Passby privacy policy

Effective November 3, 2026

What our server keeps

• An account id. A scrambled code made from your Apple or Google sign-in. Your phone sends us a sign-in token from Apple or Google, which can include your email. We check it and keep only the scrambled code, never your name or email.
• A push token, so a friend's phone can ask us to ping yours.
• A scrambled copy of your friend code, so a friend request reaches you. We can't turn it back into your code.
• Friend requests and replies, sealed by the phones so we can't read them. Each is deleted once answered, or after 14 days.
• Encrypted location tokens. Only your friends' phones can open them. They live in memory, never on disk, and expire within about 16 hours. A new one replaces the last. Ghost mode, a stealth zone or signing out removes them as soon as your phone reaches our server.
• Your profile photo, if you add one, encrypted. Your phone seals a separate copy for each friend, and only that friend's phone can open it. We can't see the photo. A copy is deleted when you remove the photo, remove that friend, or delete your account.
• Passby+, if you subscribe. Apple's id for your subscription, when it ends, and when Apple last confirmed it. Apple handles the payment, so we never see your card or Apple ID. Apple tells our server when the subscription renews, ends or is refunded. Tips are not recorded at all.
• Which friends matched, and when. We use this to send a ping, and to avoid pinging the same two friends again for 2 hours.

Our server keeps no request logs. When a request fails, it notes the kind of request and the error type, with nothing that identifies you.

What stays on your phone

Your name, your photo, your friends and their photos, your encryption keys, your stealth zones and schedules, your Passby+ map and pin choices, your latest location, and which version of the terms of service you accepted. Passby keeps no history of where you have been.

What your friends see

A friend you added sees your name, and your photo if you add one. When you are both in range, they see you on their map, rounded to about 25 m. In range means within the smaller of your two radar sizes. A friend running a modified app could read your rounded location within about 450 m, so add only people you trust, and remove anyone you stop trusting.

If you have Passby+, your friends see a small supporter badge by your name.

In a stealth zone or in ghost mode, nobody can see you at all.

Other services Passby uses

• Apple or Google confirm your sign-in, so they know you use Passby.
• Apple takes payment for Passby+ and tips.
• OpenFreeMap draws the map. It sees which area of the map your phone shows, and your IP address, but not who you are.
• Expo, Apple and Google deliver pings. A ping from our server says only "A friend is nearby". Only a ping your own phone makes shows the friend's name.

Deleting your data

In the app, open Settings and press Delete account. That removes your record, your location tokens, your photo copies and any waiting friend requests from our server, and everything Passby keeps on your phone. Match records and the 2-hour ping pause are not deleted, but expire on their own within 2 hours. If you had Passby+, its subscription id and dates stay with nothing linking them to you, so a refunded subscription can't be used again, and are deleted 400 days after Apple last confirmed them. Deleting your account does not cancel Passby+. Cancel it in your Apple ID's subscription settings. Uninstalling the app removes what is on your phone.

Children

Passby is not meant for children under 13, and we don't knowingly let them use it.

Changes and contact

Using Passby also means accepting our terms of service. If this policy changes, the new version appears here with a new date. Questions go to support@shawnzhu02.com.