Privacy Policy

Introduction

Pass A Link ("Passa," "we," "us," or "our") operates passalink.com and related mobile applications. This Privacy Policy explains how we collect, use, and protect information when you use our one-time secret sharing service.

We designed Passa with a zero-knowledge architecture: secrets you share are encrypted on your device before they reach our servers. We cannot read the content of your secrets.

Information We Do Not Collect

We do not receive or store: • The plaintext content of secrets you create • Encryption keys (keys stay in the URL fragment and are never sent to our servers) • General keystrokes from the Passa keyboard (we only process text you enter in our dedicated secure field when creating a link)

If you use Passa without creating a link, we do not collect what you type in other apps.

Information We Collect

When you use our service, we may collect:

**Secret metadata (required to operate the service)** • Encrypted ciphertext and initialization vector (IV) • Random link token • Expiration time and view limits • View count

**Link analytics (for link creators)** • Page visits and reveal events on links you create • Masked IP address (e.g. last octet hidden), browser name, OS, locale, and language • Full IP addresses are processed server-side only for abuse prevention and returning-viewer detection — they are not shown in the app or dashboard

**Technical data** • Hashed IP address for rate limiting and abuse prevention • Timestamps of create and retrieve events

**Account and payment data (Pro tier, when available)** • Apple account receipt data for subscription validation • Email address if you contact support or create an account

**iOS app data stored on your device** • Link history metadata (token, creation time, status — not secret content) • App settings (default TTL, max views) via App Group storage

How We Use Information

We use collected information to: • Store and deliver encrypted secrets according to your chosen TTL and view limits • Enforce rate limits and prevent abuse • Operate, maintain, and improve the service • Respond to support requests and legal obligations • Validate subscriptions (Pro tier)

We do not sell your personal information. We do not use secret metadata for advertising.

Zero-Knowledge Encryption

Secrets are encrypted using AES-256-GCM on your device (Web Crypto API in the browser, CryptoKit on iOS). The decryption key is embedded only in the URL fragment (#key) and is never transmitted to our servers.

We cannot decrypt your secrets even if compelled. If you lose the full URL including the fragment, the secret cannot be recovered.

Data Retention

Encrypted secrets are hard-deleted when: • The maximum view count is reached • The expiration time passes • You manually revoke a link (where supported)

Rate-limit records are deleted after approximately 2 hours. Support emails are retained as long as needed to resolve your inquiry.

Third-Party Services

We use third-party providers to operate the service, including: • **Vercel** — hosting and infrastructure • **Vercel Postgres / database provider** — encrypted secret storage • **Apple** — App Store distribution and in-app purchases • **Sentry** (optional) — error monitoring (no secret content)

These providers process data on our behalf under contractual obligations. Links you share are delivered through third-party chat apps (Zalo, Messenger, Slack, etc.) — their privacy policies apply to messages you send.

Full Access Keyboard Permission (iOS)

The Passa keyboard extension requests Full Access to make network requests when creating a secure link. Full Access is required by Apple for keyboard extensions that connect to the internet.

We use Full Access only to encrypt your secret locally and call our API. We do not log, transmit, or store keystrokes from other apps or fields.

Your Rights

Depending on your location, you may have rights to access, correct, delete, or restrict processing of personal data we hold about you (e.g., support correspondence, account data).

Because we cannot identify secret content, we cannot retrieve or delete a secret without the link token. You may revoke active links from the app history where available.

Contact privacy@passalink.com to exercise your rights.

Children

Passa is not directed at children under 13 (or 16 in the EEA). We do not knowingly collect personal information from children. Contact us if you believe a child has provided personal data.

International Transfers

Our infrastructure may process data in the United States and other countries where our providers operate. We take steps to ensure appropriate safeguards for cross-border transfers.

Changes

We may update this Privacy Policy from time to time. We will post the revised policy on passalink.com/privacy and update the effective date. Continued use after changes constitutes acceptance.

Contact

Questions about this Privacy Policy: • Email: privacy@passalink.com • Abuse reports: abuse@passalink.com • Website: https://passalink.com