Privacy

Last updated 6 August 2026.

The short version

We hold your email address, whatever you chose to put on your page, and a record of who you follow and what you said you want. We count how many times a page was opened each day and nothing else about the person who opened it. There is no advertising, no third-party analytics, and no tracking across other sites.

What we hold

• Your email address, because it is how you sign in and how we reach you. It is never shown to another user.
• What you put on your page — name, description, category, links, offers and prices, and any picture you upload. All of it is public by design: it is your page.
• What you follow and what you marked as wanted, with the optional message you attached. A creator sees the name you chose — or “a supporter” if you left it empty — and the message. They never see your address.
• If you joined the queue on the landing page: the address you typed, anything else you filled in, and where the visit came from (referrer and campaign parameters, when present).
• If you signed up to a creator's list, the address you typed — and this is the one thing here that is not ours. It is given to that creator: they can see it, write to you, and export it. The form says so above the field, before you type. We do not use it for anything else, and we do not add you to any list of our own.
• A daily view count per page. One number per page per day. There is no field in it for an address, a device, a session or a person, so there is nothing in it that could later be joined back to you.

What we do not do

• No advertising, and no data sold or shared for it.
• No third-party analytics and no tracking pixels.
• No profile of you built from your behaviour across the web.
• No address handed to a creator except the one you typed into their own signup form, which said so at the time.
• No payment details of any kind — none are collected anywhere in this product, because nothing can be bought yet.
• No cookies beyond the ones that keep you signed in and remember where you were headed while a sign-in link was in flight.

Who can see what

The rules are enforced by the database, not only by the screens. A creator can read the rows belonging to their own page, the names of the people who reached them, and the addresses of anybody who signed up to their list on purpose. A supporter can read their own. Our own staff can read what is needed to keep pages honest — every published page, its links, the queue from the landing page, and the counts above — because a page carrying arbitrary links on our own domain has to be checked by somebody.

Who processes it for us

• Supabase — database, sign-in and file storage, hosted in the EU (Ireland).
• Vercel — runs the application itself.
• Resend — delivers our mail.
• Cloudflare — DNS for this domain.

Each of them handles this data on our instructions and for no purpose of their own.

How long

For as long as you have an account. Deleting your account removes your page, your uploads, your follows and your marks immediately and completely — it is one action in Account settings and we keep no copy. The daily view counters belong to the page and go with it. Waitlist entries are kept until we have written the one message they were given for, or until you ask us to remove yours.

Your rights

You can see everything we hold about you on your own screens, change it there, and delete all of it yourself. If you would rather have a copy sent, or want something corrected we do not offer a button for, write to hey@mitpass.app and we will do it by hand. If you are in the EU or the UK you also have the right to complain to your local data protection authority.

Children

Pass is not for people under 16. If we find an account belonging to someone younger we delete it.

Changes

The product is being built and this page will change with it. Anything that affects data we already hold is announced by mail before it applies. The Terms cover the rest.