Privacy policy
Last updated 15 October 2026
Your photos are checked on your phone and never uploaded. We don't build a face template. Face landmarks are measured and then discarded.
In short
- PassPic is made by Fjord Studio (ENK), Norway, which is responsible for your data (the controller). Contact: support@passpic.app.
- Checking, measuring and cropping your photo happen on your phone. Your photos never reach us or anyone else, unless you share them yourself.
- No ads. We don't use the advertising ID. We don't sell or share your data.
- No AI edits, and PassPic sends nothing to an AI service. Face detection runs on your phone with Google's ML Kit.
- No sign-in. When you first open the purchase sheet or restore credits, the app makes an anonymous account with no name and no email.
- Some data does leave your phone: app settings and integrity checks, ML Kit usage data, purchase records, and usage statistics and crash reports if you allow them. This page lists all of it.
- All data the app sends is encrypted in transit (HTTPS).
What leaves your phone, and when
| When | What is sent | Who receives it |
|---|---|---|
| Each time you open the app | A Firebase installation ID, the app and Android version, your phone's language, country setting and time zone, and your IP address, to fetch the app's settings (Remote Config). While the app is in front, it keeps a connection open to get new settings | Google (Firebase) |
| You open the camera, or take or import a photo | ML Kit usage data: device model, Android version, app version, performance, error codes and an ID for this installation. Never the photo. This is sent even when statistics are off. | Google (ML Kit) |
| Usage statistics and crash reports are on (see Your choices) | The steps you take in the app, from a fixed list of events, never photos, face measurements, search text, order numbers or anything else you type; an app instance ID; device model and Android version; an approximate location (country and city) that Google derives from your IP address; how you found the app (the Google Play install referrer, which can include an ad click ID); crash reports, and reports of some errors that don't crash the app (a fixed error code and where in the app's code it happened, never the error's message); plus the events Google Analytics logs by itself: first open, sessions, screens, app updates, and in-app purchases with product, price and currency | Google (Analytics for Firebase, Crashlytics) |
| You open a document's requirements | An anonymous RevenueCat ID, to get the prices from Google Play, with your IP address, country and possibly your device model. Once you have tapped Buy on this phone, your anonymous account ID instead, also if you then cancel | RevenueCat |
| You open the purchase sheet or restore credits; after that, each time you open the app (to keep your credits in sync) and when you delete your data | An anonymous account ID (no name, no email) and an app integrity token from Google Play Integrity (Firebase App Check) | Google (Firebase), our server |
| You tap Buy, and you buy | When you tap Buy: your anonymous account ID, to RevenueCat. When you buy: the purchase token, order number and product, so we can give you your credits, and your anonymous account ID, to link the purchase to it. After that, each time the app opens it asks RevenueCat for this account's purchases and sends our server the order number and product of any purchase we haven't confirmed yet | Our server, RevenueCat |
| You use a credit | The document's ID (for example us_passport), a random person ID and a random ID for the credit used | Our server |
| You restore with an order number | The order number, which our server looks up at Google Play | Our server |
| Each time you open the app (Google Play checks for an update), and when PassPic asks you to rate it | The Google Play Store app on your phone checks for an update, and shows the rating card or the update. PassPic doesn't learn your rating | Google Play |
| You email us | What you write, your email address and anything you attach | Our inbox, through Cloudflare |
Never sent: photos, face landmarks or face measurements, search text, the advertising ID, the Android ID or your precise location. We never set a user ID in Analytics.
"Our server" means Cloud Functions and Cloud Firestore in Google Cloud, in the United States.
Your photos and your face
PassPic uses Google's ML Kit on your phone to find your face and measure your photo against your document's rules: head size, eye line, angle, light, shadows and background. The measurements stay in the phone's memory during the check and are then discarded. We don't build a face template and can't identify you.
Your photos are stored only in PassPic's private storage on your phone. Unsaved drafts are deleted after 7 days, and a photo set you paid for is kept until its 30-day retake window ends. App backup is turned off, so they don't go into your phone's backup either. Names you give a person stay on this phone. Files you save to your Photos app or share are yours: they follow your own settings, for example a cloud backup.
