Passport
Privacy policy · Effective 22 October 2026
This policy covers the Passport app for iPhone and the website at thepassport.app. It is written to be read, so it is short. The one-paragraph version: Passport reads your photo library on your phone and never uploads it. There is no account. The only thing that can leave the phone is anonymous diagnostics about how the app itself is running, and you can switch that off.
Passport is made and published by GRIND IT s.r.o., a company registered in Slovakia under company number (IČO) 50687573. For the purposes of the EU General Data Protection Regulation (GDPR), GRIND IT s.r.o. is the data controller. Write to hello@thepassport.app with any question about this policy or your data.
Passport asks for access to your photo library. With that permission it reads, on your phone, the date and the location recorded in each photo, and looks at the pictures themselves to choose which ones to show. From that it builds your trips, your stamps and your maps. All of this happens on the device, in the app's own storage.
Your photos, places and dates never leave your phone. Passport has no server of its own, uploads nothing, and we have no way to see your library, your trips or where you have been. Stamps come only from photos you took in a place; the app never reads your calendar, your email or your contacts.
You can limit or withdraw photo access at any time in the iPhone Settings app, under Privacy & Security → Photos. Deleting the app deletes everything it built.
Passport has no account and no sign-in. We do not know who you are. The app contains no advertising, no advertising identifiers and no third-party tracking: it does not track you across other apps or websites, and it never asks for the App Tracking Transparency permission because it has no use for it. We do not sell, rent or share personal data with anyone.
To find and fix crashes and to see which parts of the app are used, Passport can send anonymous diagnostics. This is on unless you turn it off: the switch is Share diagnostics and usage, under Passport in your iPhone's Settings app. When it is off, nothing is sent. Our legal basis for this while it is on is our legitimate interest in keeping the app working (GDPR Article 6(1)(f)).
What is sent: crash reports and app hangs with the technical trail that led to them; which screens and actions were used and how long the photo scan took; counts such as how many photos, trips, countries and stamps your booklet has; the app version, your iPhone model and iOS version, whether the phone is an iPhone Duo and whether it is open or closed; the language and time zone the phone is set to; and a random install identifier that the app creates on first open, which is not derived from you or your device and is discarded when you delete the app.
What is never sent: your photos, the coordinates or names of places, the list of countries you have visited, the dates of your trips, your name, or anything typed into the app. The code that sends diagnostics is built so that it cannot carry a coordinate, a place name or a country code.
Who receives it: crash reports go to Sentry (Functional Software, Inc.) and usage events to PostHog (PostHog, Inc.). Both process the data on our behalf in the United States, under the European Commission's Standard Contractual Clauses. Both are configured to discard your IP address on arrival and to record no location from it. The data is not linked to your identity and is not used for tracking. Crash reports are kept for 90 days and usage events for up to a year, after which they are deleted.
Passport is sold through the Apple App Store. Apple handles the payment and the receipt; we receive no card details, no name and no address. Apple's handling of that purchase is described in Apple's privacy policy. The app checks with Apple only whether it is a TestFlight or an App Store build, which carries no information about you.
thepassport.app counts its visits with Plausible, a privacy-first analytics service: it sets no cookies, stores no personal data and keeps only aggregate numbers such as how many people visited a page and which country they came from. Nothing is counted when you visit from a private network. The site is hosted by Vercel, whose servers see your IP address briefly in the course of delivering the page, as every web server does. The free wallpapers need no account and no email address.
If you write to hello@thepassport.app, we keep your message for as long as it takes to answer you and to keep a record of what was agreed.
Passport is not directed at children under 16 and knowingly collects no personal data from them. Because there is no account, the app holds nothing that identifies any person of any age.
Under the GDPR you may ask for access to, correction of, deletion of or a copy of personal data about you, object to our processing of it, and ask us to restrict it. Because the diagnostics are anonymous and carry no identity, we usually cannot connect a record to you; the surest way to exercise these rights is in your own hands: turn off Share diagnostics and usage to stop anything being sent, and delete the app to end the install identifier. Write to hello@thepassport.app for anything else, and we will answer within a month.
If Passport ever changes what it collects, this page changes first and the date at the top moves. We will not start collecting something new under the cover of an old date.
Passport is a keepsake, not a travel document. It is not connected to any real passport or state authority.