Privacy Policy
Last updated November 4, 2026
Passport helps students studying abroad see when their friends' travel plans overlap. This policy explains what we collect, why, and the choices you have.
What we collect
We collect only what you give us to run Passport. We don't collect your live location, contacts or browsing activity.
| What | Examples | Where it's stored |
|---|---|---|
| Account | Email address and password (stored only as a secure hash) | Our database |
| Profile | Name, username, semester base city, semester dates, optional university and program, optional profile photo, and your confirmation that you're 18 or older | Our database |
| Trips | Destination city, dates, and who can see each trip | Our database |
| Friends and groups | Friend requests, friendships, blocks, people you've hidden your plans from, and group memberships | Our database |
| Photo posts | Photos you post (1–5 per post), captions, tags, likes and reports | Our database and photo storage |
| Settings | Privacy and notification preferences | Our database (and your phone) |
| Messages to support | Anything you send to [email protected] | Our support inbox |
Photos: before upload, the app resizes each photo and saves a new copy, which removes location and other camera data.
We don't use advertising trackers or analytics tools.
How we use it and who can see it
We use your information only to run Passport: to sign you in, show your plans, find overlaps with friends, show photos to the people you choose, and answer support requests. We never sell it or use it for advertising.
- Your trips are visible only to friends who have accepted you, unless you mark a trip "Only me" or hide your plans. Joining a group never shares your trips or photos by itself.
- People who aren't your friends can see only your name, username and university (if you added one). People in a group with you also see your profile photo.
- Friends-of-friends matching is off unless you turn it on. When both of you opt in and share a current mutual friend, each of you sees only the shared city, the overlapping dates and the mutual friend.
- Photos are visible to the poster's accepted friends for 7 days, then move to the poster's private archive. Tagging someone does not widen who can see a photo.
- Overlap alerts are worked out from the plans you and your friends have chosen to share.
- We assume you're at your semester base on dates without a trip. These are plans you enter, never your live location.
- Reports of a post are sent to our support team so we can review them.
- We may disclose information if the law requires it, or to protect someone's safety.
Services we use
These companies process data on our behalf, only to provide their part of the app.
| Service | What it does | Data it handles |
|---|---|---|
| Supabase | Database, sign-in and photo storage; servers in the eastern United States | Everything in our database and photo storage |
| Mapbox | Draws the map | Anonymous map usage data, which you can turn off in Sharing & privacy. Mapbox does not receive your trips, friends or profile |
| Resend | Sends account emails (sign-up and password-reset codes) and report notices to our support team | Email addresses and the email's content |
| Cloudflare | Hosts this website and forwards email to our support inbox | Website requests and support emails |
| Apple | Distributes the app; Sign in with Apple and push notifications when available | As described in Apple's privacy policy |
Because our servers are in the United States, your information is transferred there if you use Passport from another country, for example while studying abroad.
Your choices and rights
You control your information from inside the app, and you can delete everything at any time.
- Edit your profile in My profile → Edit profile, and your trips in My trips.
- Limit sharing by marking a trip "Only me", hiding all your plans, or hiding them from a specific friend. You can also block people, and turn friends-of-friends matching, alerts and Mapbox usage data on or off.
- Delete your account in My profile → Delete account. This immediately and permanently deletes your login, profile, profile photo, trips, friendships, group memberships, photo posts, tags and likes. Routine database backups may keep copies for a short period until they are overwritten.
- Ask for a copy, a correction or deletion by emailing [email protected]. We aim to reply within 30 days.
- If you're in the EU, UK or a similar region, you have the right to access, correct, delete, restrict or object to the use of your data, and to receive it in a portable format. We rely on contract (to provide the app you signed up for) and your consent (for optional features like friends-of-friends matching). You can also complain to your local data protection authority.
How long we keep data: for as long as your account exists. Photos leave the Feed after 7 days and stay in your private archive until you delete them or your account. Reports of harmful content may be kept as long as needed to handle them safely.
Age, security, changes and contact
- Age: Passport is only for people 18 and older. If we learn that someone under 18 has an account, we'll delete it.
- Security: Data is encrypted in transit, and our database only lets each person read and change their own data, plus what friends have chosen to share with them. No system is perfectly secure; tell us right away if you suspect a problem.
- Changes: If we change this policy in a meaningful way, we'll tell you in the app before the change takes effect.
- Contact: Passport is run by Thomas Fitzgerald. Email [email protected] with any privacy question.