1. Summary at a glance
Your privacy is not a feature we added at the end. PassGram is built around the idea that the most useful thing we can do with your personal information is to protect it and then get out of the way. The short version of this policy is below; the rest of the page explains each point in detail.
- We collect only what the service needs. Account details, the content you choose to store or send, and limited technical data used to keep your account secure.
- We do not sell your personal information. We have never sold it, we do not rent it, and we do not share it with data brokers.
- We do not show advertising and we do not build advertising profiles about you.
- Security events are shown to you first. New-device sign-ins, one-time codes and approvals are delivered to your own signed-in app, not to a third party.
- You stay in control. You can view, correct, export and delete your information, and you can end any active session at any time.
2. Who this policy applies to and who we are
This policy applies to everyone who visits our websites, installs our apps, creates an account, signs in through the web app, or uses the developer API. In this policy, “PassGram”, “Z Pass”, “we”, “us” and “our” mean the team that operates these services. If you use PassGram on behalf of an organisation, you confirm that you are allowed to do so and that the organisation has agreed to this policy.
Where this policy says “personal information”, it means any information that identifies you or can reasonably be linked to you, such as your username, your email address, your device name or your approximate location. Information that has been properly anonymised so that it can no longer be linked to a person is not personal information.
3. Information we collect
We group the information we handle into the categories below. For every category we try to explain where it comes from and what we use it for.
3.1 Information you give us
- Account details such as your username, display name, profile photo, email address and the sign-in method you choose.
- Content you create such as messages, notes, attachments and items stored in your private space. Content that is end-to-end or vault encrypted is stored in encrypted form and we cannot read it.
- Support requests including the message you write and any screenshot you attach. Please remove secrets before sending anything.
- Preferences such as language, theme, notification settings and privacy choices.
3.2 Information created when you use the service
- Session and device records: a device name (for example “Chrome on Windows”), the date and time a session was created, and a session identifier. These power the Active Sessions screen so that you can recognise and end sessions you do not trust.
- Approximate location: a city and country derived from the network address of a sign-in. We use it only to show you where a sign-in came from; we do not track your movements and we do not use GPS for this purpose.
- Security events: sign-in attempts, QR approvals, one-time code requests and their outcome, so that we can warn you about suspicious activity and block abuse.
- Diagnostic data: app version, operating system version and error reports that help us find and fix crashes.
3.3 Information from other sources
If you sign in using a third-party identity provider, we receive the basic profile information that provider shares with us (for example your name and email address). If you subscribe to a paid plan, our payment processor tells us whether the payment succeeded and which plan you are on. We never receive your full card number.
4. What we will never do
Some promises matter more than the details, so we state them separately:
- We will never sell or rent your personal information.
- We will never ask you for your master password, your recovery key, your one-time codes or your session tokens. Anyone who does is not us.
- We will never use the content of your private space for advertising, profiling or to train advertising models.
- We will never place third-party advertising trackers on our website or in our apps.
- We will never hide a security incident that affects you. If your information is put at risk we will tell you promptly and clearly.
5. How we use information
We use personal information only for purposes that are necessary to run, protect and improve PassGram. In practice that means:
| Purpose | Examples | Basis |
|---|---|---|
| Provide the service | Creating your account, syncing your content, delivering messages, signing you in on the web with a QR code or one-time code. | Performing our agreement with you |
| Keep you secure | Detecting new-device sign-ins, rate-limiting guesses, blocking automated abuse, delivering security notifications to your app. | Legitimate interest and legal obligations |
| Run paid plans | Activating Plus or Pro, handling renewals, preventing payment fraud. | Performing our agreement with you |
| Support you | Answering questions, investigating bugs you report, restoring access. | Performing our agreement; legitimate interest |
| Improve reliability | Finding crashes, measuring performance, planning capacity. | Legitimate interest |
| Meet legal duties | Responding to valid legal requests, keeping required accounting records. | Legal obligation |
We do not use automated decision-making that produces legal or similarly significant effects on you.
6. Sign-in security messages
When someone signs in to your account from a new device, PassGram sends a notice to your already signed-in app. The notice contains your username, the date and time in UTC, the device name and the approximate location, together with instructions for ending the session if it was not you. The notice is generated by the system, is shown in a protected inbox inside the app, and cannot be replied to, edited or forged by other users.
When a one-time sign-in code is required, the six-digit code is delivered to your app instead of by SMS. Codes are short-lived, can be used once, and are stored only as a one-way hash on our side. QR sign-in requests expire after ten minutes and can be approved by only one device.
7. When we share information
We share personal information only in the limited situations below.
- Service providers. Infrastructure providers that host and deliver the service, for example Google Firebase for authentication, database and hosting, and Stripe for payments. They may only use the information to provide their service to us and are bound by their own contractual and legal privacy obligations.
