On your iPhone
Locations, rooms, tasks, notes, photos, visits, drafts and your professional identity are saved in the local library. Passage does not use an account for these features, advertising, advertising tracking or a third-party analytics tool.
The camera is used at your request. The Photos picker gives access to images you choose. Passage creates smaller copies without retaining the source image’s metadata. The date shown corresponds to when the image was added to Passage.
PDFs and backups
You choose PDF recipients and backup locations. The PDF contains observations from the visit: review it before sharing. These copies then depend on the recipient or chosen service. Passage cannot recall them.
System backups depend on your iOS settings. The library does not automatically sync across your devices. Client access details have a separate encrypted export; keep its code in another safe place.
Invitation-based client links
No link service is connected by default. An invitation indicates the service to use. During activation or recovery, your access key is checked with that service. It then remains in this iPhone’s Keychain.
Explicit publication sends the location name, time slot and message you enter, along with the selected tasks, photos and points. Internal notes and reference photos are not sent. The service also receives the technical information needed for the connection, including the IP address.
Anyone holding the link can open it. You choose a duration of 1, 7 or 30 days and can disable access. Confirmed deactivation removes the content and photos from the active service; it does not delete copies already saved by recipients. Invitation information specifies hosting and the retention periods for that service’s logs and backups.
Passage pilot hosting
The invitation-based pilot uses Cloudflare Workers, D1 and R2 at passage-client-pilot.momoudghiri.workers.dev. The database and photo storage are configured with European Union jurisdiction. Cloudflare network processing may take place in other regions: this configuration does not mean that all processing stays within the European Union.
The database keeps a hash of the professional key, link identifiers and statuses, and published text. Selected photos are in private storage; they are delivered only after the link is checked. The IP address is used temporarily by a rate limiter to protect the service. Passage does not record request bodies, keys, photos or IP addresses in its own persistent logs. Cloudflare also processes technical data necessary for its infrastructure’s security and operation under its privacy policy.
Access expires on the chosen date. An automatic purge processes expired copies in batches every fifteen minutes; a delay or outage may postpone physical deletion without restoring access. A storage rule expires remaining photos after 31 days, subject to the provider’s processing delay. Technical states of disabled or expired links are retained to allow their management and prevent reactivation.
Automatic Cloudflare D1 database backups may retain earlier states for seven days on the plan used. Original photos remain in your iPhone library: the sharing service is not a backup of your work. Before any service restore, disabled access must remain blocked. To request deletion of invitation-based access and its data, contact support.
Retention and support
Archiving a location keeps its history. Deleting the app and its data removes its local library; exports, system backups and published links are separate. Disable your links and keep the backups you want before deleting the app. If you lose your iPhone, contact support about your invitation-based access.
Developer: Mehdi Oudghiri. For a question or request about your data, provide only the necessary information. Nothing is sent automatically.