Privacy Policy

Who We Are

Passport.Me is operated by Magic Crystal Limited, a company incorporated in Hong Kong ("we", "us", or "our"). We operate the Passport.Me service, accessible at passport.me and passport.me (the "Service").

The Service functions as a personal data management tool that allows you to connect your Google account and cryptocurrency wallets, then authorize AI tools — such as Claude, ChatGPT, Gemini, and Cursor — to access your live data via the Model Context Protocol (MCP). You remain the controller of your personal data. Passport.Me acts as a data processor on your behalf — we provide the technical infrastructure and tools for you to manage, authorize, and disconnect access to your own data. We process your data only according to your instructions (connecting accounts, authorizing apps, configuring source permissions).

Our Role: Data Processor

Under data protection law, there is an important distinction between a data controller (who determines the purposes and means of processing) and a data processor (who processes data on behalf of the controller). For Passport.Me:

• You are the data controller. You decide what data to connect, which AI tools to authorize, what sources to enable, and when to disconnect access. Every data sharing action in Passport.Me requires your explicit direction.
• Passport.Me is the data processor. We provide the technical platform that executes your data-sharing instructions. We store your OAuth credentials, proxy API requests, and deliver data to the AI tools you have authorized — all on your behalf and under your direction.
• Limited controller role. We act as an independent data controller only for a narrow set of operational data that we determine the purpose of: session management, security audit logs, rate-limiting, abuse prevention, and compliance record-keeping. These processing activities are necessary to operate and secure the Service regardless of your specific data-sharing instructions.

Registered Address

Magic Crystal Limited
28 Wellington St
Central, Hong Kong

Privacy Contact

For all privacy-related inquiries, requests, and complaints:
Email: privacy@passport.me

EU / EEA and UK Data Protection Officer (DPO)

For users located in the European Economic Area (EEA) or the United Kingdom, we have appointed the following as our Data Protection Officer (DPO) under Articles 37–39 of the General Data Protection Regulation (GDPR) and the UK GDPR:

Financial Technology OÜ
Registrikood: 14703656
Harju maakond, Tallinn, Kesklinna linnaosa, Narva mnt 5, 10117, Estonia
Email: passport.me@fintech.ee (direct), or privacy@passport.me (forwarded to DPO)

You may contact our DPO directly for matters relating to GDPR or UK GDPR compliance, including data-subject rights requests, lawful-basis questions, and processing complaints. The DPO advises on, and monitors compliance with, our obligations under those regulations and cooperates with supervisory authorities on your behalf.

Affiliated Companies

Passport.Me is part of a group of affiliated companies that operate data-driven consumer products and services. Our affiliated companies include but are not limited to:

• Measurable Data Token Limited (BVI)
• Mobile Internet Limited (HK)
• Alternative Data Limited (HK)
• Alternative Data Limited (UK)
• Alternative Data Pte Ltd (SG)

Measurable AI ("MAI") is an enterprise-facing alternative data platform available at measurable.ai, which provides de-identified, aggregated consumer insights to subscribers.

How your data may be shared with affiliated companies is described in Section 6 (Who We Share Your Data With).

Data We Collect

We collect only data that is necessary to provide the Service. The following table describes all categories of personal data we collect, where we store it, and with whom it is shared.

2.1 Google Account Data

This data is stored in our gmail_connections database table. If you disconnect your Google account, your OAuth tokens are zeroed out, but your Google email address and identifier remain in our system to maintain audit records and prevent abuse. Full account deletion removes all associated records (see Section 9).

2.2 Google OAuth Tokens

Encryption keys are derived using HKDF. Tokens are never logged, never transmitted in plaintext, and are only decrypted in memory during active API proxying. On disconnect, both fields are set to an empty string (zeroed) immediately. On full account deletion, the records are removed entirely.

What these tokens can do is limited to the scopes you grant on Google’s consent screen (see Section 3.2). Most scopes are read-only. Where you have granted write-capable scopes — drive.file for files Passport.Me creates, and, if you enable editing features, spreadsheets, documents, or calendar.events — the same encrypted tokens are what authorize those write actions (see Section 7), so disconnecting, which zeroes the tokens, immediately ends both read and write capability.

2.3 Demographics Data (Consent-Based)

If you choose to enable the "Demographics" data source during Google account connection, we collect and store the following additional data:

This data is stored as a JSON blob in the demographics_json column of the gmail_connections table. Collection of Google People API data requires your explicit consent at the time of Google account connection. Demographic data is not cleared when you disconnect your Google account; it is removed only upon full account deletion or upon explicit request.

2.4 Wallet and Blockchain Identity Data

Stored in the wallet_accounts table. Wallet addresses are public by nature on most blockchains. Retention is indefinite while your account exists.

2.5 Live On-Chain Data (Not Stored)

When MCP consumers or the account dashboard request wallet data, we fetch the following information live from Moralis and public RPC nodes. This data is not persisted in our systems — it is fetched on demand and passed through to the requesting party:

• Token balances and token metadata
• NFT holdings and metadata
• DeFi positions
• ERC-20 transfer history (wallet activity)

2.6 Session Data

Session records are stored in the sessions table and are automatically deleted 30 days after the last update, or 2 hours after it for a session that never signed in (see Section 9).

2.7 Events and Audit Log

We maintain an event log for security, fraud prevention, and audit purposes. Each event record contains:

• Event type — e.g., google_connect, app_authorize, wallet_link
• Connection ID — links the event to a Google or wallet connection
• Session ID — links the event to the session in which it occurred
• IP address — your IP at the time of the event
• Payload JSON — event-specific data, which may include email addresses, wallet addresses, and app identifiers

Stored in the events table, which is also the activity log you can review in your dashboard. Retained for the duration of your account and deleted when you delete your account (see Section 9).

2.8 Connected Apps Data

When you authorize an AI tool to access your Passport data, we store:

• App key and display name
• Authentication mode (e.g., OAuth 2.0)
• Client ID and redirect URI registered for the app
• A hashed token used to verify app-to-Passport authentication
• Which data sources are blocked or permitted for that app
• Revocation timestamp (if you disconnect the app)

Stored in the connected_apps table. Retained while your account exists. Revocation sets a revoked_at timestamp and terminates active access immediately.

2.9 Email Preferences

If you opt out of certain email categories, we store your email address and an array of opted-out categories in the email_preferences table. This is necessary to honor your communication preferences.

2.10 Beta and Metering Data

During the beta program, we collect the following operational data:

• Invite codes — code status and usage records (beta_invite_codes)
• Waitlist entries — email address and waitlist status (beta_waitlist)
• MDT balances — Measurable Data Token holdings associated with your wallet (mdt_balances)
• Usage logs — API call counts and metering data for quota management (mdt_usage_log)

2.11 Rate Limit Data

To prevent abuse, we maintain rate-limit counters containing a bucket identifier, a hashed subject key (anonymized), and a hit count. Stored in the rate_limits table and automatically deleted after 48 hours.

2.12 AI Memories

You may create AI Memories — structured context notes that you author and store within Passport.Me so that connected AI tools can reference them during conversations. Each memory record contains:

• Label — a short title you assign to the memory
• Content — the text body you provide (up to 10 000 characters)
• Source provider — which AI tool the memory was exported from (e.g., Claude, ChatGPT), auto-detected from standardized export headers
• Cutoff date — an optional date indicating when the information was current
• Connection ID — links the memory to your account
• Status — active or archived

Stored in the ai_memories table. Active memories are delivered to connected AI tools via MCP when the AI Memories data source is enabled for that app. You can create, edit, and remove memories via your account dashboard. Deletion sets the memory to "archived" status; full account deletion removes all memory records permanently.

