Privacy Policy
This policy explains what ePassport collects, why, who it is shared with, and what your rights are. It follows Brazil's General Data Protection Law (LGPD, Law 13,709/2018) and the European Union's General Data Protection Regulation (GDPR, Regulation 2016/679). It is written in plain language on purpose; if anything is unclear, write to privacy@epassportapp.com.
1. Who is responsible
The controller of your data is Gabriel Nascimento, an individual, Brasília, Brazil, who also acts as data protection officer. Contact for any privacy matter: privacy@epassportapp.com. When the company that will operate ePassport exists, this policy will be updated with its details.
We have not appointed a representative established in the European Union (GDPR art. 27). If you are in the EU, exercise your rights through the same email; we answer within the same deadline.
2. What we collect and why
Everything ePassport stores comes from you, while using the app. We do not buy data, do not combine it with other sources, and there is no hidden collection.
| Data | Purpose | Required? | Legal basis |
|---|---|---|---|
| Email and password | create the account and sign in. When you sign up with email we send a 6-digit code to your email to confirm it is yours; password reset uses another such code. We do not ask for a phone number and do not send SMS. The password is stored only as a hash; we never see it | Yes, to have an account | performance of contract |
| Name, nationality, home city, travel style, language | your profile and the app's texts | No | performance of contract |
| Public username (@) and bio | your public traveler profile | No | consent (you choose to publish) |
| Profile photo | shown on your profile. If you upload a photo, it is downsized on your device (up to 1024 px, WebP or JPEG, up to 1 MB) and stored in our storage, one file per person; whoever views your public profile sees it. You can replace or remove it at any time, and it is deleted together with the account. If you do not upload one, nothing is collected | No | consent |
| Passport: number, country, printed name, birth date, issue and expiry dates | the passport page and the expiry alert. It is an identity document and we treat it as sensitive in practice | No | consent |
| Stamps: country, city, entry and exit dates, means of entry, visa type, note | the stamp book and the day radar | No | performance of contract |
| Approximate location (country and city) | fill in a stamp when you tap "where am I". Only sent if you save the stamp | No | consent |
| Flights: airline, number, airports, times, booking code | the boarding card and the next destination | No | performance of contract |
| Stays: country, city, place name, check-in and check-out | the hotel widget | No | performance of contract |
| Cards: nickname, brand, last four digits, design. Never the full number, expiry or security code | a visual reminder in the widget. Not a payment method | No | performance of contract |
| Favorite currencies, base currency, budget by category | the exchange and budget widgets | No | performance of contract |
| Preferences: widget order and size, theme, chosen time zones | rebuild your Home the way you left it | No | performance of contract |
| Daily flight search count | limit to 20 searches per person per day and protect the service | Automatic | legitimate interest |
| IP address, country, city and carrier of your connection | the Connection widget, if you add it to your Home: show what the network and websites see about you. Our server reads this at the moment the widget asks, returns it only to you and neither stores nor logs it. The app shows the IP partially hidden | Only with the Connection widget | performance of contract |
| Saved attractions: the code of the tour or attraction and, if you want, the visit date | your list of tours at the destination. We store only the code; title, price, rating and photos are fetched from Viator when shown | No | performance of contract |
| Photos of the stamp pages of your passport, when you tap "Read stamps" | turn the stamps into entries and exits, for you to check and save. The data page (the one with your photo) is rejected, and name, passport number and visas never come back. We do not store or log the photos. They go to Google's Gemini, in the free version, where Google may keep the images and use them to improve its products, including human review; so only with your consent. Without it, you stamp by hand. If Gemini does not answer, the photo goes to Cloudflare's AI (Workers AI), which does not use it for training | No | consent |
| Your consent to stamp reading (the text version and the date) and the count of photos read | prove your consent and limit readings per person. We keep only the number, never the photos | Automatic, if you use it | consent and legitimate interest |
| Health card, if you choose to fill it in: blood type, height and weight, allergies, health conditions, medicines, surgeries and implants, vaccines (and the photo of your international yellow fever certificate), pregnancy, special needs and mobility, whether you are an organ donor, health plan and travel insurance, emergency contact, your doctor and a note for first responders | keep your health information at hand when traveling: to show a doctor, a border post that asks for a vaccine, or whoever helps in an emergency. It is sensitive data (LGPD, art. 11): it is kept encrypted in your account and only you see it (and whoever you choose to show it to, on screen, with "Show a doctor"); it goes to no AI (not even Alfred), never appears on the public profile, goes to no partner and is used for nothing else. You delete everything with one tap, whenever you want | No | specific and prominent consent, given in the card itself |
3. What we do not collect
- GPS coordinates. When you tap "where am I", the device reads the position, converts it into country and city using maps bundled in the app, and discards the coordinate. It is never transmitted.
- Whether you use a VPN, your network type and your apps. On Android, the Connection widget asks the device whether any VPN is active, whether the network is Wi-Fi or mobile data, and whether the NordVPN app is installed. The answers stay on the device: they are neither sent nor stored. We do not read your Wi-Fi network name or the list of your apps.
- No analytics, ads, device identifiers, crash reports, contacts, camera, microphone or browsing history. There is no third-party SDK in the app.
- ePassport is not intended for people under 18 and does not knowingly collect children's data. If we learn of a minor's account, we delete it.
