix the problem. A report contains the technical details of the crash (which part of the app failed and the steps leading to it), your device model, iOS and app version, and a random identifier for this installation of the app. It does not include your name, email address, username or posts, we do not attach your account to it, and it is not used for advertising. The Android app sends no crash reports.

(w) Story cards. In versions of the apps that include it, you can turn a post or a board into a picture to share to your Instagram Story or through your phone’s share sheet. The card is made on your phone. When you share it, your phone hands the picture to Instagram or to the app you pick, under that app’s privacy policy; for a short video post you can send the video itself to Instagram instead. To Instagram the app also passes Passboards’ public Meta app identifier, which is the same for everyone. We do not receive the card, we send nothing to Meta ourselves, and neither app contains Meta software. You can also save the card to your photos or copy its link. The app sends our servers only a usage event (2(n)): that you chose to share or save a card of a post or of a board, or copied its link, where in the app you started, the card’s style, and where the card went (to Instagram, to the share sheet, to your photos or as a copied link, and, if a card meant for Instagram went to the share sheet, why, for example that Instagram is not installed). The event never says which post or board.

3. What We Do Not Collect
- Your phone’s location. Neither app asks for or uses your phone’s location services. The only location data we hold is what is described in 2(d) and 2(e).
- Advertising identifiers (Apple’s IDFA or the Android advertising ID) or any advertising SDK. Passboards has no ads today.
- Your address book in readable form (see 2(f)). Neither app reads your contacts unless you choose to find friends from them, and then only hashes leave your phone.
- SMS or text messages.
- Data about you from data brokers or other companies.
We do not sell your personal information, we do not “share” it for cross-context behavioral advertising, and we do not track you across other companies’ apps or websites.

4. How We Use Your Information
- To run the Services: show your boards and posts to the right people, deliver messages and notifications, match contacts you ask us to match, and keep your Premium entitlements right.
- To keep the Services safe: prevent spam and abuse, enforce our Terms of Service, respond to reports and flags, and protect our systems.
- To communicate with you: account emails, replies to support requests, and product updates you have agreed to.
- To improve the Services, using the usage analytics described in 2(n), unless you turn them off.
- To meet legal obligations.

5. Who Can See Your Content
- Public boards and public profiles can be found and viewed by anyone with a Passboards account, through the search and Explore features of the app and, signed in, on the web at passboards.com/app. Without an account, a link to a public board or public profile opens a page on passboards.com that only offers to open it in the app or to sign in; it does not show the board’s or profile’s posts. The link’s preview (its title, a short description where there is one, and a preview image) can be read by anyone who has the link. A link to a post on a public board works the same way; for a music post the page also shows the song, album or playlist and its artwork, and for a text post it shows the note, or an essay’s title and excerpt, with the author’s username. When a share link to one of them is pasted into a message or social app, it shows the board or profile title and a preview image. Public clubs can be found through the app’s search and viewed on the web at their address (passboards.com/c/<address>), which shows the club’s name, mark, cover, description and member count. A private club’s address shows only an invite-only card to anyone without a valid invite, and never confirms the club exists.
- Private boards are visible only to the people who have been added to them, except for the invite-link preview described next. Private profiles are visible only to approved followers. Private clubs are visible only to their members, and can be joined only by invitation — an in-app invite, or an invite link created by the club’s host or co-hosts.
- A board’s owner or admins can create invite links (passboards.com/b/<code>). Anyone who has a link — including anyone it is forwarded to — can open it without an account and see the board’s title, its cover (on a private board, only a cover the host chose; on a public board, its latest post if no cover was chosen), how many members it has, and the first names of up to three members, starting with the person who made the link (or their username, if they have not given a first name); for a public board, also its caption. When a link is pasted into a message or social app, its preview shows the title, the cover and the member count. The link lets that person join the board with the role it grants, and nothing else about a private board is shown until they do. Hosts can make a link expire or stop after a number of uses, and can turn it off at any time; after that the page says only that the link is no longer active and does not reveal whether the board exists. Invite-link pages are kept out of search engines.
- Posts you make to a board that belongs to someone else are visible to that board’s members, and stay on the board if you leave it. Messages you send in a club chat stay in the chat if you leave the club. Deleting your account removes your posts and comments everywhere; messages you sent remain visible to the people you sent them to, attributed to a deleted account.
- If you share a post with a club, that club’s members can see the post, its comments and its likes; only members see the tag. A club’s hosts can remove it from their club.
- In the app, links in text posts open only after the reader confirms where they go.
- In versions of the apps that include board export (2(u)), anyone who can see a board can save or export the photos and videos on it, including yours; an exported file also lists each post’s caption and date and the name of the person who posted it. Members who subscribe to Premium (when available) can download posts on boards they belong to, including yours, at the best quality available.
- Anyone who can see a public board can make a story card (2(w)) of it or of a post on it. For a private board, or a public board owned by a private account, only people in it can, and the app asks them first: the owner or an admin (on a club board, a host of the club) can make a card showing its photos and members’ faces, or a card of any post with its author’s name; another member’s card shows the board’s name and only their own photos; an author can make a card of their own post. Whoever shares a card decides who sees it.
- Other members of a board can make recaps that include your photos and videos from it, and post them back to the board, unless you keep your photos out of recaps (2(s)).
- A supporter crown on a profile means only that the account pays for Premium. It is not a verification of identity.
Please use care before revealing anything that identifies you in the real world in a public board or profile.

