PassdownPrivacy Policy
1. Who we are
Passdown is provided by [[DEVELOPER_NAME]], [[DEVELOPER_ADDRESS]] ("we", "us"). Contact: support@fishingcatch.net.
2. On-device sites (no account)
When you use a site only on one device, all entries, photos, checklists, handovers, signatures and settings are stored only on that device (and in your device backups if you use them). We cannot see this data. The JSON export in Settings is created on your device and only goes where you send it.
3. Team sites
When you create or join a team site, the app creates an anonymous account on our server. There is no email address, phone number or password. To sync the site between members we store:
- Account data: a random account ID, a random device ID, a hashed refresh token, the app version, your device language and time zone.
- Member data: the display name and stamp text you choose (a nickname is fine), your role and your notification quiet hours.
- Site content: site name, shift templates, post orders, checklists, notes, tasks, incidents, handovers, confirmations, questions and replies, signatures and stamps, corrections, and the device and server timestamps and integrity hashes of these records.
- Photos: a compressed copy (about 1280 px) of photos added to team-site entries, plus a small thumbnail. The full-size original stays on the phone that took it.
- Push token: to notify you about handovers, questions and assignments. Notifications show item numbers and names, never the text of an entry.
- Sign in with Apple (optional): only the anonymous Apple user identifier, so you can recover your team sites on a new phone. We do not request your name or email.
Purpose and legal basis: providing the sync service you asked for (GDPR Art. 6(1)(b)). Content that members enter about other people (for example visitors or residents) is the responsibility of the site owner, who acts as controller; for that content we act as processor on the owner's behalf.
Retention: site content is kept while the site exists. Compressed photos are deleted from the server after 14 days (90 days on Pro); thumbnails stay with the record. Deleted records are purged 90 days after deletion. When a member leaves, the handovers they signed stay in the site's history with their display name, because the handover log belongs to the site.
4. Purchases
Payments are handled by Apple. We never receive your payment details. To unlock Pro for your sites, the app sends us Apple's signed transaction (product, transaction ID, purchase and expiry dates), which we store with your anonymous account.
5. Usage statistics
To learn which features help, the app sends usage events such as "handover submitted" with counts and settings (for example number of items or export format). Events never contain entry text, site names, member names or photos. They carry a random device ID and session ID, app version and language and — once you use a team site — your random account ID, so events are linked to that anonymous account (not to your name, e-mail or phone number). Detailed events are kept for 90 days and daily totals for 400 days; deleting your account deletes the detailed events linked to it. You can turn this off in Settings → Privacy → Share usage data; the change takes effect the next time the app starts. Legal basis: our legitimate interest in improving the app (GDPR Art. 6(1)(f)).
6. Crash reports
If the app crashes, a crash report (stack trace, device model, iOS version, app version, a random installation ID and your anonymous account ID) is sent to Firebase Crashlytics, a service of Google, so we can fix the problem. Crash reports contain no entry text or photos and are kept for 90 days.
7. Permissions
- Camera: only when you tap to take a photo.
- Photos: the system photo picker gives the app only the photos you choose.
- Notifications: only for handover events; you can set quiet hours.
- Never requested: location, contacts, microphone, health data, advertising identifier (no App Tracking Transparency prompt).
8. Where your data is stored
Team-site data is stored with Cloudflare (Cloudflare Workers and D1 database), which operates a global network; data may be processed outside your country. Transfers from the EU/UK rely on the European Commission's Standard Contractual Clauses. All traffic uses HTTPS and data is encrypted at rest.
9. What we never do
We do not sell or share data for advertising, do not track you across apps or websites, do not build performance scores of employees, and do not give site owners any view of how often members open the app.
10. Your rights and choices
- Export: Settings → Data → Export backup (a JSON file per site with all entries and handovers and photo thumbnails). Site owners can also export the whole team site. Full-size photos move to a new phone with your normal iPhone backup (iCloud or computer).
- Delete: Settings → Account → Delete my account removes your account, devices, push tokens and the usage events linked to your account, revokes Sign in with Apple, and leaves all team sites. If you are the only owner, ownership passes to the earliest member; if there are no other members, the site and its photos are deleted. "Delete all data on this device" removes local data.
- Depending on where you live (for example GDPR in the EU/UK, APPI in Japan, PIPA in Korea, PIPL in China, CCPA in California) you may have the right to access, correct, delete, restrict or object to processing, and to data portability. Contact support@fishingcatch.net; we answer within 30 days. You may also complain to your data protection authority.
11. Children
Passdown is a work tool and is not directed at children under 16.
12. Changes
If we change this policy, we will update the date above and, for significant changes, tell you in the app.