Privacy policy

Accounts and sign-in

You can create a passage without registering. We use cookies to keep your signed-in or guest session and browser storage to remember your preferences. Registered accounts store your name, email address, verification status, preferences and sign-in information. Passwords are stored as hashes, rather than readable passwords.

Google and GitHub sign-in provide your basic profile and email address. We use that information to identify you and manage your account. We request identity access only; we do not request access to your Gmail, Google Drive or GitHub repositories. Provider credentials may be stored with your linked account. We send account verification, password recovery and subscription messages through Resend.

Conversations and published passages

When you submit a public conversation link, we retrieve and save its content, including supported embedded images, to prepare your passage. We send selected conversation text to OpenAI to generate a title and highlights. You can edit the result before publishing.

Private drafts, account settings and templates are not publicly listed. Publishing makes the saved conversation, title, highlights, share card and any included branding available to anyone with its passage link. Search engines and social platforms may copy or cache public pages and images. Only submit content you have permission to share publicly.

Uploaded artwork and templates

We store uploaded backgrounds and logos in Cloudflare R2, and save your templates and share-card settings with your account. Original account uploads use private storage. Their appearance can become public when you include them in a published passage. Passage does not generate custom background images with AI.

Payments

Stripe handles Checkout, payment methods and billing management. We store Stripe customer and subscription identifiers, plan and payment status, billing periods and related billing events to provide paid access. Your full payment-card details are handled by Stripe and are not stored in Passage's database.

Service providers and operational data

Vercel hosts the application and background preparation workflows; Neon stores application data; Cloudflare R2 stores images; OpenAI processes summary requests; Resend delivers transactional emails; and Stripe processes payments. Google and GitHub provide optional sign-in. These providers process the information needed for their respective services, which may involve processing outside your country.

We use website analytics, request logs, session metadata and usage records to understand site use, troubleshoot problems, prevent abuse and enforce allowances and spending limits. These records can include page addresses, browser or device information, IP addresses and timestamps. We do not sell your account information.

Your choices and data retention

Account settings let you manage linked sign-in methods and delete your account. Account deletion removes your profile, private drafts, preferences and templates, and disables passages owned by the account. Shared conversation snapshots and limited billing, usage and security records may remain for service operation, accounting and abuse prevention. Backups and service-provider records may also retain information beyond deletion from the active application.

Deletion does not recall previously shared content. Public image assets may be retained, and cached pages, social previews and other copies can remain available. Contact us for help accessing, correcting or deleting information, including passages created without an account.