Passport

Passport Privacy Notice

Last updated: October 19, 2026. Applies to the limited iPhone beta and Passport's published policy and support website.

Passport is operated by Kevin Garand. Privacy questions and requests: kevingarand@berkeley.edu. This beta is for adults aged 18 or older. No separate invite code is required: an Apple-authenticated account can join after accepting the beta terms while signups are open and the 50-account limit has not been reached. Admission does not verify membership in a particular TestFlight group or guarantee that other testers are people you know.

What we collect and why

Who can see information

Your Passport starts private. Home settings, passive history, hidden recommendations, and saves are not shared with other travelers. If you make your Passport public, approved profile and travel content can be viewed by other admitted testers. New or edited public content requires operator review. Comments you post on another visible item may remain visible even if your own Passport is private. Blocking restricts reciprocal access; it cannot recall a copy someone already downloaded or photographed.

Photos are held in a private storage bucket. Permitted viewers receive temporary links, which can continue working for up to five minutes after visibility changes. Authorized operators can access backend records for administration, moderation, and support. This service is not end-to-end encrypted.

Services used by Passport

We do not sell personal information or share it for cross-context behavioral advertising. This beta has no advertising, third-party behavioral analytics, or session-replay SDKs. Our app and policy website do not currently change their behavior in response to browser Do Not Track or Global Privacy Control signals; the no-sale/no-advertising-sharing practices above apply regardless of those signals. This does not limit privacy rights available under applicable law.

We may disclose limited information when legally required or necessary to address abuse, protect users, or enforce the beta rules. Service providers may process information outside your state or country. Providers handling personal data on Passport's behalf must provide the same or equal protection described in this notice and required by applicable law and Apple's privacy requirements, and use it only for the agreed services and permitted security or legal purposes. Providers also maintain their own privacy notices; those do not replace this notice for Passport's processing. Independently operated websites you choose to visit have their own practices.

Retention and deletion

Account and travel content is retained while needed to provide your account, unless you remove it or request deletion. Passive history is limited to the latest 500 events and a 90-day retention window. Place-search cache entries expire after 30 days. Routine maintenance removes expired operational records and resolved reports created more than 90 days ago; open reports may remain while an investigation is ongoing. Report text can remain after account deletion with account references removed; unnecessary identifying details are removed during review. Support correspondence is kept as needed to resolve a request and handle related security or legal issues, then deleted when no longer needed.

Removed, replaced, or abandoned photo uploads become eligible for cleanup once they are at least 24 hours old and no saved profile or Passport references them. Cleanup is performed by scheduled server maintenance; deletion is not instantaneous and failures can delay it. Account deletion separately attempts to remove all of that account's uploads before deleting the account. Security markers identifying retired photo paths remain until account deletion to prevent stale devices reattaching deleted media.

Use Edit profile → Account & safety → Delete my account to delete your account, associated app records, and uploads, and revoke the Apple authorization. You will confirm with Apple. Signing out or uninstalling is not account deletion. If deletion fails, the app tells you it is incomplete: retry or contact us. Limited abuse reports, provider logs, and restricted backups may outlast deletion from the active system. Backup and provider-log retention depends on the configured service and plan; contact us for the current periods. Backups are not used to restore deleted accounts to normal service without reapplying deletion.

Your choices and requests

Edit or remove your content, keep your Passport private, disable personalization, clear history, block/report travelers, or delete your account in the app. Contact Kevin Garand at kevingarand@berkeley.edu to request access, a copy, correction, deletion, or other rights available where you live. We may verify account ownership before responding; never send passwords, Apple codes, or access tokens. Some requests require retaining limited information for legal or safety reasons. This beta is not intended for children, and we do not knowingly collect their personal information; contact us if you believe a child has provided information.

Depending on where you live, you may also have rights to object to or restrict certain processing, withdraw consent where consent is the basis for processing, appeal a privacy-request decision, or complain to a privacy regulator. Contact us to exercise applicable rights; we will explain any refusal or exception. Accepting the beta terms does not waive those rights or automatically authorize a new, unrelated use of your information.

Changes to this notice

We update the date above when this notice changes. For material changes, we will provide an additional notice through the app or a contact method associated with your account before the new practices take effect, where required, and obtain any legally required consent. If the current handling of your data is unclear, contact us before sharing sensitive information.

Beta Terms and Community Rules · Support and Privacy Requests