Legal
Privacy Policy
Passport Days works out how many days you have left in the countries you travel to. To do that it needs to know where you have been. This page says exactly what happens to that information, in the same words the app itself uses.
On this page17 sections
Your location is not sent to third parties; it is synced only between your own devices in your own iCloud account, and you can turn syncing off in Settings.
That sentence is not marketing copy. It is the same sentence shown in the iOS permission prompt before you grant location access. If one of the two changes, both change together. This is deliberate: a privacy policy that says something the app does not do is worse than no policy at all.
- Country crossings. When your device notices you have moved a significant distance, the app checks which country you are in and records the crossing, along with the coordinate it used to work that out.
- US state days. While your device is in the United States, the app can also work out and record which state you were in, once per local calendar day — a state code such as
US-NYand a day, nothing more. There is no coordinate and no time of day in this record, and it is written every day location tracking is on, the same as the country crossings above, whether or not that state is one you are watching for a tax threshold. - Visit monitoring for watched US states. While you are watching at least one US state's tax threshold and the US states module is visible in Counters, the app also asks the operating system to tell it when you arrive at or leave a place. This is used only to help work out which state you were in on a given day; the location it briefly sees for that purpose is not stored. Short visits may be missed, and it stops the moment you are watching no US states or you hide the module — the day-by-day state recording above keeps running either way.
- Stays. The crossings are turned into stays — a country, an entry day, an exit day.
- What you type. Passports you add, stays you correct by hand, notes you attach, rules you enter yourself.
- Travel permissions. For supported destinations such as the UK, the app records the passport or document you selected, permission or status, entry route, evidence type, any validity date you enter from your document, linked stay, and policy version. These are your answers; the app does not verify your immigration status.
- Residence and permit periods. The country, status or permit kind, start/end days, passport reference, spouse-of-citizen answer and related start day where relevant, notes, policy version and record creation/update times you save. Citizenship and residence counters use these records with your travel history. They follow the same private iCloud sync setting; they are not sent to analytics.
- Tax watches. The countries and US states you choose to watch for tax days, the tax-year start you pick where a country's tax year is not the calendar year, the version of the tax data in use when you set the watch up, and how far from a threshold you want to be reminded.
- Counters you watch. The day counters you add to Today — which counter or country, the passport it counts for, and the safety margin you choose (0 to 3 days).
- Your setup answers. What you answer in the first-run setup — what you want to track, your passport, your home country, the places you visit, a US state or UK settlement route if you give one, and trips you type in — is kept on this device so the Today screen can build your setup from it. The passports, trips, watched counters and tax watches the setup creates are stored like the records above; the answers themselves are not sent to iCloud.
- Your settings. Which passport is your default, whether tracking is on, whether syncing is on, which reminders are on.
Reminders are local notifications: the app schedules them on your device and iOS shows them there. Nothing is sent to a server to deliver them.
There is no continuous GPS. The app asks the operating system to tell it when your location changes significantly, which is a low-power service, and does nothing in between. Visit monitoring is the one addition to that, and it runs only while at least one US state is being watched — even then, a short visit may be missed.
Your completed travel records are stored on your device and, if you leave syncing on, in your own iCloud account — Apple's private database, the same place your other apps' iCloud data lives. It is not a server this app's developer runs, and the developer cannot read it.
There is no account to create. No password, no sign-up screen, and no email address is needed to use the app. The one optional exception is the reply address on a counter request or a support message, described under Requests and support messages below. Otherwise the app never asks you who you are, because it never needs to know.
You can turn syncing off in Settings. The change takes effect the next time the app opens; from then on, new changes stay on this device. Turning sync off does not remove data already stored in iCloud or on another device.
Completed travel-permission records follow the same sync setting. An unfinished setup is kept as a device-local draft on this device so the app can resume at the same question. It is not sent to iCloud or CloudKit. Completing or cancelling the flow clears the draft; "Delete everything on this device" clears it too.
US state days are stored the same way as everything above: on your device and, if you leave syncing on, in your own iCloud private database. They are included in your data export alongside your stays, and Settings › Delete all my data › Delete everything on this device removes them too. One limit is worth knowing: if you also use an older, 1.0 build of Passport Days on another device signed into the same iCloud account, that build's delete tool was written before this record type existed and cannot remove it — delete from a device running this version instead, or the older device's copies keep resyncing back.