6. Who We Share Information With
We share information only with the service providers we need to run Passboards, each under a contract that limits what they may do with it:
- Google (Firebase Authentication and Firebase Cloud Messaging, and on iPhone Firebase Crashlytics) — sign-in, push notifications and, on iPhone, crash reports.
- Microsoft (Microsoft 365) — sending our emails, including password-reset emails; it processes your email address and the message.
- Cloudflare — the network in front of our servers (content delivery, DNS and tunneling); it processes connection data such as your IP address.
Apple processes your App Store purchase of Passboards Premium under its own privacy policy and sends us the subscription record described in 2(j). Apple (Apple Music / iTunes) and Spotify receive lookup requests from our servers when a music link is shared, and serve artwork (and, from Apple, song previews) to your device in the app, under their own privacy policies (see 2(p)). Apple Maps and Apple’s geocoding service provide place suggestions and maps in the iPhone app under Apple’s privacy policy, and your phone’s geocoding service provides place suggestions in the Android app (see 2(e)). If you share a story card to Instagram (2(w)), your phone gives it to the Instagram app at your request; Meta is not one of our service providers, and we send it nothing. Your data is otherwise stored on servers we operate ourselves in the United States. If our staff confirm apparent child sexual abuse material (2(r)), we report it, with information about the account that uploaded it, to the National Center for Missing & Exploited Children (NCMEC), as US law requires; NCMEC may share reports with law enforcement. We may also disclose information if the law requires it, to protect the safety of a person, to enforce our Terms, or as part of a merger, acquisition or sale of the company, in which case we will tell you before your information becomes subject to a different privacy policy. We do not sell personal information.

