Privacy

How we use your information

PasserJack uses your information to save and synchronize content, provide sharing and connected-agent features, secure your account, process payments, and respond to support requests.

We do not sell your personal information or use your saved content for advertising. PasserJack does not use your content to train models. There are no advertising or third-party analytics scripts in the application. Optional image, document and audio analysis involves a separate provider, described below.

Information we store

Account and access information: your verified email address and how you signed in. If you use Google, that includes your Google account identifier, name and profile picture. If you use Sign in with Apple where it is offered, Apple sends an account identifier, an email address that may be a private relay address Apple creates instead of your real one, and, on your first sign-in only, the name you choose to share. We also store sign-in sessions and provider credentials; API keys and connected-app authorizations; device names, platform and browser details, and activity timestamps. We never receive your Google or Apple password. API keys and device access tokens are stored as hashes. Browser sessions and provider sign-in credentials use separate authentication storage.

Where your access was set up: when you make an agent key, connect an app or pair a device, we record the network (IP) address, the browser and the approximate place of the browser that did it, and the device it was signed in from. We show them to you in Settings. We keep them with that key, app or device's record, including after you revoke it.

Email sign-in: when you ask for a sign-in link, we email a one-time link to the address you enter. Until it is used or expires (after 10 minutes), we keep that address with a protected form of the link's token; expired ones are cleared out periodically. To limit abuse, each request is recorded with protected identifiers for the address and for the network address it came from, kept for about a week. A request to an address that may not sign in is not mailed.

Saved content: text, links, code, files, titles, notes, tags, previews, timestamps, the device or agent that supplied an item, and its sharing and expiry settings. Files also have metadata such as their name, type, size and dimensions. Named parts of an item can have revision history. When image analysis is enabled, we store its descriptions, extracted text, labels and other structured results. For a video, we also store a transcript of its audio beside the file, and that transcript is included in search. For an audio file, we store a transcript in the same way. For a document, we also store a short AI summary with its topics, suggested tags and quoted details. For a PDF page with no text layer, we store the text that the model read from a picture of the page, marked as read by AI.

Sharing and notifications: trusted-contact email addresses, link expiry and revocation settings, and view counts. When somebody opens a share link, we record the time, the network (IP) address, the browser's user agent and language, and the site the link was opened from. We derive an approximate place (city, region and country) from the address with the DB-IP database. For a restricted link, we also record the signed-in account. We show these records to the person who shared the link, and we keep them as long as the link exists. The email addresses you enter for a restricted link, or that it copies from your trusted contacts, are stored with that link in readable form, alongside a protected identifier used to check who may open it. We also keep a list of the addresses you have shared with before, with when and how often, so the share dialog can suggest them; you can forget any suggestion, which does not change links already created. A request from an API key or device to email a link to its recipients is stored encrypted until you approve or decline it, or it expires. Notification registration details let us reach devices that have enabled push. Email delivery records include the message type and a protected recipient identifier; the sending provider receives the address and message. These records are deleted with your account, except the record of a link that somebody else shared and you opened. That record belongs to that person.

Support conversations: the subject, messages, attachments, and optional browser details you choose to send, along with request status and reply history. These are readable by PasserJack support and its authorized support agents; they are separate from your encrypted Vault. Conversations stay with your account until account deletion. Your account export includes customer-visible support history and attachments, but not internal operational notes. Email notifications link back to the conversation without including its contents.

Billing and service operation: Stripe customer and subscription identifiers, plan and billing-period information, usage totals, and operational records used to diagnose errors, prevent abuse and measure service costs. Payment card details are handled by Stripe. Vault reads performed for authorized agents are recorded with the time and calling credential, without recording the content in that audit trail.

Board and Vault protection

Board content is stored in a form the service can read, so it can provide search, previews and sharing. Vault content uses a different protection model: its saved bodies, files and thumbnails are encrypted under keys protected by your trusted devices and recovery code.

Vault captures made through the browser are encrypted on your device before upload. Some capture paths, including API and agent submissions, send content to the server for encryption to your vault's public key. The server processes that plaintext during capture, then stores encrypted content. These paths do not have the same protection before storage as a capture encrypted on your device.

Vault metadata is not encrypted: titles, notes, tags, item kind, filenames, sizes, timestamps, and account and sharing relationships remain available to the service. Keep sensitive information in the content rather than its label or filename.

