Privacy policy

Your notebook

Titles, accounts, passwords, notes and folders are encrypted on your device using AES-256-GCM before they are synced to your private iCloud database. PassBy has no developer-operated password server, advertising or analytics SDK.

Tenon Account

Tenon manages sign-in methods, verification and account settings. PassBy receives your verified Tenon identifier, display name and platform role. Web and updated iPhone account sessions last up to 30 days after verification. Older iPhone versions must be updated and signed in again to use the current account service. Web sessions do not renew silently. The iPhone renews its session using a rotating credential kept in the device-only Keychain, never synced to iCloud. Each sign-in and renewal verifies your current central identity, role and verified email. The credential expires after 30 days without renewal; signing out removes it from this iPhone and requests central revocation. Closing the app does not sign you out. Offline, the remembered account profile does not grant renewed account privileges; your existing notebook still opens with Face ID. The authentication service stores only product session token hashes, verified identity details, fixed expiry and optional refresh credential hashes in private SQLite. Normal restarts preserve the original deadline; expired or signed-out sessions are removed. Central tokens, native refresh credential plaintext and one-use login tickets are processed transiently without logging or persisting them to disk. It never receives notebook passwords or recovery keys. Platform roles do not grant access to notebook contents. Routine security and request metadata may be retained by the hosting and central account services. Manage your central account at Tenon Account.

Account information

Tenon processes your email, display name, account identifier and login security records for authentication and account management. PassBy receives verified identity details to establish its product session. These details are linked to your account and are not used for advertising or tracking. Notebook contents and recovery keys are never sent to Tenon. See the Tenon Account privacy notice for central account retention and your rights.

Apple storage and Face ID

Your system iCloud account identifies the notebook. PassBy does not receive your Apple password or facial data. Apple may share identity information with Tenon when you choose Apple as a central sign-in method; this is separate from notebook storage authorization. Face ID is handled by iOS; PassBy receives authentication results, never your facial data.

Keys and recovery

The local encryption key is protected by the device Keychain and current Face ID or Touch ID enrollment. Your recovery key is never uploaded. Save it outside PassBy. Without a working device key or your recovery key, your notebook cannot be decrypted by the developer.

Clipboard and drafts

In the iPhone app, copied values stay on this device and expire after 60 seconds. The app you paste into can read them. Unfinished entries are saved as encrypted local drafts and are not synced to iCloud.

Web access

The web app connects directly to Apple CloudKit for your private notebook. Your recovery key is used by WebCrypto in the browser and is not sent to our hosting server or Apple. Notebook data is decrypted in page memory; the recovery phrase, notebook contents and unfinished edits are not saved to browser storage. Authorizing a browser saves a non-exportable decryption key locally, scoped to your Tenon identity and Apple storage account. Remove it with “Forget this browser” in Settings. This browser storage is not protected by iPhone Face ID. The browser stores only your optional “keep Apple signed in” preference. If you enable it on a trusted computer, Apple’s SDK also persists an authentication token; signing out through “Change Apple Account” clears that token. An authorized browser can open the notebook during a valid Tenon session; a new browser still needs initial authorization with the recovery key. Switching tabs, leaving the window or 5 minutes of inactivity locks the notebook and removes its contents from the interface. Browsers cannot provide the iPhone app’s Face ID or clipboard expiry. Use a trusted computer. Our web host receives routine page requests and service metadata such as IP addresses; it does not receive notebook contents or recovery keys.

Retention and deletion

Choose Delete account in Settings, or open account deletion. Tenon verifies your identity, then you choose the scope. Deleting only PassBy removes your PassBy sessions and its link to your Tenon identity, and keeps your Tenon Account for other products. Deleting your Tenon Account removes central account information and revokes available Apple sign-in tokens, which affects all Tenon products. Neither deletes your Apple-stored notebook or recovery key, which are managed separately. PassBy keeps a record that the deletion happened, holding only a hashed account identifier, so a repeated request cannot delete an account you create later.

Delete entries and folders inside PassBy and allow iCloud sync to finish to apply those deletions to your notebook. Each iPhone keeps deleted passwords encrypted in Recently Deleted for 30 days without syncing them; you can delete them sooner there. Removing the app deletes its local files, but does not delete the iCloud notebook. Apple manages iCloud storage and service metadata under its own privacy policy.

PassBy sign-in sessions last up to 30 days. Signed-out and rotated sign-in credentials are remembered only as hashes for 30 days, so they cannot be reused. To keep our network secure, our servers record access and security logs: the time, IP address and page requested, without URL parameters. These logs are deleted automatically after 6 months.

Service providers and location

PassBy shares data only with the services it needs: Tenon Account for sign-in, operated by the same publisher; Apple for iCloud storage under your Apple Account and, if you choose it, Sign in with Apple; and our hosting provider. The PassBy server is in mainland China, and PassBy does not send your personal information outside mainland China. Apple stores your notebook according to your Apple Account region, and the Tenon Account privacy notice covers Apple sign-in.

Support and your choices

View and change your notebook in the app, and your account details in Tenon Account. Delete your account as described above. You can contact support@tenonai.cn for technical or privacy questions, or to ask what we hold about you. Any details you voluntarily send are used to answer your request. Never send passwords, recovery keys, Apple verification codes or device passcodes.