2.12a AI BOND Connection

AI BOND is a separate service that holds a vault of reviewed, individually approved memories. It — not Passport.Me — is the canonical record of those memories. If you explicitly connect an AI BOND vault to your Passport.Me account, Passport.Me can read the approved memories in it on your behalf. What we store about that connection is:

• AI BOND connection identifier — which vault your account is connected to
• An encrypted access credential — how we prove to AI BOND that we may read it
• Connection status and dates — active or disconnected, when it was connected, when it expires, when it was last read
• Per-app permissions — which of your connected apps you have turned AI BOND on for

We do not store the memories themselves. No AI BOND memory content is written to our database, caches, logs, event records, analytics, or error reports. Each request reads the vault live and keeps nothing afterwards, so archiving or deleting a memory in AI BOND removes it from what Passport.Me can see on the very next read. If AI BOND cannot be reached, connected apps receive an error rather than stale or empty results.

Connecting is always an explicit action you take, through the same authorisation flow as our other optional sources. We never match your Passport.Me account to an AI BOND vault by email address, Google account, or any other inferred identifier. AI BOND access is off by default for every connected app and must be turned on per app. Disconnecting, or deleting your Passport.Me account, removes our link credentials and ends our ability to read — it does not delete your AI BOND vault, which remains yours and is managed in AI BOND.

AI BOND connects the same way as our other optional sources (sections 2.14–2.15), so the connection is stored in provider_connections alongside them, and the per-app permissions in app_ai_bond_grants. Your existing ai_memories records (section 2.12) are not migrated, altered, or deleted by connecting.

2.13 Interview Room (Chat) Data

The Interview Room is an in-app chat feature that lets you converse with an AI model (OpenAI) using your Passport data as context. When you send a message in the Interview Room:

• Your chat messages are sent to OpenAI's API for processing. Messages are not stored on our servers after the response is delivered.
• Contextual data — if you have context enabled, the Interview Room may fetch your Gmail messages, Google Drive file metadata, Google Docs content, Google Sheets data, Google Calendar events, Google Contacts, wallet data, demographics, and AI Memories and include them in the prompt sent to the AI provider. This means Google user data (including email content, Drive file content, Docs content, Sheets data, calendar events, and contacts) may be transmitted to OpenAI.
• API keys — the Interview Room runs entirely on a Passport.Me-held API key. You cannot supply your own, and we no longer store user-supplied provider keys of any kind.

Chat interactions are logged as audit events (message count, credit usage) but the content of messages and AI responses is not stored in our database. The AI provider processes your data according to their own privacy policy and terms of service.

The proactive assistant is a separate feature from the Interview Room: it runs in the background rather than in response to a message you send. What it stores, where it delivers, and what we record about your engagement with it are described in Section 2.16.

2.14 GitHub Account Data (Optional)

If you connect your GitHub account via OAuth, we receive and store the following GitHub data:

GitHub data is only proxied to a strict per-endpoint allowlist (user profile, user/repos, user/starred, user/issues, user/orgs, public repo metadata). Write operations (creating issues, pushing code, modifying repos) are not supported. You can disconnect GitHub at any time from my.passport.me; on disconnect we delete the encrypted access token and clear cached metadata.

2.15 Oura Ring Data (Optional — Special Category)

If you connect your Oura account via OAuth, we receive and store the following Oura data:

Oura biometric data is informational only. Passport.Me is not a medical device, and the data we surface from Oura must not be interpreted as medical advice, diagnosis, or treatment recommendation. If you need clinical interpretation, consult a qualified healthcare professional. You can disconnect Oura at any time from my.passport.me; on disconnect we delete the encrypted tokens and clear cached metadata.

2.16 Proactive Assistant, Heads-Ups, and Messaging Delivery

The proactive assistant runs on a schedule in the background. It looks at recent items from the sources you have connected — for example a new email or an upcoming calendar event — and decides whether any of them is worth telling you about. Unlike the Interview Room, it is not triggered by anything you type. When it decides something is worth surfacing, it stores a heads-up: a short title and body written from that item, a reference back to the original (such as a Gmail message id), a kind, and a status.

The title and body are derived from your own data, so a heads-up about an email can contain that email's sender and subject.

How the decision is made. Three kinds of heads-up are decided by a fixed numeric threshold rather than by a model: a purchase at or above a set amount, an Oura readiness or sleep score below its threshold, and a notable stablecoin transfer on a connected wallet. For those, no model is asked whether to tell you; it is asked only to word the message, and a plain template is always kept as a fallback so the alert cannot be lost if that fails or if the daily model budget is exhausted. Items from other sources — ordinary mail, calendar events, GitHub activity — are put to an OpenAI model, reached through the same transit proxy as the Interview Room (Section 6), which decides whether each one is worth telling you about now, worth holding for your morning brief, or not worth your time, and writes the wording. The same model words the threshold-decided kinds. This happens automatically on each scheduled run, not at your direction.

To make that wording read like something written by someone who knows you, we also send that model a short context block assembled from data we already hold: your demographics, the calendar events in view on that run, up to a dozen of your confirmed profile facts, and the titles of heads-ups already sent to you (those of the last 24 hours, and a few before that), so that it does not repeat itself or tell you about the same thing twice. No email bodies or previews form part of that context block. The full list of what reaches this sub-processor, including the message preview and the receipt-amount case, is in the OpenAI row of Section 6.

Where heads-ups are delivered. Every heads-up appears on your dashboard at my.passport.me. In addition:

• Telegram — if you have linked a Telegram account to Passport.Me, and have not opted out of Telegram heads-ups, we send the heads-ups worth telling you about now through the Telegram Bot API, a few minutes after they are written, several at once as one message. Between 23:00 and 08:00 in your Google Calendar's time zone, which we store for this, only urgent ones (a login code, a sign-in you may not have caused) are sent; the rest wait until 08:00. Once a day from 09:00 we also send a morning brief: a short summary, written by the same model from the heads-ups we held back and your calendar for the day, with a button that opens your dashboard. This means the title and body of each heads-up, and the text of the brief — all derived from your connected data — are transmitted to Telegram FZ-LLC and handled under Telegram's own privacy policy. Addressing the message necessarily discloses your Telegram user id to Telegram, and the message carries a button whose link contains the random identifier of that heads-up, which is how the click is recorded. A heads-up carries nothing beyond those two identifiers — not your email address, not your Passport account identifiers, and no message bodies or attachments. The bot names your account once, when you link it: the confirmation shows your account email masked, for example j*****e@gmail.com, so that a chat linked with someone else's code says whose Passport it now reports to. One qualification, so that this is not read as a stronger promise than it is: for a heads-up about an email, that button redirects to Gmail at a link that names your Google account address, so that it opens in the right mailbox rather than in whichever Google account your browser happens to have signed in first. We do not send that address to Telegram, and Telegram has no reason to open the link — but anyone or anything that does follow it, including a mail scanner that resolves links automatically, can see the address. Telegram is listed as a recipient in Section 6 and as an international transfer in Section 8. Linking Telegram is entirely optional and off unless you set it up; you can unlink it at any time from your dashboard, which stops all further delivery.
• Email digest — heads-ups may also be summarised in a notification email delivered by Resend (Section 6) to your account address. This is sent unless you have opted out of that email category, which you can do at any time from your dashboard or via the unsubscribe link in the email itself. It is not sent while you receive the Telegram morning brief, so the same heads-ups do not reach you twice.

