Privacy

Last updated 10 September 2026. MePass is operated by ToadLeap, Inc., San Francisco, California, United States. If you have a question about your data, email support@mepass.bio.

Your public page is public. Anything you put on it — your name, your links, your photo — is visible to anyone with the address. That is what it is for. This notice covers everything else: what we hold, why, who it reaches, and how to get it back or gone.

The short version

• We keep what we need to run your page and sign you in — nothing for advertising.
• We do not sell personal information or share it for advertising, and we run no ads. Service providers process the data needed to operate MePass, as described below.
• Our view and click counts hold no IP address, cookie, or fingerprint.
• The people you save live only on your phone, encrypted; we cannot read them.
• You can download everything we hold and delete your account at any time.

What we collect, and why

• Your email — to sign you in (there is no password) and to reach you about your account. Basis: performing our contract with you.
• What you put on your page — name, headline, bio, pronouns, company, job title, location, photo, links, and your handle. We build and show your page from it. Publishing it, and how findable it is, is your choice. Basis: our contract with you, and your consent to publish.
• Sign in with Google, GitHub, LinkedIn, or Apple (optional) — we receive an identifier and the email at that provider. We never store your social passwords or tokens, with one exception: an Apple token kept solely so that deleting your MePass account can revoke Apple's grant. Basis: our contract.
• An age band (for example 16–17 or 18+) — to apply age rules. We store a band, never a birth date. Platform age signals, where a device provides them, take precedence. Basis: our legitimate interest in meeting our responsibilities around children's data and platform age rules, and legal compliance.
• Page-view and link-open counts — so you can see how your page does. We store no IP address, no cookie, no device fingerprint, no location, and no referrer. Whether two visits came from one person is estimated with a keyed hash that changes every day, so nobody reading the stored data can link a visitor across days or work out who they were; the underlying events are kept 30 days, and only aggregate counts remain after that. Basis: our legitimate interest in showing you your own stats, designed to hold no personal data.
• Sign-in sessions and security logs — a device label and last-active time for each session (so you can sign out a device), and error logs with personal fields stripped out. Basis: our legitimate interest in security.
• Account identifiers — your account ID, handle and optional sign-in-provider identifier connect your profile and settings to your account. Basis: performing our contract with you.
• Notifications (optional) — when you enable alerts we register a push token, a randomly generated installation ID and your device platform, linked to your account. Expo and Apple or Google deliver these alerts. You can turn alerts off in device settings; signing out unregisters this device. Basis: providing the notification feature you request.

Where it comes from, and what is required. We collect this directly from you (what you enter and publish); from the sign-in provider you choose when you use Sign in with Google, GitHub, LinkedIn, or Apple (an identifier and the email at that provider); and automatically from your own use of the service (the aggregate counts and session records above). An email address is required to create and keep an account — it is how we sign you in, so without one you cannot use MePass. Everything you add to your page is optional.

Details other people send you — and details you send

If a visitor uses the "share your details back" form on your page, we pass their name and contact details to you and keep a copy for you for 18 months, then delete it. You can turn this off, block a sender, and remove any entry.

If you send your details to someone else's page, you are sharing them with that person, who then keeps their own copy and decides what to do with it — we cannot reach into their phone or their tools. For our part, at the moment you send them we show you a link to view or remove the copy we hold, and we delete it automatically after 18 months.

Contacts you save

People you save from a scan or a card stay only on your device, encrypted, with a key that never leaves your phone. We do not upload them, and a backup restored on a new phone cannot read them. We never see them.

Cookies and tracking

Your public page makes no third-party requests and sets no cookies as you browse it. The one exception is strictly necessary: if you fill in “share your details back” and the send fails, we put what you typed in a short-lived cookie (10 minutes, this page only) purely so the form can be handed back to you filled in rather than blank. It is cleared the moment it has been used. The signed-in dashboard uses a single strictly-necessary session cookie so you stay logged in. There are no advertising or cross-site tracking cookies, and no app tracking or advertising identifier.

Security

All traffic between your device and MePass is encrypted in transit (HTTPS/TLS). Your profile photo is re-encoded to strip camera metadata such as location before it is stored, error logs have personal fields removed, and the internet-facing part of our system cannot read the tables that hold personal data.

Automated decisions

We do not carry out automated decision-making or profiling that produces legal or similarly significant effects about you. Age rules are applied automatically from your age band and any platform age signal; if you think an outcome is wrong, contact us and a person will look at it.

