Privacy Policy

Effective and last updated: October 31, 2026

        Quick summary: PassJar keeps your passes and documents on your device.
        Three things can leave it: (1) when you create a Wallet pass, that pass's contents are sent
        to our signing server, signed and discarded straight away; (2) usage analytics,
        only if you allow them; and (3) feedback you choose to send. We don't sell
        or share your data, there are no ads, and we don't track you across apps.
    

1. Who we are

PassJar ("the App") is made by Tom Weiss, trading as Code VIA Technologies, in Israel ("we", "us"). We are the controller of the personal data described here. Contact: tom.weiss.t@gmail.com.

2. What stays on your device

The following is stored only on your device and is not sent to us:

Your saved passes: names, organisation names, card numbers, balances, expiry dates, notes and photos you add
App preferences (language, appearance)
Personal documents in the Documents section — see Section 6

Saved passes use standard iOS storage and may be included in your iCloud or computer backups like other app data. Passes you add to Apple Wallet are stored by Apple under Apple's terms.

3. Pass signing (when you create a Wallet pass)

Apple requires every Wallet pass to be cryptographically signed with our Apple Wallet certificate, which has to stay on a server. So when you generate a pass, the app sends that pass to our signing server over an encrypted connection. That includes everything that appears on the pass:

the pass name and organisation name
the barcode or QR value and the card number
the balance and expiry date
notes, website and phone fields you entered
colours, logo and any photo you chose as the pass artwork

The server checks the pass, signs it, sends it straight back and keeps nothing: the upload is processed in memory, is not written to a database or to disk, and its contents are not logged. We use it only to create the pass you asked for (legal basis: performing our contract with you, GDPR Art. 6(1)(b)). Every signed pass carries a note on its back saying it was created by the holder with PassJar and is not issued by the organisation named on it.

4. Usage analytics (only if you allow them)

The first time you open the app, it asks whether you want to share usage analytics. Nothing is sent, and no analytics ID is created, until you say yes. If you allow it, the app sends this short, fixed list of events to an analytics server we operate:

app_open (and whether it was a cold start) and first_launch
purchase — product id, Apple transaction id, and whether it was a purchase or a restore
paywall_view — where the upgrade screen was shown from
feature_used — the name of a feature, from a fixed list we define
error — an error domain and a numeric code
opt_out — recorded when you turn analytics off

With each event we record a random install ID created on your device (not an Apple identifier, not shared with other apps, not linked to your name or account), plus app version, iOS version, device model, language and 2-letter country. Because the install ID persists, this is pseudonymous data rather than anonymous data. Analytics never include pass or document contents, and have no free-text fields.

Legal basis: your consent (GDPR Art. 6(1)(a); ePrivacy Directive Art. 5(3)). You can withdraw it any time in Settings → Privacy: turning analytics off stops new events and asks our server to delete everything already collected from your install. "Delete My Analytics Data" does the same without turning analytics off.

IP addresses are not stored: an IP is hashed with a key that rotates daily, used only to limit abuse, and discarded.

5. Feedback you send

If you use Send Feedback, the text you type is sent together with the app and iOS version — no install ID. It is stored on our server and posted to a private Slack channel so we can read it. Please don't include card numbers, document details or other personal information. Legal basis: our legitimate interest in improving the app (GDPR Art. 6(1)(f)). If you email us, we keep the conversation in our mailbox for as long as needed to answer you.

6. Personal documents

The Documents section is a local vault for copies of identity documents and is held to a stricter standard:

Never uploaded by PassJar — not to the signing server, the analytics server or anywhere else — and never turned into a Wallet pass.
Encrypted at rest with iOS complete file protection, so they can't be read while your device is locked.
Locked behind Face ID, Touch ID or your passcode whenever you open the section.
Excluded from backups by default; you can turn backups on in the app.
Text recognition runs on your device (Apple's Vision framework) to suggest form values.
Widgets: if you add a Document Preview widget (Pro), a small thumbnail of the first page is kept in the app's shared widget storage so the widget can show it. It stays on your device, is excluded from backups, and is hidden on the Lock Screen and in StandBy.
You can export a document yourself with the share sheet; where it goes then is up to you.

7. Who processes data for us

Service	Purpose	Data
Railway Corporation (hosting)	Runs our signing and analytics servers	Pass contents (transient), analytics, feedback
Slack Technologies	Internal notifications	Feedback text; new-install, purchase and error notices (no install IDs)
Apple	App Store, purchases, Apple Wallet	Under Apple's own privacy policy

We do not sell or share personal data, use advertising networks or third-party analytics SDKs, or track you across other companies' apps and websites. Our providers may process data in the United States. Where data from the EU/EEA, the UK or Israel is transferred there, we rely on our providers' Standard Contractual Clauses or EU-US Data Privacy Framework certification, as applicable.

8. How long we keep data

Pass contents sent for signing: not kept — discarded when the request ends.
Raw analytics events: 90 days. Daily totals derived from them contain no install ID.
Install records (install ID, device model, OS, language, country): until 13 months after the install was last active.
Purchase records: 25 months.
Feedback: 180 days, on our server and in Slack.
When you delete your analytics data, we keep a one-way hash of the install ID so that delayed events can't recreate it. The hash can't be turned back into the ID.

9. Your rights

Depending on where you live — including under the GDPR, the UK GDPR, Israel's Protection of Privacy Law and US state privacy laws — you can ask to access, correct, delete or receive a copy of your personal data, restrict or object to its use, and withdraw consent at any time. Most data never leaves your device, so you control it directly in the app. For analytics use Settings → Privacy; for anything else, email us. Analytics aren't linked to your identity, so deleting them from the app is the reliable way to erase them.

You can also complain to a data protection authority — for example your local EU supervisory authority, the UK Information Commissioner's Office, or Israel's Privacy Protection Authority.

10. Children

PassJar is not directed at children under 13 (under 16 in the EU), and we don't knowingly collect their personal data. If you think a child has sent us personal data, contact us and we'll delete it.

11. Security

All network traffic is encrypted (HTTPS). Our signing server accepts only well-formed PassJar passes, is rate-limited, and keeps no pass contents. No system is perfectly secure; if a breach affecting your data occurs, we will notify you and the authorities as the law requires.

12. Changes

We update the date at the top when this policy changes. If a change means the app collects more than described here, we update this page before releasing that version of the app.

13. Contact

Email: tom.weiss.t@gmail.com
See also our Terms of Use and Support page.

PassJar — your passes, your device, your privacy