Messages you send the Telegram bot. You can also write to the bot. Telegram passes each message to us with your Telegram user id, and what happens next depends on the message:

• From a chat that is not linked, or from a group, the bot only answers link codes and commands. Nothing else you send is read or kept, and none of it reaches an AI model.
• Commands — /start with a code, /check, /unlink, and undo — are handled by fixed code. No AI model sees them.
• Anything else from your linked chat is a question or a request to your assistant, at your direction. It is sent to an OpenAI model, through the same transit proxy as the Interview Room (Section 6), together with your recent conversation with the bot and the heads-ups it recently sent you. To answer, the model may read your connected data through the same tools any AI app you connect uses (Section 7): the bot is an AI app called Passport.Me on Telegram, created when you link Telegram. It appears in Apps on your dashboard, where you can switch off any source for it or disconnect it, and every read it makes is in your activity log. What a tool returns — an email, an event, a file, a health score you asked about — goes to that model for that answer only. Each message you send uses Ask credits, as an Interview Room message does.
• An email you want to send (“reply to Sarah saying I'll send it tonight”) comes back as a draft with a Reply in Gmail button, which opens Gmail with the draft filled in for you to send. Passport.Me never sends email. The draft's text is part of that button's link, so Telegram receives it with the message; the link does not contain your email address.
• A calendar change — adding an event, moving or renaming one of yours, or answering an invitation — comes back as a card, and nothing reaches Google until you tap it. For an event that already exists, Google's current version of it is shown first and you confirm again; nobody is emailed about the change. This works only when you allow writes for Passport.Me on Telegram in Apps and allow calendar changes when Google asks; it goes through the same write tools, with the same confirmation steps, as any AI app you allow to write (Section 7).
• A correction (“the gym membership is my partner's, not mine”) gets a card with Save and Cancel. Nothing is saved until you tap Save; the fact is then confirmed and marked as coming from you (Section 2.17). Reply undo within 15 minutes to drop it; it is then archived like any fact you archive yourself.

Tuning heads-ups. A heads-up from a sender or a GitHub repository has Mute and Less like this buttons. Mute keeps that sender's or repository's address or name, and their heads-ups go to your morning brief instead of buzzing you, apart from login codes and anything urgent; it lasts until you undo it or delete your account. Less like this keeps that heads-up's title for 30 days and shows it to the proactive assistant's model as an example of what to hold back.

What the bot keeps. The last ten messages of your conversation with it and the last ten heads-ups it sent you, per chat, so it can follow up and answer a reply to a heads-up; each is deleted seven days after it was written, and all of it when you unlink or delete your account. A correction card is deleted once it is answered, or a day after it was shown, and a saved fact stays as a profile fact. Credentials that look like access keys are removed from what is kept. The bot's replies reach you through Telegram. Health details are never saved from a message: the bot will not file anything under Health, and it declines other sensitive details too (see Sensitive Data in Section 4). Anything it saves, you can delete from your dashboard.

Heads-up engagement. For each heads-up the proactive assistant creates, we record three timestamps about your interaction with it: when it was first displayed on your dashboard, when you first followed its link, and when you marked it opened or dismissed. We record this so we can tell whether the feature is useful to you at all; without it we cannot distinguish heads-ups everybody reads from heads-ups nobody reads. When a heads-up is delivered to your messaging app or by email, its button points at a Passport address that records the click and then immediately redirects you to the underlying item (for example the message in Gmail). We store only the fact and time of the first click — not your IP address, device, or location — we do not record repeat clicks, and this data is never shared with advertisers or used to build an advertising profile. It is deleted with the rest of your data when you delete your account.

The destination of that link is resolved on our server from the stored heads-up; it cannot be set by whoever follows the link. We count a click only when the request looks like a real browser navigation, specifically so that automatic link-prefetching by a mail client is not recorded as you having opened something. This is a deliberate under-count, not a precise measure of readership.

Retention. A heads-up you never read is marked expired after 14 days and drops out of your feed, your digest, and the messaging queue; the record itself is kept until you delete your account. Heads-ups the assistant considered and skipped are discarded after 3 days for email and receipt items. An item the assistant could not assess yet is retried, and its placeholder is discarded within 3 days. Everything described in this section — heads-ups, their engagement timestamps, your channel link, and the record of what was delivered to it — is deleted when you delete your account, and all of it is included in the data export described in Section 11.

2.17 Passport Profile Facts and Their Evidence

Passport.Me derives a small set of durable facts about you from the sources you have connected — for example a subscription you appear to hold, an employer, a school, a place you appear to be based, or the programming languages you work in. Most come from narrow extractors, each reading one source; the rest come from you:

• Gmail, mail you received — subscription, employer, school, and address extractors, which read sender and subject lines only. These never open the body of a message you received.
• Gmail, mail you sent — a self-statement extractor, which does read the body of messages in your Sent mail. This is the only profile extractor that opens a body, and it is deliberately narrow, so it is worth being precise about what happens:
  • It looks only at mail you sent. It never reads the body of mail you received.
  • Text you quoted, and everything below a reply or forward separator, is discarded first — those are someone else's words, and a statement found there is not yours.
  • What remains is split into sentences, and only sentences that match an explicit first-person self-description are kept — the kind of sentence that begins "I work at", "I'm a student at", or "I'm based in". Everything else in the message is discarded unread by anything downstream.
  • Those sentences are redacted (card-length numbers, government ID numbers, email addresses and links are removed), capped at four per message and roughly 240 characters each, and only then passed onward.
  • The body itself is never stored and never sent to any AI sub-processor. It exists only inside the function that reads it. What travels onward is those few sentences and nothing else.
  Why we do this at all: a subject line almost never says where you study or work, so facts drawn from received mail were often wrong — a university mailing list is not evidence you attend it. A sentence you wrote yourself is much better evidence, and it is also evidence you can check.
• Google Calendar — a locations extractor, which looks at where your events recur over time.
• GitHub — a technology extractor, which looks at the languages of repositories you have pushed to recently.
• You, through the Telegram bot — a fact you tell the bot and save with its Save button (Section 2.16). It is confirmed when you tap Save, because you said it, and it replaces an inferred value for the same thing. It need not be about you alone: the Household category exists so you can say that an activity or a subscription belongs to someone you live with, which stops your assistant describing it as yours. Keep those to what your assistant needs; you can delete them at any time.

For each fact we store the category, the value, which source it came from, a confidence score, and a status. We also store, separately, the evidence behind it, together with a reference to the source it came from and when it was observed. For facts drawn from mail you received, that evidence is a short excerpt of the message — in practice its subject line. For facts drawn from mail you sent, it is the redacted sentence you wrote, which is the most direct evidence this system can hold: not "a school mailed you", but the words in which you said it yourself. For Calendar and GitHub facts there is no message to quote, so the evidence is a one-line summary of what was observed, such as how many events at a place across how many weeks, or which language led across how many repositories. We keep this so that a fact about you is auditable — so you can see why it appeared rather than only that it did. A fact you told the bot has no evidence stored with it: its source is you. Your message is kept only in the bot's seven-day conversation history (Section 2.16).

Confirmation, and where facts go. Connected AI tools receive only facts whose status is confirmed; pending facts are never served to them. Be aware that confirmation is not always something you do: a newly derived fact starts as pending, but where the extractor's confidence in it meets our threshold it is confirmed automatically and becomes available to those tools without you clicking anything. Weaker signals stay pending until you review them. A decision you make yourself — confirming, denying, or archiving — is never overridden by that automatic step.

Your control over them. From your dashboard you can confirm or deny a fact, archive all facts at once, or delete an individual fact — deleting a fact also deletes the stored evidence behind it. Denying a fact stops it being served. Archiving marks facts as archived and stops their use, but keeps the records until account deletion.

Profile facts and their evidence are deleted when you delete your account, and both are included in the data export described in Section 11.

2.18 Passport.Me Chrome Extension (Optional)

The Passport.Me extension for Chrome runs only on chatgpt.com, chat.openai.com, gemini.google.com, grok.com, chat.deepseek.com and perplexity.ai. There it reads the AI's replies to find requests for Passport tools. It runs a request only when you click Run, or automatically if you turn on auto-run (never for sensitive tools). To run one, it sends the tool name and its inputs, and which of those sites the request came from, to Passport.Me with your sign-in. It then puts the result in the chat's message box, and sends that message for you only when auto-run is on. Each run is recorded in your activity log like any other app's (Section 2.7).