Who we share data with

We do not sell personal information or share it for cross-context behavioural advertising, we run no ads, and we are not a data broker. We use a small set of service providers (processors) to run the service, each given only the minimum and bound by a written contract that requires it to protect your data to at least the standard set out in this notice and to use it only for the purpose we specify. We disclose personal information to no other third parties.

• Cloudflare — hosting/CDN for public pages and storage of your photo (stripped of camera metadata before it is stored).
• Resend — sending sign-in codes to your email.
• Apple, Google — sign-in, wallet passes, and push notifications you turn on.
• Expo — delivering app updates and routing optional push notifications using the device's push token.
• Google ML Kit — business-card text recognition runs on your device; card images and recognized contacts are not uploaded by MePass. The SDK may send usage and technical diagnostics to Google.
• Sentry, PagerDuty — error monitoring and on-call alerts; personal fields are removed before anything is sent.

Cloudflare, Resend, Sentry, and PagerDuty process data in the United States and other countries. For those transfers out of the EEA or the UK we rely on the European Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum (and, where a provider is certified, the EU-US / UK-US Data Privacy Framework). To request a copy of the safeguards for any transfer, email support@mepass.bio. A current list of providers is at app.mepass.bio/legal/subprocessors.

How long we keep it

• Your account and page: until you delete them.
• Your profile photo: until you replace or remove it, or delete your account.
• Leads sent to you: 18 months, then deleted.
• Raw view/click events: 30 days; only aggregate counts are kept after that.
• Sign-in sessions and security logs: while a session is active and for up to 90 days after.
• Error-monitoring logs (Sentry): up to 90 days.
• An Apple sign-in token, if you use Sign in with Apple: kept until you delete your account, then used once to revoke Apple's grant and erased.
• A one-way hash of a deleted account's email: 12 months, to prevent abuse — then gone.

Deleting your account

You can delete your account any time from Settings, in the app or at app.mepass.bio/delete-account. Your page stops resolving immediately, and every other device is signed out. Deletion then finalises after a 7-day grace period, during which you can cancel it; after that, your profile, handle, links, email, sessions, stats, and the contact details other people sent you are permanently erased, and we produce a signed erasure receipt confirming it is done. Your handle is retired, never reissued — a printed QR code must not one day resolve to a stranger. People who saved your details keep their own copy on their device.

Your rights

Wherever you live, you can:

• Know and get a copy of what we hold, and take it elsewhere (data portability) — Settings → Export my data gives a full JSON download.
• Delete your account, as above.
• Correct anything — edit your page, or change your sign-in email in Settings.
• Object to or restrict some uses, and withdraw consent you gave — for example, turn search-engine indexing of your page back off at any time.
• Opt out of "sale" or "sharing" — there is a Global Privacy Control toggle in Settings, honoured everywhere. We do not sell or share your data in any case, so this changes nothing in practice, but the choice is recorded and respected.
• Not be treated differently for using any of these rights — we will not deny you the service, change your price, or lower your quality of service.

We do not collect sensitive personal information as California defines it, and we do not use your information to infer characteristics about you, so the right to limit sensitive information does not apply — if that ever changes, we will offer it.

Use the in-app controls, or email support@mepass.bio. You may use an authorised agent to make a request for you; we will ask for your written permission and may still verify your identity directly. If we refuse a request we will tell you why, and you can appeal by replying to that decision or emailing us with "appeal" in the subject — we respond within 45 days (60 for Colorado residents).

If you have a complaint, contact us first at support@mepass.bio — we will acknowledge within 30 days and respond without undue delay. You can also complain to your data protection authority at any time: in the UK the Information Commissioner's Office (ico.org.uk), or in the EEA your local authority.

California and other US states

In California's terms, the information above falls into these statutory categories: identifiers (your email, handle, and sign-in identifiers); professional or employment information (company and job title, if you add them); internet or network activity (aggregate page-view and link-open counts, and session records); and other content you choose to put on your page. We collect it for the business purposes described here, disclose it only to the service providers listed above (each acting under a contract that bars using it for their own purposes), and do not sell or share it. Residents of California, Virginia, Colorado, Connecticut, Texas, and states with similar laws have the rights set out above, including the right to appeal a refusal.

Children

MePass is not for children under 13; if we learn an account belongs to someone under 13 we remove it. People aged 13–15 may use the app to save contacts, but a public page can only be published from age 16.

Changes

If we change this notice we will update the date above, and for anything significant we will tell you in the app or by email before it takes effect.

Contact

Email support@mepass.bio for anything in this notice. We are not required to appoint a Data Protection Officer; your data-protection questions go to the same address.