Agents cannot read your saved vault content by default. If you explicitly unlock the vault for agents, your browser provides the server with a derived read key for the duration you select: 15 minutes, 1 hour or 8 hours. During that window, a credential with Read my vault permission can obtain content on your behalf. The held key stays in server memory and is cleared when the window closes or expires. This permission is called secrets in the API.

• Understand Vault protection and its limits

Sharing and external connections

A public share link can be opened by anyone who has it. Restricted links require sign-in with an allowed account. For every link, the sender can see when it was opened, the network (IP) address and approximate place it was opened from, and the browser that opened it. For a restricted link, the sender can also see which account opened it. If you open a link that somebody else shared, that record belongs to the person who shared it, and it is not deleted with your account. Trusted-contact audiences use the recipient list at the time the link is created. Changing that contact list does not change existing links.

A one-click encrypted link includes information needed to decrypt its content. Treat the complete link as access to that content. Vault access granted to another account is a separate sharing mechanism. Revocation restricts future access through PasserJack; it cannot remove copies a recipient has already saved.

When you fill in a form through a PasserJack share link, we store your answers, the time of each change, your network (IP) address and your browser's user agent, and show them to the person who shared the form. If the link asks who is filling it in, we also store the name and email address you type, and show them to the person who shared the form. Other people who have the link see only the name. We keep them as long as the form's owner keeps the form.

QR handoff links provide temporary access to one eligible item without signing in. Each link opens once and expires after five minutes. A QR code is a way to carry a link, not an additional encryption layer.

To create link previews, PasserJack contacts linked websites and may fetch preview images. Media lookup and download contact the source platform and may use a configured network proxy. Those services receive the requested address and connection information. Links and remote resources you open can also be subject to the destination's own privacy practices.

An agent or application with read permission can read all ordinary Board items and attachments, including items you added. Own-only credentials restrict changes to items that credential created; they do not restrict Board reads. Secrets permission also includes text and extracted details from sensitive Board images without a Vault unlock window. Vault reads require both that permission and an explicit Unlock for agents window. Content retrieved by another application is also handled under its policies. Revoke unused connections and grant only the permissions you need.

Service providers and notifications

Google, and Apple if you use Sign in with Apple, supply sign-in identity information. Stripe processes payments and subscription management. Railway hosts the application, database and object storage used for files. These providers process the information needed to perform their respective roles.

The approximate place of a share link's opener, and of the browser that set up an agent key, a connected app or a paired device, comes from a copy of the DB-IP database that runs on our own servers. No address is sent to DB-IP. IP geolocation by DB-IP (db-ip.com), CC BY 4.0.

Resend delivers sign-in links and billing, sharing and vault-reset emails. It receives the recipient address and message; a sign-in email contains the sign-in link; a sharing email can also include the sender's identity and the share URL. OpenAI provides the image, document and audio analysis described below.

If you enable notifications, delivery uses your browser's push service or Apple's notification service. Notifications can show snippets of ordinary Board content. Vault notifications do not include decrypted content, but may show a plaintext title, note or tag. Your operating system's notification settings control what appears on your lock screen.

Image analysis and your choice

Where image analysis is enabled for eligible paid accounts, images are sent to OpenAI to generate descriptions and extract text for search. For a video, a sheet of four still frames is sent for the same analysis, and up to the first ten minutes of its audio is sent to OpenAI to produce a transcript, within your plan's monthly transcription minutes. For an audio file, up to its first ten minutes are sent in the same way, within the same minutes. For a document, the text that PasserJack reads from the file is sent to OpenAI to produce a short summary with a document type, topics, suggested tags and quoted details, within your plan's monthly document allowance. For a PDF page that has no text layer, a picture of the page is sent to OpenAI to read the words on it, and each such page counts as one image against your plan's monthly image allowance. The account setting is enabled by default. Vault content and legacy encrypted attachments are excluded.

The request contains a resized image, our analysis instructions, and technical information about the image's type, dimensions and analysis level. A document request contains the extracted text with a marker for each section or page, our summary instructions and technical settings. A scanned-page request contains a picture of the page at a reduced size, our reading instructions and the page's pixel size. We do not add your account email, filename, title, notes, tags or other saved items to the request. Information visible within the image, the page or the text itself is necessarily included. A transcription request contains the video's or audio file's sound, converted to a compact mono recording, and technical settings for the transcription model, without those account details either. Speech and other sound in the recording are necessarily included.