4. Who we share with
We do not sell data and do not share it for advertising. We use processors (companies that handle data on our behalf, under contract) to make the app work:
| Processor | Purpose | Where | What it receives |
|---|---|---|---|
| Supabase | database, sign-in, photo storage and server functions | São Paulo, Brazil (AWS sa-east-1) | everything in the table above |
| Google (Sign in with Google) | sign in with your Google account, if you choose | USA and others | Google hands us your email and name; Google learns you signed in to ePassport |
| Apple (Sign in with Apple), when available | sign in with your Apple account, if you choose | USA and others | email (may be Apple's relay address) and name |
| AeroDataBox | public flight data | European Union | only the flight number and date, sent by our server; nothing about you |
| OpenWeather | the weather for the cities shown in the app (the destination and the city where you are) | United Kingdom | only the city's coordinates, sent by our server; never your position |
| Frankfurter (European Central Bank rates) and ExchangeRate-API | exchange rates for the currency widget. Rates By Exchange Rate API | Frankfurter: not stated; ExchangeRate-API: South Africa | nothing about you: our server asks only for the day's rates of the currencies |
| Viator (a Tripadvisor company) | tours and attractions at the destination, with price, rating and photos, in the Attractions widget | USA | only the destination, language and currency, sent by our server; nothing about you. Photos come from Viator's servers, which therefore receive the IP address of whoever opens the widget. If you tap a tour, Viator's website opens with our partner code and receives what any website receives |
| NordVPN (api.nordvpn.com) | in the VPN widget of the installed app (not the web version), tell you whether your connection is protected by NordVPN | abroad | your device asks NordVPN directly, which receives the connection's IP address (like any website) and replies whether it belongs to one of its servers; nothing from your account goes with it, and we do not keep the answer |
| Google (Gemini API, free version) | read the photos of the stamp pages, only with your consent | USA and others | the photos you chose and our instruction, sent by our server; nothing from your account. In the free version, Google may keep and use the images to improve its products, with human review (Gemini API terms) |
| Cloudflare | deliver the web version of the app and, in the Connection widget, tell your device the country, city and carrier of the IP | global network | IP address and HTTP headers of the request, in their technical logs; we do not store what the widget looks up |
| Hostinger | this website and our email | European Union | the content of emails you send us |
| Brevo | send the password reset email | European Union | your email address and the message content |
Partner links. Some widgets recommend another company's service (currently: NordVPN and Viator). The button opens the partner's website and is labeled "partner link". If you purchase, ePassport may receive a commission, at no extra cost to you. The link carries a random code of ours, which is not your email or your name, so the partner knows the referral came from ePassport. What you give the partner (payment, email, account, health or travel details) is handled by them, under their own privacy policy, and never reaches us. The partner tells us about sales made through our link (the amount and the random click code), without saying who bought; we do not keep who clicked either. ePassport does not sell or broker partners' products (VPN, eSIM, insurance, lodging, tours): the partner sells and provides the service.
We may also disclose data when required by law, by order of a competent authority.
5. International transfers
Your data is stored in Brazil. Some processors (Google, Apple, Cloudflare, Brevo, AeroDataBox) handle part of it outside Brazil, and for people in the European Union the data leaves the EU for Brazil. These transfers rely on the processors' standard contractual clauses and compliance programs (LGPD art. 33; GDPR chapter V).
6. How long we keep it
- As long as your account exists.
- If you started using the app without creating an account (anonymous mode) and had no activity for 7 days, that data is deleted automatically.
- When you delete your account, everything is removed immediately in a single operation. Database backups expire within 7 days.
- Stamp-reading photos do not stay with us: they are read and discarded. Google, in the free version of Gemini, keeps them for its own period. Your consent is kept while the account exists, or until you withdraw it in settings; the count keeps only the number.
- The health card is kept until you delete it (one tap deletes everything, including the certificate photo) or delete your account. It never goes into anything public or into statistics.
- Processors' technical logs (access, errors) are kept by them for short periods and deleted automatically.
7. Your rights
At any time and free of charge you can:
- See and correct your data: everything is in the app and editable.
- Take everything with you (portability): in Profile, "Export data" produces a JSON file with all your data.
- Delete the account: in Profile, "Delete account", immediately. Or through the Delete account page, without opening the app.
- Withdraw consent: delete a stamp, remove the public @, remove the photo, disconnect social sign-in.
- Know who we share with: section 4.
- Withdraw consent for the health card: "Delete health card" in the card itself deletes everything right away. Withdraw consent to stamp reading: in settings.
- Object to a processing and complain to the authority: in Brazil, the ANPD (gov.br/anpd); in Portugal, the CNPD (cnpd.pt); in another EU country, the local authority.
Requests emailed to privacy@epassportapp.com are answered within 15 days.
8. Security
All communication uses HTTPS. Each person can only access their own rows in the database (row-level security rules). Passwords are stored as hashes (bcrypt). The database disk is encrypted at rest by the processor. On the device, the app keeps a cache of your data and the session, cleared when you sign out or delete the account. The passport number is stored as plain text in the database, protected by the access rules; we do not promise more than that.
9. Cookies and the web version
The web version uses only the browser's local storage to keep the session and the cache. We use no tracking or advertising cookies. The network delivering the site may set a technical anti-abuse cookie.
10. Changes
When this policy changes in a relevant way, we notify you inside the app and update the date at the top. Previous versions are available on request.
11. Contact
privacy@epassportapp.com for privacy; contact@epassportapp.com for everything else.