On your device it keeps your Passport sign-in and connection details, your auto-run and launcher preferences, the last sign-in error if there was one, and a record of requests it has already run, with their results, so the same request is not run twice. It clears that record 24 hours later, the next time it runs on one of those sites. Your auto-run setting is also saved to your Passport account so it follows you to other browsers; it is deleted when you delete your account. The extension does not read other sites or your browsing history, and we never sell or share what it handles.

The use of information received from Google APIs will adhere to the Chrome Web Store User Data Policy, including the Limited Use requirements.

How We Collect Your Data

3.1 Directly from You

We collect data you provide directly when you:

• Create an account or join the beta waitlist (email address, invite code)
• Connect your Google account via OAuth (triggers collection of Google Account Data and, if consented, Demographics Data)
• Connect your cryptocurrency wallet (wallet address, chain ID)
• Configure connected apps and data source permissions
• Contact us for support or submit feedback
• Set email communication preferences

3.2 From Google via OAuth

When you connect your Google account, you are redirected to Google's OAuth consent screen where you review and authorize the specific permissions we request. Upon your authorization, Google returns an access token and (where requested) a refresh token, along with your basic profile information. The scopes we request depend on which data sources you enable:

• Always requested: OpenID Connect sign-in scopes (openid, email, profile) — these identify your Google account (your email address, name, and profile picture) and are requested on every Google connection.
• If the Gmail source is enabled (a default source you can decline on Google's consent screen): read-only Gmail access (gmail.readonly, a restricted scope). Passport.Me stores only aggregate mailbox counts from this scope — the total number of messages and threads in your mailbox (see Section 2.1).
• If Demographics source enabled: Google People API scopes including birthday, gender, and locale
• If a Google Workspace read source is enabled: the matching read-only scope for that source — Google Drive (drive.readonly), Google Calendar (calendar.readonly), Google Docs (documents.readonly), Google Sheets (spreadsheets.readonly), or Google Contacts (contacts.readonly). Each scope is requested only when you enable that specific source.
• If Drive write-back is enabled: the per-file write scope (drive.file). This scope lets Passport.Me create and edit only the files it makes in your Drive — it cannot read or modify any file you already have. It powers your PROFILE.md sync (an optional feature that writes a Markdown summary of your Passport profile to a Passport.Me-created file in your Drive) and, where you additionally opt in per app, AI-tool write-back (see Section 7).
• If you enable AI-tool editing of your existing files or calendar (optional, off by default): the matching write scope — Google Sheets (spreadsheets), Google Docs (documents), or Google Calendar (calendar.events). Each scope is requested only when you enable editing for that source, and each exists solely so that an AI tool you have granted write access can, at your instruction, edit spreadsheets and documents you already own or create and manage calendar events. Any edit to a file Passport.Me did not itself create, and any calendar change affecting other attendees, first produces a server-generated preview and executes only after that exact operation is confirmed (see Section 7).

You may review and disconnect these permissions at any time from your Google Account permissions page.

AI Activity log: When an AI tool you have connected calls a Google scope on your behalf via MCP (see Section 7), we record that the call happened, which tool was invoked, and the shape of the response (for example, message count or result type) — never the parameters passed to the tool, never the response content, and never the conversation between you and the AI. These records form the AI Activity surface of the audit log described in Section 3.4. They are not auto-deleted; you can review them at any time on your Account page, export them as JSON, or request deletion under GDPR Articles 15 and 17.

3.2a From GitHub via OAuth

When you connect your GitHub account, you are redirected to GitHub's OAuth consent screen. The scopes we request are read:user and user:email, which permit reading your profile, primary email, and a list of your repositories (public and private metadata only — file content is not requested). On authorization, GitHub returns an access token that we store encrypted at rest. We do not request repo write permissions or any administrative scope. You may disconnect access at any time from your GitHub OAuth applications page or from my.passport.me.

3.2b From Oura via OAuth (Special Category Consent)

When you connect your Oura account, you are redirected to Oura's OAuth consent screen. The scopes we request cover personal info plus daily metrics (sleep, activity, readiness), heart rate samples, workouts, and contextual ring data. By proceeding through the Oura consent screen you provide explicit consent to processing of special category health data (GDPR Article 9(2)(a) / UK GDPR Article 9(2)(a)). You may withdraw this consent at any time by disconnecting Oura from my.passport.me or by disconnecting access on cloud.ouraring.com; withdrawal does not affect the lawfulness of processing carried out before withdrawal.

3.3 From Blockchain Infrastructure

On-chain data (token balances, NFTs, transaction history) is fetched live from public blockchain networks via Moralis and RPC nodes whenever you or an authorized AI tool requests it. This data is inherently public on the blockchain. We do not store it persistently (see Section 2.5).

3.4 Automatically During Service Use

When you interact with the Service, we automatically receive:

• IP address — present in all requests to our Cloudflare Worker
• Geolocation metadata — Cloudflare's edge network derives country, city, region, timezone, latitude, and longitude from your IP address. This data is used for demographics (if enabled) and for general security analysis.
• Session identifiers — issued by the server upon first visit and maintained via the passport_sid cookie
• Audit events — actions such as connecting accounts, authorizing apps, and disconnecting access are logged automatically

Legal Bases for Processing

As explained in Section 1, we act primarily as a data processor on your behalf — you instruct us on what data to connect and which AI tools may access it. For the narrow set of processing activities where we act as an independent data controller (operational security, audit logs, abuse prevention), the following legal bases apply under GDPR and equivalent frameworks:

Sensitive Data (Special Categories)

Two categories of special category data (GDPR Article 9 / UK GDPR Article 9) may be processed by Passport.Me:

• Demographics from the Google People API (birthday, gender, locale). Processed only with your explicit consent (Article 9(2)(a)), which you provide during the Demographics scope consent screen — see §2.3.
• Wearable health data from Oura (sleep, heart rate, HRV, SpO₂, body temperature, activity, readiness, stress, cardiovascular age, workouts). Processed only with your explicit consent (Article 9(2)(a)), which you provide during the Oura OAuth consent screen — see §2.15 and §3.2b. This data is informational only and not used for medical analysis or AI/ML training.

We do not save special category data from messages you send the Telegram bot (Section 2.16). The bot never files a fact under Health, and it is instructed to decline health, religious, sexual, ethnic, political, trade-union, genetic, biometric and criminal-record details, about you or anyone else. When you ask it about your Oura data, it reads that data to answer, under the consent you gave when you connected Oura (§2.15), and keeps the answer only in its seven-day conversation history. A model can misjudge, so if a fact is saved anyway, reply undo or delete it from your dashboard.

You may withdraw consent for either category at any time by disconnecting the corresponding source on my.passport.me (see Section 10). Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Hong Kong (PDPO)

Under Hong Kong's Personal Data (Privacy) Ordinance (Cap. 486), we handle personal data in accordance with the six Data Protection Principles (DPPs). As a data processor acting on your behalf, we collect data only for the lawful purposes you direct — connecting accounts and authorizing AI tool access (DPP 1). Data is kept accurate and not retained longer than necessary (DPP 2), and is used only for the purposes stated at the time of collection or with your consent (DPP 3). For the limited operational data where we act as data user (controller), we comply with all six DPPs independently. This Privacy Policy, together with collection-point disclosures, constitutes our Personal Information Collection Statement (PICS) under DPP 1(3).

Singapore (PDPA)

For users in Singapore, we collect, use, and disclose personal data with your consent (express or deemed) under the Personal Data Protection Act 2012, or where applicable exceptions apply (such as the legitimate interests exception introduced by the 2020 amendments).