7. How Long We Keep It, and Deleting Your Account
- Content you post stays until you delete it or your account. Deleting a post also deletes its private capture coordinates (2(d)) and any stored original.
- You can delete your account in the app under Settings › Account Deletion (or by emailing support@passboards.com from your account email). The steps for both phones, and for deleting without the app, are at passboards.com/delete-account. In the app, deletion is immediate; by email it can take up to 30 days, because we first confirm that the request is yours. Either way it is permanent: your profile and photo, the boards you own and everything on them, your posts and comments on other people’s boards and on club boards, your likes, saves, follows, notifications, push tokens, email preferences, your date of birth if you added one, and any stored originals are removed from our live systems; your contact hashes stop being matchable; and your username and email address become available again. Your text posts (with their titles and body text) and music posts are deleted like your other posts, and so are your posts’ tags in clubs. Clubs you own are deleted, and their addresses (handles) are retired: they are not given to another club. A board or an event you created inside a club you do not own belongs to that club and stays; your posts on it are deleted. Text-post drafts on the phone you delete your account from are removed too. Direct messages and club-chat messages you sent remain with the people you sent them to, shown as coming from a deleted account, so that their side of the conversation is not lost. Your subscription records are deleted too (Apple keeps its own record of your purchases), and so are the usage analytics events linked to your account (2(n)); we keep only an anonymous log that emails were sent, with the address and content removed.
- Usage analytics events (2(n)) are kept for 180 days. After that we keep only daily totals (for example, how many times the app was opened that day, and by how many devices and accounts), which identify no one. Events recorded while you were signed out are not linked to your account, so deleting your account does not delete them; they expire after 180 days like the rest.
- Material and account records preserved after a confirmed child-safety match (2(r)) are kept for the period described there, even after the post or account is deleted.
- Records of the moderation actions our staff take (2(r)), and the log of our staff’s access to our moderation tools, are kept after the content or account they concern is deleted, so that we can show how a report was handled and protect the Services.
- If your email address ever bounced or you reported one of our emails as spam, we keep that address on a suppression list so we never email it again, even after account deletion.
- Backups. We back up our database every night. Daily backups are kept for 14 days and weekly backups for up to 8 weeks. Copies are also exported to offline drives we keep ourselves, not to any cloud service; on those drives daily backups are removed after 90 days and weekly backups after a year, and media files you delete are held for 30 days before removal. Something you delete can therefore remain in a backup for up to about two months, and on an offline copy for up to a year, before it is gone everywhere. Backups are used only to recover from a failure, never to restore deleted accounts.
- Deleting your account does not cancel a Passboards Premium subscription; cancel it in your Apple Account (formerly Apple ID) subscription settings.

8. Passboards Premium and Stored Originals
If you subscribe to Premium (when available), the original files of the photos and videos you post (metadata-stripped, up to 4 GB each) are kept in addition to the standard copies, and you can download any post you have access to at the best quality that exists for it. If your subscription ends, we do not delete or downgrade the originals already stored because of that; new posts keep only the standard copy, and downloads stop until you subscribe again. Originals are deleted when you delete the post or your account.

9. Children
Passboards is for adults. You must be at least 18 to create an account, and we do not knowingly collect information from anyone under 18. If we learn that an account belongs to someone under 18, we delete it and its information. The age checks described in 2(a) run on your phone and their answer is not sent to us: when one shows that the person using the phone is under 18, the app does not create an account, or stops working on that phone, and we are not told. If you believe a child is using Passboards, email support@passboards.com.

10. Your Choices
- Profile privacy, read receipts and “Keep my photos out of recaps” are switches in the app. “Findable by my contacts” is a switch in Find friends in the app and in Settings on passboards.com/app. The supporter crown switch is in the iPhone app and in Settings on passboards.com/app; the Android app does not have it yet.
- Which kinds of notification you get, quiet hours, and muting a single board are choices in the app (Settings › Notifications, and on each board).
- Your preferred music app (Settings › Music) is a choice in the app.
- On iPhone, which accounts’ posts can appear in Passboards widgets (Settings › Widgets) is a choice kept only on your phone.
- Usage analytics can be turned off in the app under Settings › Privacy › Share usage analytics.
- Push notifications can be turned off entirely in your phone’s settings (iOS Settings or Android Settings).
- Product-update emails have an unsubscribe link in every message, which opens your email choices on passboards.com (see 2(k)).
- You can edit your name, bio, date of birth and profile photo in the app (a username cannot be changed in the app today; see Section 11), block and unblock people, and delete individual posts, comments, boards and conversations at any time.

