Privacy policy

Last updated 2026-10-02

Noptcha, LLC ("we") operates Passin.io and a number of software products of its own. This policy explains what Passin stores. Products we operate describe the data they handle in their own policies.

Platform services (API customers)

If you use our Authentication or Payments API:

• Your account: email, API keys (hashed), usage logs, invoices.
• Waitlist: the email address and the service you asked about; delete it any time by emailing us.
• End-user data in Authentication API: email addresses, password hashes, display names, avatars, OAuth provider IDs (Google sub, GitHub user ID), sign-in sessions (IP, user-agent, timestamp), and an audit log. This data belongs to you; we store it on your behalf and erase it when you delete a user via API or they delete their own account.
• Payment transactions: order amount, currency, status, customer reference you provide. Card details are handled by the payment provider (Stripe, etc.) and never reach us.

Products we operate

If you signed up on one of our own products, we store your account data (email, password hash, profile) and your usage of that product. Specifics are in that product's privacy policy.

What we use it for

To provide the services, keep accounts secure, send necessary emails (sign-in codes, receipts, security notices, service updates), process payments and refunds, enforce acceptable use, and meet legal obligations. We do not sell your data or use it for advertising.

Who processes it for us

Cloudflare (hosting and email routing), Resend (transactional email delivery), Stripe and other payment providers (payments), Google and GitHub (only if you or your users choose them for sign-in), and our own bot-protection service on sign-in pages.

Cookies

Only first-party cookies needed for sign-in and to complete in-progress authentication flows. No advertising or cross-site tracking.

How long we keep it

Platform customer data stays while your account is active. End-user data in the Authentication API stays until you delete it via API or the user deletes their account, then it is erased within 30 days (expired sessions and audit logs). Payment records are kept as long as tax law requires. Product account data stays while that account exists; see that product's policy.

Your rights

Platform customers: email contact@passin.io to export your data, change your email, or close your account. End-users of the Authentication API: your rights are provided by the product you signed up on (account pages, data export, account deletion). For products we operate, account management is at passin.io/account.