How We Use Your Data

5.1 Service Delivery

• Authenticating your identity and maintaining your session
• Connecting your Google account and fetching authorized data on your behalf
• Connecting your cryptocurrency wallet and verifying ownership via cryptographic signature
• Issuing OAuth 2.0 tokens to AI tools you have authorized
• Delivering your authorized data to connected AI tools via the MCP protocol
• Carrying out create and edit actions in your Google account — new Sheets, Docs, and files; confirmed edits to existing files; calendar events — when you request them through a connected AI tool you have granted write access (see Section 7)
• Managing your data source permissions and connected app configurations
• Maintaining your beta access status, invite code, and usage quotas
• Storing and delivering your AI Memories to connected AI tools via MCP
• Powering the Interview Room by sending your chat messages and authorized context data — which may include Gmail, Drive, Docs, Sheets, Calendar, and Contacts content — to OpenAI at your direction
• Running the proactive assistant: sending the metadata and preview of new items from your connected sources to OpenAI, on a schedule, to decide which deserve a heads-up and to write heads-ups and your morning brief (Section 2.16)

5.2 Security and Integrity

• Logging authentication events and account changes to the audit log
• Detecting and preventing unauthorized access, fraud, and automated abuse
• Rate-limiting API requests to protect the Service and other users
• Verifying admin authentication freshness (15-minute step-up requirement)
• Monitoring for unusual patterns that may indicate account compromise

5.3 Communications

• Sending transactional security emails (e.g., alerts when a new device connects your account)
• Sending service-related notifications (e.g., beta access granted, invite code redeemed)
• Sending non-security notifications where you have opted in (subject to email preferences)
• Responding to your support inquiries

5.4 Service Improvement

• Analyzing aggregate usage patterns to improve reliability and feature design
• Identifying errors and performance issues in the Service
• Understanding which data sources and AI tool integrations are most valuable

5.5 Legal and Compliance

• Complying with applicable laws, regulations, and court orders
• Enforcing our Terms of Service
• Responding to lawful requests from regulatory or law enforcement authorities
• Protecting our legal rights and the rights of other users

Who We Share Your Data With

As your data processor, we share your personal data only as necessary to execute your instructions (e.g., delivering data to AI tools you authorize), to operate the technical infrastructure of the Service, or to comply with the law. The following table describes all third-party recipients and sub-processors.

Public Blockchain Nodes

When querying on-chain data, requests are routed via Moralis to public or Moralis-operated RPC nodes for the relevant blockchain network. Your wallet address is included in RPC queries. This is technically necessary to fetch blockchain data and is a consequence of the inherently public nature of on-chain activity.

Legal Disclosures

We may disclose personal data to law enforcement authorities, courts, or regulatory bodies if required to do so by applicable law, court order, or governmental regulation. Where legally permitted, we will notify you before disclosing your personal data in response to such a request.

Business Transfers

In the event of a merger, acquisition, reorganization, or sale of all or substantially all of our assets, your personal data may be transferred to the acquiring entity. We will provide notice before your data becomes subject to a materially different privacy policy.

AI Tool Data Sharing (MCP)

The core function of Passport.Me is to give you control over delivering your personal data to AI tools — such as Claude (Anthropic), ChatGPT (OpenAI), Gemini (Google), and Cursor — via the Model Context Protocol (MCP). We act as your data processor for this function: we execute the data-sharing instructions you configure, and we do not independently decide what data to share or with whom. This section explains how that works and what it means for your privacy.

Google Workspace API Data — No AI/ML Model Training

How It Works

When you authorize a connected app, you choose which data sources (e.g., Gmail metrics, demographics, wallet data) that app may access. We issue the app an OAuth 2.0 bearer token that grants access only to those specific sources. When the AI tool makes an MCP request, we authenticate the token and return only the authorized data subset. You can modify or disconnect this authorization at any time from your account dashboard. Where you have additionally granted an app write access (see “Actions AI Tools Can Take on Your Behalf” below), the same authenticated flow carries out the write actions you request; edits to anything the app did not itself create require a per-operation confirmation.

Data Sent to AI Tools

The exact data delivered depends on which sources you have enabled for each app. Possible data elements include:

• Your Google email address (if email source enabled)
• Gmail mailbox metrics (messages_total, threads_total)
• Demographics: country, city, region, timezone, birthday, gender, locale (if demographics source enabled; latitude/longitude and IP are excluded)
• Wallet address and chain ID (if wallet source enabled)
• Live on-chain data (token balances, NFTs, DeFi positions, transfer history) fetched on demand
• AI Memories: label, content, source provider, and cutoff date (if AI Memories source enabled)

Actions AI Tools Can Take on Your Behalf (Opt-In Write-Back)

By default, connected AI tools can only read the data you authorize — they cannot change anything in your Google account. You may optionally allow a specific AI tool to take write actions in your Google account on your behalf. Write access is layered: creating new files is the base capability, and editing your existing files or calendar is a further step that requires its own Google scopes (Section 3.2) and per-operation confirmation.

• Off by default; two explicit opt-ins required. Write-back works only when you (a) enable the Drive write-back source on your account and (b) grant write access to that specific app — by ticking the separate “allow write” box when authorizing it on its consent screen, or by turning on Allow write for it under Connected Apps on your dashboard. Neither step alone is sufficient.
• Per-service control. Once Allow write is on for an app, you can further limit it to specific Google services. Sheets, Docs, and Calendar are listed individually under the app in Connected Apps, each on by default; turning a service off blocks that app’s writes to it from its very next attempt, while leaving its read access and its other write services unchanged. This per-service setting is enforced server-side by Passport.Me.
• Creating new files (base capability). Uses Google’s drive.file per-file scope. The tool can create new Google Sheets, Docs, and files (and append rows to a sheet it created) inside your Drive. Under this scope alone it cannot read, edit, or delete any file that already exists in your Drive.
• Editing existing files and calendar (separate scopes, separate consent). If you additionally grant the editing scopes on Google’s consent screen (spreadsheets, documents, calendar.events — see Section 3.2), a write-enabled tool can also edit Sheets and Docs you already own and create, change, or delete calendar events.
• Destructive writes are confirmed per operation. Any edit to a file Passport.Me did not itself create, any change to an existing calendar event, and any new event that would notify other attendees does not execute immediately. Our servers first return a preview derived from the target’s actual current state (for example, the spreadsheet’s title and how many non-empty cells the edit would overwrite) together with a single-use confirmation that expires after 5 minutes. Only that exact previewed operation can then be executed — if the target or content changes, the confirmation is void. This check is enforced server-side by Passport.Me, not by the AI tool.
• No Gmail write access. No connected AI tool can send, draft, or modify email through Passport.Me. Contacts are likewise read-only.
• You direct every write. The content written to your Google account originates in your session with the AI tool, at your instruction. Your AI Activity log records that a write was proposed and that it was executed (which tool, which kind of action) — never the file contents.
• Disconnect at any time by turning off Allow write for the app (or an individual write service) under Connected Apps, disabling the Drive write-back source, disconnecting the app, or removing access from your Google Account permissions page. Revocation applies from the app’s very next write attempt.

Downstream Processing by AI Providers

Disconnecting AI Tool Access

You may disconnect an AI tool's access to your data at any time by disconnecting the app from your account dashboard. Revocation takes effect immediately — the app's bearer token is invalidated and subsequent MCP requests will be rejected. This does not affect any data the AI provider may have already processed or stored on their systems; you should contact the AI provider directly to request deletion of data they have received.

De-identified and Aggregated Data

We may collect, use, and share personal data in an aggregated or de-identified manner (that does not identify you personally) for lawful business purposes. This section explains what that means and how it works.

What Is De-identification?

De-identification is the process of removing or transforming personal identifiers (such as your name, email address, wallet address, and IP address) so that the resulting data cannot reasonably be linked back to you as an individual. Aggregation combines de-identified data from many users into statistical summaries.