11. Your Rights
Wherever you live, you can ask us to tell you what personal information we hold about you, to correct it, to delete it, or to give you a copy of it in a portable form. Most of this you can do yourself in the app; for anything else, email support@passboards.com from the email address on your account. We will verify that the request comes from the account holder before acting on it, respond within the time the law allows (normally 30 days, or 45 days for California requests), and we will never treat you differently for exercising your rights. You may use an authorized agent to make a request on your behalf; we will ask for proof that you authorized them.

California residents (CCPA/CPRA). In the last 12 months we have collected the categories of personal information described in Section 2: identifiers (name, username, email, hashed phone/email, account and device identifiers, IP address), account and subscription records, the content you post and send (including photos and videos, which may contain your image), the private capture coordinates described in 2(d), usage data from the app’s analytics (2(n)), and the settings you choose. We collect it from you, from your device, and from Apple and Google in the course of sign-in and purchases, for the purposes in Section 4, and disclose it to the service providers in Section 6 for business purposes only. We do not sell personal information, we do not share it for cross-context behavioral advertising, and we have no actual knowledge of selling or sharing the personal information of anyone under 16. We do not use or disclose sensitive personal information for purposes other than providing the Services. You have the right to know what we collect and how we use and disclose it, to delete it, to correct it, to limit the use of sensitive personal information, and not to be discriminated against for exercising these rights. To exercise them, email support@passboards.com with “California privacy request” in the subject line, or use the tools in the app.

Residents of other US states with privacy laws have the same rights described above. If we refuse a request, you can appeal by replying to our decision, and we will tell you how to complain to your state attorney general.

European Union, EEA and United Kingdom residents (GDPR / UK GDPR). Our legal bases are: performance of our contract with you (running the Services you signed up for, including Premium); your consent (matching your contacts, push notifications and product-update emails — each of which you can withdraw at any time in the app or in your phone’s settings); our legitimate interests in keeping the Services secure and free of abuse, in communicating with you about your account, in understanding how the app is used through the limited first-party usage analytics described in 2(n) (you can object at any time by turning off Settings › Privacy › Share usage analytics), and in holding the private capture coordinates described in 2(d) so that a future location feature would not require you to re-upload your photos (you can avoid this by removing the location from a photo before posting it), balanced against your rights; and compliance with legal obligations. You have the rights to access, rectify, erase and port your data, to restrict or object to processing, and to withdraw consent, and you may lodge a complaint with your national data protection authority (in the UK, the Information Commissioner’s Office). We do not make decisions about you by automated means that have legal or similarly significant effects. We have not appointed a representative in the EU or the UK; contact us directly at support@passboards.com. Your data is processed in the United States, as described in Section 13.

12. Security
Traffic between the app, the website and our servers is encrypted in transit. The Android app refuses unencrypted connections to every host. Passwords are stored by Firebase Authentication in hashed form; our servers pass your password to Firebase only when you sign up, or sign in or set a new password on passboards.com, and never store it. Media is served through signed, expiring links. Access to production systems and backups is limited to the people who operate Passboards. No system is perfectly secure; if we learn of a breach affecting your personal information we will notify you and the authorities as the law requires.

13. Where Your Data Lives and International Transfers
Our servers are in the United States, and the providers in Section 6 process data in the United States and, in some cases, in other countries where they operate. If you use Passboards from outside the United States, your information is transferred to and processed in the United States, whose laws may differ from those of your country. Where the law requires a specific safeguard for such transfers (for example, for EU, EEA, UK or Swiss residents), we rely on the mechanisms recognized under that law, such as the standard contractual clauses in our agreements with those providers.

14. Changes to This Policy
We will update this policy when the Services change in a way that affects your information. We will post the new version here with a new “Last Updated” date and, for material changes, tell you in the app or by email before they take effect. Where a change needs your consent under the law where you live, we will ask for it.

15. Contact
Questions, requests or complaints: support@passboards.com, or by mail to Passboards, Inc., PO Box 127, Danville, CA 94526, United States.