OpenAI states that API inputs and outputs are not used for model training by default unless the customer opts in. Its default abuse-monitoring logs may retain customer content for up to 30 days, with exceptions where retention is required by law. This describes the provider's published default policy, not a claim that PasserJack has special zero-retention terms.

To turn analysis off, open Settings, then Privacy, and turn off Describe and read my images. This deletes existing analysis results, video and audio transcripts, document summaries and text read from scanned pages from PasserJack, and removes queued work of every kind. A request already sent to the provider may finish, but its result is not saved after the opt-out. Your original images, videos, audio files and documents remain, and so does text that PasserJack read from a document on its own servers without the provider. Turning analysis back on does not restore deleted results.

• OpenAI API data usage and retention policy

Data stored on your device

PasserJack uses sign-in cookies and local browser storage for account selection, settings, trusted-device keys and pending captures. The service worker caches application assets and an offline page; it does not provide an offline backup of your account.

When you fill in a form through a share link, your browser can keep the answers that you did not send yet and the name that you typed for that link, for up to 30 days. If the link asks for your email address, your browser keeps it only until you close the tab. Signing out of PasserJack in that browser removes all of them.

Pending offline captures, including captures intended for the Vault, can be stored in plaintext on your device until they are encrypted and sent when connectivity returns. Protect access to your device. Clearing site data can remove unsent captures and the keys that make that browser a trusted vault device.

Downloaded files and copies made by other applications remain under your control or those applications' control. Deleting an item from PasserJack does not erase those copies.

Retention and deletion

Saved items remain until you delete them or their chosen expiry is reached. Archiving keeps an item. Expired items become unavailable through normal reads; background cleanup removes their stored records and files later.

Deleting an item removes its active record, associated sharing and history records, and schedules or attempts removal of its files, derivatives and retained file versions. Storage cleanup can take longer if a provider operation fails. Deletion is not a promise of immediate physical erasure from every storage system, backup or recipient's device.

Previous named-part versions are limited to the newest 20 and become eligible for cleanup after 30 days. Deletion synchronization records contain identifiers and a deletion time, not the deleted content, and become eligible for cleanup after 30 days. These cleanups run with service activity, so records can remain beyond those thresholds.

Vault agent-read history remains until the item or account is deleted. Image-analysis, transcription, document-summary and page-reading call records contain account and file identifiers, model, timing and cost information, and for a transcription the length of audio sent, without the image, the page, the text, the audio or the generated answer; they become eligible for cleanup after 90 days. Monthly usage totals are retained separately. Generated analysis, transcripts, summaries and page text remain with their item until deletion or your analysis opt-out.

Account deletion starts from Settings, then Account, with Delete my account. The deletion happens seven days after the request. Until then you can cancel it in Settings or from the link in the email we send. At the deadline the account is closed: every session, device, agent key and connected app is ended, every share link and share is revoked, and the subscription is set to end at its paid period. An automatic job then erases the content and the records; it waits for a paid subscription period to end first. A record of the deletion, with the account identifier and its dates and never the content, is kept. Billing providers may retain transaction records for their own legal, tax and dispute obligations.

Your choices and requests

You can delete items, manage share links, revoke devices, API keys and connected apps, turn off image analysis, and cancel renewal through the billing portal. Subscription cancellation and account deletion are separate actions.

For a copy of your data, open Settings, then Account, and press Export my data. The archive is ready within a few minutes to a few hours, depending on how much you store, and you can download it for seven days. You can ask for one export each day. Vault entries in the archive stay encrypted and open only with your recovery code on a trusted device. For questions about your personal information, contact PasserJack support. Do not send passwords, API keys or your vault recovery code. Vault plaintext can only be exported from a device that can open it; support cannot reconstruct a lost vault key.

To put an archive back, open Settings, then Account, and choose Restore from an export. The archive you upload is stored only until the restore finishes or is given up, and it is then deleted. The restore adds the archive's items to the account you are signed in to; an item that is already in the account is not restored twice. Share links, shares, agent keys, devices and other people's content are never restored. Restored files get the same processing as an upload, except image analysis and document summaries, which a restore does not run.

• Recovery, copies and account deletion

Children

PasserJack is not intended for children under 13, and we do not knowingly collect their information.

Policy changes

We update this page and its revision date when our practices change. Contact us if you have a question about this policy or how a change affects your account.