How We Create De-identified Data

We may use non-Google-API data — such as aggregate usage patterns, demographic distributions, wallet activity trends, and MCP consumption metrics — to create de-identified or aggregated datasets. We adopt the following safeguards:

• All personal identifiers (email, name, wallet address, IP, session ID) are removed or irreversibly obfuscated before any data is shared.
• If we combine de-identified data with personal data, the combined dataset is treated as personal data for as long as it remains combined.
• We prohibit all recipients of de-identified data from re-identifying or attempting to re-identify any individual.
• We commit that we will not re-identify or attempt to re-identify de-identified data.

Sharing with Measurable AI (MAI)

We may share de-identified, aggregated data with Measurable AI, an affiliated enterprise-facing alternative data platform (measurable.ai) that provides consumer insights, market trends, and business intelligence to its subscribers. For example, aggregated demographic distributions, wallet activity trends, or MCP usage patterns may become part of MAI's data products.

MAI subscribers use this de-identified data for research, analytics, marketing optimization, and other commercial purposes. The data shared with MAI cannot reasonably identify you as an individual.

Opt-Out

You may opt out of having your data included in de-identified or aggregated datasets shared with MAI or other third parties at any time by:

• Emailing privacy@passport.me with "Opt Out of Data Aggregation" in the subject line
• Using the data sharing controls in your account dashboard (when available)

Opting out will not affect your ability to use the Service. You can continue to use all Passport.Me features with no degradation to your experience.

CCPA "Sale" Disclosure

To the extent that sharing de-identified or aggregated data with MAI or other partners for monetary or other valuable consideration is deemed a "sale" under the California Consumer Privacy Act (CCPA), California residents have the right to opt out of such sales. You may exercise this right by emailing privacy@passport.me with "Do Not Sell My Personal Information" in the subject line, or by using the opt-out mechanism described above.

Over the past 12 months, we may have shared the following categories of de-identified data with MAI:

• Consumer Demographic Data (age distributions, gender distributions, geographic distributions)
• Usage Data (aggregate MCP consumption patterns, source enablement rates)

We do not sell Personal Data in identifiable form. We do not sell the personal information of minors under 16 years of age. We will not discriminate against you for exercising your opt-out right.

International Data Transfers

Passport.Me is based in Hong Kong. The Service operates on Cloudflare's global edge network, which processes requests at points of presence worldwide. Several of our third-party processors are based in the United States. As a result, your personal data may be transferred to and processed in countries outside your country of residence, including countries that may not provide the same level of data protection as your home jurisdiction.

Transfers to the United States and Other Third Countries

Where we transfer personal data from the EEA, UK, or other jurisdictions with transfer restrictions to third countries (including the United States and Hong Kong), we rely on the following transfer mechanisms:

Hong Kong as the Country of Processing

Hong Kong has a comprehensive data protection framework under the Personal Data (Privacy) Ordinance (Cap. 486, PDPO). While the PDPO's cross-border data transfer restrictions (Section 33) have not yet been commenced as of 2026, we voluntarily ensure that personal data transferred overseas receives a standard of protection comparable to the PDPO through our contractual arrangements with sub-processors.

Obtaining Transfer Documentation

If you would like to receive a copy of the specific transfer mechanisms we rely upon for a particular transfer, or if you have questions about international data transfers, please contact us at privacy@passport.me.

Data Retention

We retain personal data only for as long as necessary to fulfill the purposes described in this Privacy Policy, to comply with our legal obligations, to resolve disputes, and to enforce our agreements. The following table specifies retention periods by data category.

Account Deletion

You may request full account deletion at any time from your account dashboard or by emailing privacy@passport.me. We will process your deletion request within 30 days. Deletion removes all records associated with your account except the staff access ledger described above, which is kept for 400 days, and except where we are legally required to retain certain data (e.g., under applicable financial or legal compliance obligations) or where deletion would impair the rights of other users (e.g., anonymized audit records needed to investigate a prior security incident may be retained in anonymized form).

Please note that deletion of your Passport.Me account does not retroactively affect data that has already been delivered to connected AI tools. You should contact those providers separately if you wish to request deletion of data they have processed.

Files and calendar events that an AI tool created or edited in your own Google account via write-back (Section 7) are part of your Google account, not ours. Deleting your Passport.Me account removes everything we hold — including your tokens, the write audit trail, and our ledger of which files Passport.Me created — but it deliberately does not delete anything from your Google Drive or Calendar: that content is yours, and reaching into your Google account to remove it would exceed the authority you gave us. You keep full control of it through Google directly.

Your Rights

Depending on your jurisdiction, you have the following rights regarding your personal data. We respect these rights regardless of which legal framework applies to you, and we will respond to rights requests within the statutory timeframes.

Rights Available to All Users

Regardless of your location, you have the following rights:

• Right of Access — you may request a copy of the personal data we hold about you
• Right to Correction / Rectification — you may request that we correct inaccurate or incomplete personal data
• Right to Deletion / Erasure — you may request that we delete your personal data (subject to the exceptions in Section 9)
• Right to Data Portability — you may request a machine-readable export of your personal data in a structured, commonly used format
• Right to Withdraw Consent — where processing is based on your consent, you may withdraw that consent at any time; withdrawal does not affect the lawfulness of processing prior to withdrawal
• Right to Object to Processing — you may object to processing based on legitimate interests; we will cease such processing unless we demonstrate compelling legitimate grounds

EU / EEA Users (GDPR)

Under the EU General Data Protection Regulation (GDPR), you have the following additional rights:

• Right to Restriction of Processing (Article 18) — you may request that we restrict the processing of your data in certain circumstances (e.g., while a correction request is pending)
• Right Not to Be Subject to Automated Decision-Making (Article 22) — we do not make solely automated decisions with legal or significant effects about individuals; no action required
• Right to Lodge a Complaint — you have the right to lodge a complaint with your local supervisory authority (see Section 19) if you believe we have infringed your GDPR rights

Our EU/UK Data Protection Officer (Financial Technology OÜ) can be contacted at passport.me@fintech.ee for GDPR matters. Response time: 30 days (extendable by a further 60 days for complex requests, with notice).

UK Users (UK GDPR)

UK residents have the same rights as EEA residents under the UK GDPR, which broadly mirrors the EU GDPR. You may also lodge a complaint with the UK Information Commissioner's Office (ICO). Contact our EU/UK DPO at passport.me@fintech.ee or email privacy@passport.me.

Brazil (LGPD)

Under Brazil's Lei Geral de Proteção de Dados (LGPD), data subjects have rights under Articles 17–22, including:

• Confirmation of the existence of processing; access to data
• Correction of incomplete, inaccurate, or outdated data
• Anonymization, blocking, or deletion of unnecessary or excessive data
• Portability; information about third parties with whom data is shared
• Deletion of data processed with consent
• Information about the possibility of denying consent and the consequences
• Revocation of consent
• Right to petition the Autoridade Nacional de Proteção de Dados (ANPD)

Response time: 15 days under LGPD.

California (CCPA / CPRA)

California residents have rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to Know — the categories and specific pieces of personal information collected, the sources, the business purpose, and the third parties with whom it is shared
• Right to Delete — request deletion of your personal information, subject to certain exceptions
• Right to Correct — request correction of inaccurate personal information
• Right to Opt Out of Sale or Sharing — we do not sell your personal information in identifiable form. To the extent that sharing de-identified or aggregated data with affiliated companies (such as Measurable AI) may be deemed a "sale" under the CCPA, you have the right to opt out — see Section 7A for details and opt-out instructions. We do not share your personal information for cross-context behavioral advertising.
• Right to Limit Use of Sensitive Personal Information — we use sensitive personal information only as necessary to provide the Service; no further limitation action is required
• Right to Non-Discrimination — we will not discriminate against you for exercising any CCPA rights

Response time: 45 days (extendable by 45 additional days with notice).