How long we keep data
| Data | How long |
|---|---|
| Photos on your phone | Drafts 7 days; a paid photo set until its 30-day retake window ends; files you save are yours |
| Face measurements | Discarded after each check, never stored |
| Purchase records on our server: order number, product, credits and a hash of the purchase token | We keep purchase records as long as you have unused credits or an open retake window, and after that for refunds and restores. We keep them until automatic deletion is switched on; this page will then give the exact times. |
| The credits you used: the document's ID, a random person ID, and when the retake window starts and ends | As long as the purchase records, on the same terms |
| Your anonymous account: an ID with no name, email or photo, and when it was made and last used | Until you delete your data in the app. If you never bought anything and have uninstalled PassPic, we can't tell which ID was yours, so it stays. When you restore your credits on a new installation, the older installation's ID stays too, without its purchases; deleting in the app deletes the ID of the installation you delete from. Our server's note of the ID, used to match a purchase that finishes while the app is closed: As long as the ID itself. We keep them until automatic deletion is switched on; this page will then give the exact times. |
| Purchase and photo-set records on your phone (order number, a hash of the purchase token, document and dates) | Until you uninstall PassPic or delete your data in the app |
| Request logs on our server: time, function, result and technical details such as the IP address; never photos, tokens or order numbers | 30 days |
| Abuse limits: requests to our server are counted per day for your anonymous account, and requests to confirm a purchase, restore credits or delete data also with a salted hash of your IP address | The counters and the salt are not deleted yet. We keep them until automatic deletion is switched on; this page will then give the exact times. |
| Purchase records at RevenueCat | As long as RevenueCat keeps them for our project. We delete your record there when you ask (see Deleting your data) |
| Usage statistics, crash reports, ML Kit usage data, installation IDs and app integrity data | Kept by Google for a limited time under Firebase's retention rules, see Privacy and Security in Firebase |
| Emails you send us | Up to 12 months after your case is closed |
Who processes data for us
- Google: Firebase (Remote Config, Installations, Analytics, Crashlytics, App Check, Authentication, Cloud Functions and Cloud Firestore), ML Kit and Google Play Integrity. Our server data is stored in the United States.
- RevenueCat, Inc. (United States) checks and records in-app purchases with Google Play and gives the app its prices. While we test prices, it shows one of two price levels, chosen at random. It processes data for us under a data processing agreement with the EU standard contractual clauses and the UK and Swiss addenda, and uses its own subprocessors under that agreement. RevenueCat never receives photos.
- Cloudflare forwards email sent to support@passpic.app to our inbox.
- Google Play takes the payment. We never see your card details. Google's own privacy policy covers what Google Play processes.
We don't connect Firebase or Analytics to Google Ads, and RevenueCat's integrations with other services are off.
This website
passpic.app has no cookies, scripts or trackers. Google (Firebase Hosting) processes your IP address and browser details to serve the pages and keeps short-lived server logs.
Legal bases
- Purchases, credits, your anonymous account and the installation ID the app needs to run: to perform our contract with you (GDPR article 6(1)(b)).
- App integrity checks, abuse limits and request logs: our legitimate interest in preventing fraud and abuse (article 6(1)(f)).
- Usage statistics and crash reports: your consent (article 6(1)(a)) in the EEA, the UK and Switzerland; elsewhere our legitimate interest in improving the app, and you can turn them off.
- ML Kit usage data: our legitimate interest in a face detector that works and is maintained (article 6(1)(f)).
- Transfers to the United States: the standard contractual clauses in Google's and RevenueCat's data processing terms.
Your choices
- In the EEA, the UK and Switzerland, usage statistics and crash reports stay off until you say yes. PassPic asks after your first check, and treats your phone as there when its SIM card, mobile network or time zone is there, or when it can't tell. Steps you took earlier in the same session are sent only if you say yes. Elsewhere they are on, and you can turn them off.
- Settings in the app has a switch for each. Turning crash reports off also deletes reports that haven't been sent.
- ML Kit's usage data has no switch. Uninstalling the app stops it.
Deleting your data
- In the app: Settings lets you delete the photos on your phone, and delete your purchase data on our server: your credits, retake windows and anonymous account ID. Your unused credits are lost, and they can't be restored with your order number afterwards. It also clears everything PassPic keeps on this phone (photos, photo sets, names and settings) and closes the app. Photos you saved to your Photos app stay.
- After uninstalling: see Delete your data.
- RevenueCat's copy: deleting in the app doesn't remove it. Email us your order number and the Google Play receipt, and we delete it there within 30 days.
- What stays after deletion: request logs for up to 30 days, Google Play's own records of your purchase, and on our server a record of each purchase (order number and product) without your account ID, so the same purchase can't give credits again and a refund can still be matched, a note that an account was deleted (a hash and a time), and abuse counters. We keep them until automatic deletion is switched on; this page will then give the exact times.
Your rights
You can ask for a copy of your data, and ask us to correct, delete or restrict it, to object to how we use it, or to receive it in a portable format. You can withdraw consent at any time in Settings. Because PassPic has no sign-in, we usually need your order number to find your records. We answer within 30 days.
You can also complain to a data protection authority, for example Datatilsynet in Norway or the authority where you live.
Children
PassPic is made for adults and isn't directed at children. A parent can take a child's photo with PassPic. It is checked on the phone like any other photo and never uploaded.
Changes
When the app changes what it sends, we update this page and the date at the top.
Contact
Fjord Studio (ENK), Norway: support@passpic.app