The app sends anonymous usage events (product interactions) to TelemetryDeck (Germany) to understand which features are used — for example, which onboarding step was shown, whether the plans screen opened, or whether a purchase finished. They never include your countries, travel dates, day counts, location or stays. No name, email address or advertising identifier is sent. Events also include the time of the event, app, OS and SDK versions, build flags, device model and display information, language, appearance and accessibility preferences, and session/retention data. Time zone, region, locale and calendar fields are replaced with a placeholder; the first session date is kept to measure install retention. The first Photos restore summary can also send a broad found-trip count (none, 1–9, 10–49 or 50+) and whether it started during setup. No individual trip is sent.
Purchase events record the selected plan, a purchase starting, and its result: completion (with trial/no-trial classification), cancellation, failure or pending approval. They do not include payment details, receipts, transaction identifiers or your Apple ID.
A random install ID made on this iPhone groups events from one install; it is sent only as a salted hash, not linked to your identity, and is not used for tracking across apps or websites. In data-protection terms these events are pseudonymous rather than strictly anonymous: they carry that hashed install ID, but nothing that tells us who you are. Sharing is on by default. Settings › Your data › Share anonymous usage data turns it off. Turning it off stops sending, clears queued events and resets the install ID; turning it back on creates a new one. The core app works with sharing off. DEBUG, simulator and TestFlight/sandbox builds use test mode, separately from App Store usage.
TelemetryDeck processes these events in the EU and does not store your IP address. See TelemetryDeck's privacy policy. Turning sharing off stops future collection; it does not remove events already sent. We keep these events only as long as we need them to understand how the app is used; TelemetryDeck's privacy FAQ explains how deletion works on its side.
- No cross-app or website tracking. The app uses no IDFA and does not ask for App Tracking Transparency permission. TelemetryDeck measures use of this app, not activity in other apps or websites. Apple’s first-open attribution service is described below.
- No crash-reporting SDK. The app contains no diagnostics SDK of its own and does not measure the proportion of users without crashes. If you have turned on Share With App Developers in iOS (Settings › Privacy & Security › Analytics & Improvements), Apple — not this app — shares crash reports and usage diagnostics with the developer, without information that identifies you. You can turn that off in the same place.
The core travel ledger works offline. If you enable iCloud sync, Apple transfers your data between your devices. StoreKit can contact Apple to show or verify purchases, and opening a source or support link contacts that site. Additional network paths are described here. The History map loads map imagery from Apple Maps for the area on screen. No travel records are sent. Apple Maps receives the map area you view. Without a connection, the app shows its offline map. The optional cloud AI request requires your explicit permission on its own screen. A counter request or a support message is sent only when you write one and tap Send. Anonymous usage events are sent when sharing is on and a connection is available; offline they wait on the device (at most 500) and nothing else changes.
On the first launch, Passport Days asks Apple’s AdAttributionKit to report conversion value 0 (opened), once. Apple handles any resulting ad-attribution postback. The app supplies no travel data, purchase value or advertising identifier through this path. It does not track you across apps or websites.
Passport Days can use on-device Apple Intelligence to understand sentences like "I was in Lisbon from the 3rd to the 11th". That runs on your phone and nothing leaves it.
Where the device cannot do it, the app can — only if you turn it on — send the sentence you typed to a third-party AI provider through a relay. This is a separate decision with its own permission screen, it is off until you say otherwise, and refusing it costs you nothing: every core function of the app works without it.
When you allow a cloud AI request:
- The sentence you typed is sent as request content to Groq through our Cloudflare relay. Your saved travel history, raw coordinates and passports are not sent with that request.
- Your connection's IP address reaches the relay as part of the network request. The relay uses it to create a secret-salted daily quota key; only that key and a call count are kept in Cloudflare KV for up to 48 hours, then expire. The raw IP address and quota key are not forwarded to Groq. People sharing one public IP address may share a quota.