To submit a CCPA rights request, email privacy@passport.me with "CCPA Request" in the subject line.

Singapore (PDPA)

Under Singapore's Personal Data Protection Act 2012:

• Access Right — request access to your personal data and information about how it has been used or disclosed in the past year
• Correction Right — request correction of your personal data
• Withdrawal of Consent — withdraw consent to the collection, use, or disclosure of your personal data (subject to legal and contractual restrictions); note that withdrawal may limit our ability to provide the Service
• Data Portability Obligation — under the 2021 PDPA amendments, you may request portability of data to another organisation in machine-readable format, where technically feasible

Response time: As soon as reasonably possible, and in any case within 30 days.

Hong Kong (PDPO)

Under Hong Kong's Personal Data (Privacy) Ordinance (Cap. 486):

• Data Access Right (Sections 18–19) — request access to your personal data held by us and information about how it has been used. We will respond within 40 calendar days. A reasonable administrative fee (not exceeding HK$100) may apply for complex requests.
• Data Correction Right (Sections 22–24) — request correction of inaccurate personal data. If we refuse correction, we will provide written reasons.
• Openness (DPP 5) — you may request information about our data policies and practices at any time.
• Opt-Out of Direct Marketing (Sections 35C–35D) — you may opt out of any direct marketing at any time without charge. We will cease using your data for marketing within 10 business days.

To exercise these rights, email privacy@passport.me with "PDPO Data Access Request" or "PDPO Correction Request" in the subject line. Complaints may be directed to the Office of the Privacy Commissioner for Personal Data (PCPD) at www.pcpd.org.hk.

Australia

Australian users have rights under the Privacy Act 1988 and the Australian Privacy Principles (APPs), including the right to access and correct personal information, and to make a complaint to the Office of the Australian Information Commissioner (OAIC).

Canada (PIPEDA)

Under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), you have the right to access your personal information and to challenge its accuracy. You may also make a complaint to the Office of the Privacy Commissioner of Canada (OPC).

Nevada

If you are a resident of Nevada, you have the right to opt out of the sale of certain personal data to third parties who intend to license or sell that data. You can exercise this right by emailing privacy@passport.me with the subject line "Nevada Do Not Sell Request" and providing your name and the email address associated with your account.

Other US States

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Texas (TDPSA), Oregon (OCPA), and other US states with comprehensive privacy laws have rights that broadly mirror the CCPA rights described above, including:

• Right to access, correct, delete, and obtain a portable copy of your data
• Right to opt out of targeted advertising, sale of personal data, and profiling (none of which we engage in)
• Right to appeal a denial of a rights request — if we deny your request, we will explain the reason and you may appeal by emailing privacy@passport.me with "Privacy Rights Appeal" in the subject line; we will respond within 60 days

How to Exercise Your Rights

In-App Controls

Many rights can be exercised directly from your account dashboard at my.passport.me:

• Disconnect Google account — immediately zeros OAuth tokens
• Disconnect wallet — removes wallet identity from your Passport
• Disconnect connected app — immediately invalidates an AI tool's access token
• Modify data source permissions — granularly control what each connected app can see
• Update email preferences — opt out of non-security email categories
• Delete account — initiates full account deletion workflow

Submitting a Request by Email

For rights that cannot be exercised in-app (access request, data export, correction, complaint), email privacy@passport.me. Please include:

• Your name and the email address associated with your account
• A clear description of your request
• Your jurisdiction (for jurisdiction-specific requests)
• Sufficient information to verify your identity (we may ask for confirmation of your account email or connected wallet address)

Response Timeframes

Identity Verification

To protect against unauthorized requests, we may need to verify your identity before fulfilling a rights request. Verification methods may include confirming access to the email address on your account, or confirming ownership of a connected wallet address via a message signature. We will not require you to provide more information than is reasonably necessary for verification and will not use verification data for any other purpose.

Authorized Agents

If you are submitting a request through an authorized agent (e.g., under CCPA), we may require written authorization or a power of attorney confirming the agent's authority, and we may also verify your identity directly.

Children's Privacy

The Passport.Me Service is intended exclusively for users who are at least 18 years of age. We do not knowingly collect personal data from individuals under the age of 18.

Age Verification

When you enable the Demographics data source, we receive your birthday from the Google People API. If we determine that a user is under the age of 18, we will:

1. Immediately suspend access to the account
2. Delete all personal data associated with the account within 7 days
3. Notify you of the reason for account suspension by email

Parental / Guardian Notice

If you are a parent or legal guardian and believe that your child under the age of 18 has created an account with us or provided us with personal data, please contact us immediately at privacy@passport.me. We will promptly investigate and, if confirmed, delete the relevant data.

Additional Protections for Minors

For users under the age of 16 in the EEA (or a lower age set by applicable EU Member State law), GDPR Article 8 requires parental consent before an online service may process their personal data. Because our Service is strictly age-gated at 18, we do not enroll users under 16 under any circumstance.

Blockchain and Public Data

Cryptocurrency wallet addresses and on-chain transaction records are recorded on public, decentralized blockchains. This has important privacy implications that differ from traditional data systems.

Inherent Publicity of Blockchain Data

Blockchain networks are designed to be transparent and immutable. Once a transaction is recorded on a public blockchain, it becomes permanently and publicly accessible to anyone. Your wallet address, transaction history, token balances, and other on-chain activity are publicly visible regardless of your relationship with Passport.Me or any other service.

Limitations on the Right to Erasure

What We Can Delete

Upon an erasure request relating to wallet data, we will:

• Remove the wallet address record (in the wallet_accounts table)
• Remove any wallet address references from the connected_apps and events tables (within the applicable retention periods)
• Cease proxying on-chain data for the deleted wallet to any connected AI tool
• Remove wallet address references from email notification content stored by Resend (where technically feasible under their data deletion process)

WalletConnect Protocol

The WalletConnect protocol facilitates the cryptographic handshake between your mobile wallet application and Passport.Me. WalletConnect processes connection session metadata in accordance with their privacy policy. We recommend reviewing that policy if you have concerns about WalletConnect's data practices.

Security Measures

We implement technical and organizational security measures appropriate to the risk level of the personal data we process. The following describes our primary security controls.

Encryption

• Encryption at rest — Google OAuth tokens (access and refresh) are encrypted using AES-256-GCM before storage in Cloudflare D1. Encryption keys are derived using HKDF (HMAC-based Key Derivation Function) from a root secret, ensuring that the stored ciphertext is computationally infeasible to reverse without the secret.
• Encryption in transit — All communication between your browser or AI tools and Passport.Me is protected by TLS 1.2 or higher. Cloudflare terminates TLS at the edge and enforces HTTPS-only access.

Cloudflare Edge Security

The Service is deployed on Cloudflare Workers, which provides:

• DDoS protection and traffic scrubbing at the network layer
• Web Application Firewall (WAF) rules
• Rate limiting at the edge before requests reach application logic
• Strict security headers including Content Security Policy (CSP), X-Frame-Options, X-Content-Type-Options, and Strict-Transport-Security (HSTS)

Session Management

• Session cookies are marked HttpOnly, Secure, and SameSite=Lax to mitigate common session hijacking attacks
• Sessions expire after 24 hours of inactivity
• Admin access requires a fresh authentication step within a 15-minute window, regardless of existing session state
• OAuth state parameters are validated to prevent cross-site request forgery during authorization flows

Access Controls

• Administrative functions require authentication with a designated admin wallet address
• MCP consumers are authenticated via signed bearer tokens with scoped, per-app permissions
• No employee or contractor has standing access to plaintext OAuth tokens, which exist only in memory during active API proxying operations. Refresh tokens are never exported. While a user has turned on Support access, an administrator can retrieve a Google access token that expires within an hour, after a fresh admin-wallet signature; every retrieval is logged and emailed to the user

Incident Response

In the event of a personal data breach, we will:

1. Contain the breach and assess the scope as soon as possible
2. Notify relevant supervisory authorities within 72 hours of becoming aware of a notifiable breach (as required under GDPR and equivalent regulations), and within 3 working days for the Hong Kong PCPD (as required under PDPO Sections 26A–26F)
3. Notify affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms
4. Document all breaches in our internal incident register

Limitations

No security measure is infallible. While we invest significantly in securing the Service, we cannot guarantee absolute security of data transmitted over the internet or stored in any system. If you become aware of a potential security vulnerability, please disclose it responsibly to privacy@passport.me.