- Other people, at your direction. Content you send to another person, or make visible in your profile, is visible to them. Please think before you share.
- Legal and safety. If we receive a valid legal request, we review it carefully, challenge it if it is overbroad, and disclose only what we are legally required to. We will notify you unless the law or the request forbids it. We may also act to prevent serious harm or fraud.
- Business changes. If PassGram is involved in a merger or transfer of assets, we will give you notice before your information becomes subject to a different privacy policy.
We do not share personal information with advertisers, and we do not “sell” or “share” personal information for cross-context behavioural advertising as those terms are used in privacy laws.
8. How we protect information
We apply several layers of protection. Data is encrypted in transit using modern TLS. Vault content is encrypted before it is stored. Sensitive security values, such as one-time codes, are stored only as hashes. Access to production systems is restricted to the people who need it and is logged. Server-side security rules prevent one account from reading another account’s data.
No online service can promise absolute security. If we discover a breach that affects your personal information we will notify you without undue delay, explain what happened, and tell you what you can do. You can read more on our Security page.
9. How long we keep information
| Information | How long we keep it |
|---|---|
| Account details and content | For as long as your account is active, until you delete it. |
| Session records | While the session is active, and for a short period afterwards so that you can review recent activity. |
| One-time codes and QR requests | Minutes. They expire automatically and expired requests are removed by scheduled cleanup. |
| Security event logs | A limited period needed to detect abuse and investigate incidents. |
| Support conversations | Until the request is resolved plus a reasonable follow-up period. |
| Billing records | As long as tax and accounting law requires. |
When you delete your account we remove or irreversibly anonymise your personal information, except for the limited records above that we are legally required to retain. Backups are overwritten on a rolling schedule, after which deleted data is gone.
10. Your rights and choices
We apply the same standard to every user, wherever you live. You can ask us to:
| Right | What it means |
|---|---|
| Access | Tell you what personal information we hold about you and give you a copy. |
| Correction | Fix information that is inaccurate or incomplete. |
| Deletion | Delete your account and the personal information associated with it. |
| Portability | Provide your information in a structured, commonly used format. |
| Objection and restriction | Stop or limit processing that is based on our legitimate interest. |
| Withdraw consent | Withdraw any consent you gave, without affecting earlier processing. |
| No retaliation | You will never receive a worse service for using these rights. |
These rights reflect the principles of laws such as the EU and UK GDPR, the California Consumer Privacy Act as amended, Brazil’s LGPD and similar laws. If your local law gives you additional rights, they still apply. To exercise a right, contact us using the details in section 15. We may need to verify your identity first, and we will respond within the time required by law, normally within 30 days.
11. Your privacy choices
PassGram does not run advertising, so there is nothing to opt out of in that sense. We still give you controls over the things that matter:
- Cookies and storage: choose essential only, or also allow optional preferences, in the cookie banner. You can change your mind at any time by clearing site data in your browser.
- Notifications: turn security and general notifications on or off in your device settings and in the app.
- Sessions: open Settings → Devices to end any session instantly.
- Do Not Track and Global Privacy Control: because we do not track you across other sites, we treat these signals as already respected.
12. Cookies and local storage
The PassGram website and web app use cookies and similar technologies only where they are necessary. They keep you signed in, remember your language and theme, protect forms from forgery, and remember your cookie choice. We do not use advertising cookies, social-media tracking pixels or cross-site analytics.
| Type | Purpose | Can you refuse it? |
|---|---|---|
| Essential | Sign-in session, security tokens, load balancing. | No. The service cannot work without them. |
| Preferences | Language, theme, interface settings. | Yes. |
| Analytics | We do not use third-party analytics on the marketing website. | Not applicable. |
13. International transfers
PassGram is used all over the world, and our service providers operate data centres in several regions. This means your information may be processed in a country different from your own. When we transfer personal information across borders we rely on appropriate safeguards, such as standard contractual clauses or adequacy decisions, where the law requires them.
14. Children
PassGram is not directed to children under 13, or the higher minimum age that applies in your country. We do not knowingly collect personal information from children below that age. If you believe a child has given us personal information, please contact us and we will delete it. Parents and guardians remain responsible for accounts used by minors.
15. Contact and complaints
You can reach us through Settings → Support inside the app, or on X at @4rezan. Never send passwords, recovery keys, card numbers, one-time codes or session tokens to anyone, including us.
If you are unhappy with how we handled a privacy request, please tell us first so that we can put it right. You also have the right to lodge a complaint with the data-protection authority in your country.
16. Changes to this policy
We may update this policy when our services or the law change. When the change is significant we will notify you in the app or by another prominent method before it takes effect, and we will update the date at the top of this page. Earlier versions are available on request.