Privacy Policy
Philately Passport · last updated September 2026
The short version: your passport stays on your device. There are no accounts, we operate no server, and we never receive your collection. The only third party the app talks to is Google AdMob, for ads.
What we store on your device
Your collector profile, passport progress, stamp and cancellation collection, wishlist, and any photos or notes you add. This data is encrypted at rest on your device (AES-256-GCM) using a key held in the platform keychain/keystore. There are no accounts and no sign-in: your passport belongs to this installation of the app, and nothing is uploaded to us.
Camera
Used only when you choose to photograph a cancellation record. Photos are stored inside the app on this device and stay there unless you explicitly export or share them.
Location
Read only when you tap "Add my location" on a cancellation record, or when you open Explore to sort catalogued post offices by distance. It is never collected in the background or continuously.
Backup and export
This version keeps your passport on your device only — there is no cloud sync, so losing the device means losing the collection. Settings → Export My Passport writes everything to a file you can save wherever you choose. That file is readable rather than encrypted, so that it can still be restored on a new device; keep it somewhere you trust.
Advertising
This app shows ads from Google AdMob to keep the core experience free. On iOS we ask your permission through App Tracking Transparency before any advertising identifier is read — decline and every feature still works, you just see less relevant ads. Where consent rules apply (the EEA, the UK and some US states) we show a consent form on first launch, and you can change that choice any time from Settings → Ad Privacy Settings. No ad is requested until you have answered. Ads never appear inside your Passport or Collection screens.
Google's handling of ad data is covered by Google's own policy.
Deleting your data
Settings → Delete Account removes everything this app holds on the device — profile, collection, cancellation records and photographs. Because nothing is uploaded, that is a complete deletion; there is no server copy for us to remove. Deleting the app also removes its data.
Third parties
We do not sell your personal data. This app includes no analytics or tracking SDK of any kind — Google AdMob, described above, is the only third-party service it talks to.
Children
The app is not directed at children under 13 and we do not knowingly collect data from them. Because we collect no personal data at all, there is nothing for us to hold.