- The relay does not log or store your request sentence or Groq's answer. Groq processes the sentence to return an answer and may retain service usage metadata under its data policy. Depending on the account's data controls, Groq may temporarily retain request text for service reliability or abuse review for up to 30 days; zero data retention disables that customer-text storage.
- You can withdraw cloud AI permission in Settings; this stops future cloud AI requests. It does not erase a quota key already created, which expires within 48 hours. You can ask us questions through the support page. With cloud AI off, the core ledger still works offline; iCloud and Apple purchase services remain separate choices.
Settings › About has two optional forms. "Request a counter" is for telling us about a counter or country the app does not have yet, and "Support" is for asking us a question or reporting a problem. Nothing is sent until you tap Send.
If you send a counter request from the app, the text you type, the app version, iOS version and language are sent through our relay and emailed to us. If you send a support message, the topic you pick, the subject and message you type, the app version, iOS version and language are sent the same way, through the same relay, and emailed to us. If you add your email address to either, it is included so we can reply. We use it only to answer that request or message, and we delete the message on request. The email field is optional and the app does not store the address. Neither one includes your location, stays or passports, neither is sent to the AI provider, and neither is used for analytics or tracking.
Your connection's IP address reaches the relay as part of the network request. The relay uses it only to limit requests to three per day for each of the two forms: it keeps a secret-salted SHA-256 digest of the address and a count for 2 days, then they expire. The relay does not log the request, and the raw IP address is not kept. People sharing one public IP address may share that limit. To have a message deleted, ask through the support page.
Who handles it: the relay runs on Cloudflare Workers (Cloudflare, Inc.), the same relay the optional AI layer uses, and Cloudflare Email Routing delivers the message to our support mailbox, which is hosted by Microsoft (Outlook.com). We keep these emails only as long as we need them to answer and follow up, and delete them within 12 months, or sooner if you ask.
Passport Days has no server of its own that stores your travel data. A few companies handle data for the app, each only to provide its part of the service described on this page. Some of them process data outside your country, including in the United States:
- Apple — iCloud (CloudKit) sync of your records if you leave syncing on, App Store purchases (StoreKit), Apple Maps (map imagery) and ad attribution (AdAttributionKit). Apple Privacy Policy
- Cloudflare — the relay for the optional cloud AI layer and the two in-app forms, the routing of email sent to our support address, and the hosting of this website. Cloudflare Privacy Policy
- Microsoft — hosts our support mailbox (Outlook.com). Microsoft Privacy Statement
- TelemetryDeck (Germany) — anonymous usage events, processed in the EU; your IP address is not stored. TelemetryDeck Privacy Policy
- Groq (United States) — processes the sentence you typed, only when you allow a cloud AI request. Groq Privacy Policy
Where the GDPR or UK GDPR applies, transfers outside the EU/UK rely on the safeguards these companies offer for such transfers, such as an adequacy decision (including the EU–US Data Privacy Framework where the company takes part in it) or the European Commission's standard contractual clauses. Each company's policy, linked above, describes the safeguards it uses.
You can import our CSV or JSON exports, a general CSV with countries and dates, or an on-device Google Timeline export. Passport Days processes the selected file on your device and does not upload it to a server. For Google Timeline, coordinates are used offline to identify countries; raw coordinates and route points are not saved. Google and general CSV imports keep only countries and dates from the file. Our own CSV can also keep notes, counted status and precision; passport references are matched to a passport record you choose in the app. Our JSON does not contain notes or passport labels and is not a full backup.
Imported stays are stored with your other travel records and can sync through your existing private iCloud database when you enable sync. The recent-import and undo record is local to this device and contains only batch identifiers, times, source kinds and stay identifiers. Undo keeps stays you edited after import. Delete all my data also clears this device's import record; the existing iCloud deletion limits described below still apply.
If you use Find trips in your photos, iOS asks you for access to your photo library. Passport Days uses photo dates and locations on your device to reconstruct country days. It also reads library metadata, such as photo identifiers, added dates, source/screenshot/burst information and location accuracy, to filter photos and resume a paused scan. No image is loaded, and the app makes no request to download an image from iCloud for this. The dates and locations are used offline to work out which country each photo was taken in. Your photos and their locations never leave this iPhone — they are not sent to us, to a server or to a third party.