Cookies and Similar Technologies

We use a minimal set of cookies that are strictly necessary for the operation of the Service, together with analytics that count page views and how our public pages are used. We do not use cross-site tracking cookies or advertising cookies. Our public passport.me pages — the home page, /developers, /extension, /cli, /privacy, /terms, and the 404 page — can load Google Analytics 4. Whether it loads by default or only after you agree depends on where you are: in the EU, EEA and UK it is off until you agree; elsewhere it is on by default and you may opt out at any time. Either way the choice is made from the analytics notice shown on those pages, and Section 15 sets out both cases. The same choice controls our own event measurement on the home page and /developers, described below. Cloudflare Web Analytics runs across our domains, including the signed-in account dashboard at my.passport.me. It is cookieless: it sets no identifier on your device and cannot link your visits across sessions or across sites. Google Analytics is not loaded on the signed-in dashboard, and our own event measurement sends nothing from it.

Our Own Event Measurement

On the home page and /developers, a small script of ours records a few interactions so we can see which parts of those pages work: a click on one of the home page’s main buttons (with the button’s text and which button it was), how far down the page you scroll (25, 50, 75 or 100%), which sections and slides come into view, and a visit to /developers. Each event carries only those details, the event name, the page path, the time, and the address of the page it was sent from with any query string removed. Our server stores it in Cloudflare Workers Analytics Engine, part of the Cloudflare infrastructure listed in Section 6, and Cloudflare deletes it after three months.

These events are not linked to you. We store no IP address, cookie, account identifier or other identifier with them, and we never combine them with other data to single anyone out, so we treat them as anonymous statistics rather than personal data. The request that carries an event reaches our server like any other, so your IP address is used briefly to rate-limit it (Section 2.11); it is not kept with the event.

This measurement follows the same choice as Google Analytics. In the EU, EEA and UK, and wherever we cannot tell where you are, it is off until you choose “Allow analytics”; elsewhere it is on by default and “Opt out” turns it off. While it is off, the script sends nothing and stores nothing on your device. It never sends anything from the signed-in dashboard.

If an event cannot be sent, for example because your connection drops, the script keeps it in your browser under the pp_metrics_queue_v1 localStorage key (at most 50 events, with no identifier in them) and sends it when you leave the page or on your next visit, deleting it once sent. If you decline or opt out, anything queued is deleted at once rather than sent.

No Third-Party Tracking Cookies

Aside from Google Analytics 4, Cloudflare Web Analytics and our own event measurement (all described in this section, and none used for advertising), we do not use:

• Behavioral or cross-site analytics platforms such as Mixpanel or Segment
• Facebook Pixel or any social media tracking pixels
• Advertising network cookies or retargeting technologies
• Fingerprinting scripts or other non-cookie tracking technologies for cross-site tracking

Managing Cookies

You may configure your browser to block or delete cookies. However, blocking the passport_sid cookie will prevent you from logging in or using the Service, as it is technically necessary for session management. Instructions for managing cookies vary by browser; please refer to your browser's help documentation.

Cookie Consent and the EU / UK

Apart from analytics, the Service uses only strictly necessary cookies, which do not require consent under the EU ePrivacy Directive (Cookie Law) or the UK Privacy and Electronic Communications Regulations (PECR). Cloudflare Web Analytics is cookieless — it stores nothing on, and reads nothing from, your device — so it falls outside those consent requirements as well.

Google Analytics 4 does set cookies, so how it behaves depends on where you are. We determine that from the country Cloudflare associates with your connection; we do not store that country, and where we cannot determine it we treat you as being in the first group below.

• In the EU, EEA, or the UK — Google Analytics is off until you agree to it. Nothing is loaded and no _ga cookie is set on your first page view. We show a notice with an "Allow analytics" control; only if you choose it do we load Google Analytics and update Google Consent Mode to analytics_storage: granted. Declining, or simply ignoring the notice, leaves analytics off.
• Everywhere else — Google Analytics is enabled by default and the notice offers a clear "Opt out" control. Choosing it sets the GA4 disable flag for your browser and updates Google Consent Mode to analytics_storage: denied, so no further measurement is sent. In this case the _ga cookies are set on your first page view, before you interact with the notice; opting out stops further measurement but does not retroactively delete cookies already set. To remove those, clear or block cookies for this site in your browser.

Our own event measurement, described above, follows the same choice in both cases.

Advertising storage, ad user data, and ad personalization are denied at all times and are never enabled, in both cases. We record your choice in the ppme.consent.analytics localStorage key (with the ppme_analytics cookie as a fallback where browser storage is unavailable), for transparency and audit purposes. Earlier versions of the home page recorded your dismissal of its cookie notice in the ppme_cookie_consent localStorage key. We no longer read or write it: that notice did not mention analytics, so it does not count as a choice on the analytics notice. You may object to this processing at any time using the contact details in Section 18, or exercise the rights described in Section 11.

Do Not Track

Some browsers support a "Do Not Track" (DNT) signal that indicates a user's preference not to be tracked across websites.

We honor DNT signals. Passport.Me does not track users across third-party websites or services, does not engage in cross-site behavioral advertising, and does not build advertising profiles. We do not share your data with advertising networks or data brokers. As a result, our practices are consistent with DNT preferences regardless of whether a DNT signal is present.

We do collect certain data automatically within the Service (session identifiers, IP addresses, event logs) for operational security purposes as described in this Privacy Policy. This operational data collection is not the type of cross-site tracking that DNT signals are intended to address.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our data practices, new features, changes to applicable law, or for other operational reasons.

Notification of Changes

• Material changes — if we make material changes that significantly affect your rights or how we process your personal data, we will notify you by email (to the address on your account) and by prominently displaying a notice on the Service at least 30 days before the changes take effect.
• Minor changes — for non-material changes (such as clarifications, corrections, or updates that do not change the substance of our data practices), we will update the effective date at the top of this Policy.

Review and Acceptance

We encourage you to review this Privacy Policy periodically. Your continued use of the Service after a change has taken effect constitutes acceptance of the updated Policy. If you do not agree with a material change, you may delete your account before the change takes effect by following the instructions in Section 9.

Version History

Previous versions of this Privacy Policy are available upon request by emailing privacy@passport.me.

Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or our data practices, please contact us using the following:

Primary Contact

We aim to acknowledge all privacy inquiries within 5 business days and to resolve substantive requests within the statutory timeframes listed in Section 11.

EU / UK Data Protection Officer (DPO)

For users in the European Economic Area or the United Kingdom, you may contact our appointed Data Protection Officer:

Contacting our DPO is an alternative to contacting us directly. You may also contact your local supervisory authority directly (see Section 19) without first contacting us or our DPO.

Language

This Privacy Policy is provided in English. Where we are required by applicable law to provide a translation, we will do so. In the event of any inconsistency between a translated version and the English version, the English version shall prevail to the extent permitted by law.

Supervisory Authorities

You have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction. We encourage you to contact us first so we can address your concern directly, but you are not obligated to do so.