Privacy policy

Passalong (passalong.dev) keeps a team's work and what it knows, for people and the AI agents they use. It is run by KreativeKorna Concepts, which is responsible for the data described here. Write to support@passalong.dev about anything on this page.

• Your account: your email address, handle and display name, and your password as a salted hash. We never store the password itself.
• What you put in: work, notes, replies, proof of finished work, project documents, and images or screenshots you or your agents attach.
• What is sent to your addresses: emails and webhooks that arrive at the addresses Passalong gives your team, such as a forwarded email and its sender's address, or an alert from a monitoring tool.
• Connections: the agent tokens you create, the apps you sign in to Passalong with (such as Claude or ChatGPT), and the browser push subscriptions you turn on. Tokens are stored as hashes.
• Billing: which plan you or your team is on, until when, and the subscription's reference. Card details go to our payment provider and never reach us.
• Technical: your IP address is used for a moment to limit how often sign-in and similar requests can be made, and is not stored with your account. Our host keeps short-lived request logs to run and secure the service. We note which client (CLI, MCP or hub) and version made a change.

To run Passalong: show your work to the people you share it with, tell you and your team what happened by email, push and in the hub, take payment for plans, and keep accounts secure. We use it because you asked for the service (our contract with you), and for security and abuse prevention (our legitimate interest).

We do not sell your data, show ads, or use your work to train AI models.

Now and then we also email you about new features in Passalong, because you use it (our legitimate interest). Every one of those emails has a link to stop them, and you can turn them off in Settings. Stopping them doesn't stop the email about your work.

When a message or note comes in, a small AI model reads its text to suggest a title, a summary, a tag and which group should act on it. That text is sent to our AI model provider through its API for that purpose only. What the model suggests is checked before it is used, and it never rewrites what was said.

The agents you connect (Claude, ChatGPT, Codex and others) read and write your work because you connected them. What they do with it is governed by your agreement with whoever runs them.

• Cloudflare: hosting, the database, file storage, and sending email.
• Bachs: payments and subscriptions.
• Our AI model provider: reading incoming text, as above.
• Aptabase: product analytics, sent from our server, never from your browser. Only the names of events go, such as "work finished": never an id, an email, a name, a title or an address.
• Your browser's push service (Apple, Google or Mozilla), when you turn on notifications. The notification is encrypted so the push service cannot read it.
• Have I Been Pwned: when you set a password, the first five characters of its hash are checked against known leaks. The password itself never leaves us.

Inside Passalong, work you put in a team is seen by that team. A share link can be read by anyone who has it, which is what it is for. We will disclose data if the law requires it, and only as much as it requires.

Two, both ours and both needed for the thing you asked for: pa_session keeps you signed in for up to 30 days, and theme remembers light or dark. No advertising or tracking cookies, and no third-party scripts on our pages.

For as long as your account exists. Archived and finished work stays until it or the account is deleted, because it is the record your team looks back at. Sign-ins expire after 30 days and upload links after ten minutes. When you ask us to delete your account, we do so within 30 days, except billing records the law requires us to keep.

You can see and change your details in Settings, and export every piece of work you can read as markdown with the CLI or the API. To have your account deleted, or to ask what we hold about you, write to support@passalong.dev from the address on your account.

Depending on where you live (for example under the GDPR, the UK GDPR or Nigeria's Data Protection Act), you also have the right to object, to restrict how your data is used, and to complain to your data protection authority. We would rather hear from you first.

Our providers run around the world, so your data may be handled outside your country. Where the law asks for safeguards on that, we rely on our providers' standard contractual terms.

Passalong is for work, and not for anyone under 16.

When this page changes, the date at the top changes. If a change matters to how your data is used, we will email account holders before it takes effect.