The trips you choose to add become stays. They are stored with your other travel records and, if you leave syncing on, synced between your own devices through your iCloud private database. That is the only part that syncs: country days, never photos or photo locations. While a scan runs and afterwards, the app also keeps a small note on this iPhone only: how far the scan got, the "Check these" list, the trips you said were not yours, and a day-by-day list of countries (no coordinates and no times). It is not sent to iCloud, it is excluded from device backups, and Delete all my data removes it. The recent-import and undo record works as described under Importing files, and Undo keeps stays you edited.
Not every photo can be read, and not every trip can be found. Photos without a location, screenshots, shared photos and photos taken in flight are skipped, and the results screen says how many. A scan can miss a trip, and a trip it finds may need your correction. The scan runs only when you start it and only while Passport Days is open. If you give access to selected photos only, the scan looks at those photos and no others. You can change or remove photo access at any time in iOS Settings; the rest of the app works without it.
Premium unlocks counters, tracking and other paid features. Your travel history, manual entry and export remain available when a trial ends or a subscription lapses.
Settings › Delete all my data › Delete everything on this device removes this device's stored travel records and settings, including unfinished permission setup stored only here. If iCloud sync was active for this app session, the local deletion can be sent to your private iCloud database; CloudKit works asynchronously, so the app cannot confirm when the cloud or another device has removed its copy. If sync is off or iCloud is unavailable, the deletion is local only. Data previously synced to iCloud may remain and may return if you turn sync on again.
To remove a previously synced iCloud copy through the app, turn sync on, reopen the app while online, allow the records to appear, then delete this device's data again and verify the result on your other devices. You can also remove this app's data through your device's iCloud storage settings. If you need help or cannot access iCloud, contact us through the support page.
Depending on where you live — for example under the GDPR, the UK GDPR or California law — you have the right to access your personal data, to correct it, to have it deleted, to receive it in a portable format, to object to how it is used, and to withdraw a consent you gave. You can also complain to the data protection supervisory authority where you live.
- Most of your data never reaches us: it is on your device and in your own iCloud account, so you use these rights in the app. You see everything on screen, correct stays and entries by hand, take a copy from Settings › Export (also + › Export), where you can choose CSV, a PDF summary or JSON, and delete it with Settings › Delete all my data.
- For what does reach us — a counter request or a support message — write to [email protected] to ask for a copy, a correction or deletion.
- Usage events are tied only to a random install ID that we cannot connect to you, so we cannot find or hand over a particular person's events; turning sharing off resets that ID.
- You can withdraw permission for the cloud AI layer in Settings at any time. A form is only ever sent when you tap Send. Anonymous usage sharing can be turned off with its separate Settings switch, as described above.
We rely on your consent for the cloud AI layer and for the two forms. For anonymous usage events, the one-time Apple ad-attribution report and the relay's request limits, we rely on our legitimate interest in understanding how the app is used, seeing whether our App Store ads work and keeping the relay from being abused; you can object to usage events at any time with the Settings switch described above. Everything else is needed to provide the app you chose to use. We do not sell personal information and we do not share it for advertising.
passportdays.app sets no cookies and runs no analytics or tracking scripts. If you use the light/dark switch, your choice is saved in this browser only; nothing else is stored. The first screen shows an example that matches your device's time zone and language, read in your browser and never sent anywhere. The site is hosted on Cloudflare Pages, and Cloudflare processes visitors' IP addresses to deliver the pages and keep the site secure.
The free calculators at passportdays.app/tools run entirely in your browser: the dates you enter are never sent, stored or put in the page address. Your light/dark choice is the only thing saved.
Passport Days is not directed at children under 16 and does not knowingly collect anything from them. Apart from a counter request, a support message, an allowed cloud AI request and anonymous usage events described above, it collects nothing about anyone that does not stay in their own account.
If this policy changes, the date at the top changes with it. Substantive changes — anything that alters one of the claims above — arrive with an app update, not quietly.
Questions about this policy or about your data go directly to [email protected]. That address is read by the developer of Passport Days. More ways to reach us are on the support page.