This website
www.passmith.com has no forms and no accounts. You can read every page without giving us anything.
Requests to this website and to the Passmith app pass through Cloudflare, which delivers the pages and protects them against attacks. To do that, Cloudflare processes technical data such as your IP address and browser type. We do not use that data to identify you.
Cookies and tracking
This website sets no cookies, loads no analytics, and runs no advertising or tracking scripts. The only thing it keeps in your browser is two session-storage entries — pm_offer_ms (how long the site has been visible in this tab) and pm_offer_done (that our sign-up offer has already been shown) — so the offer appears once and not again. They contain no identifier, are never sent to us or anyone else, and are erased when you close the tab.
The Passmith app at app.passmith.com sets two cookies it needs to work: passmith-session, which keeps you signed in, and XSRF-TOKEN, which protects its forms against cross-site request forgery. Both expire two hours after your last request and are not used for tracking.
The Passmith app
When you create an account, we store your name, your company name, your workspace address, your work email address and your password. When you use the app, we store what you put into it: products, documents, images, branding and the passports you create.
Passports you publish are public by design: anyone who scans the code on a product can read them. Everything else stays inside your workspace and is not published.
Why we use it
To provide the service you signed up for — your account, your workspace and your passports. The legal basis is our contract with you (Article 6(1)(b) GDPR). We also use account data to keep the service secure, which is our legitimate interest (Article 6(1)(f) GDPR). We do not sell your data and do not build advertising profiles.
Where it is stored and who else sees it
App data — your account and everything in your workspace — is stored on servers in Frankfurt, Germany, inside the European Union. This website is served from a server in Amsterdam, the Netherlands, hosted by DigitalOcean.
Apart from that hosting and Cloudflare, nobody else receives your data. We use no third-party payment, email-delivery, analytics or advertising service. If that changes, this page changes first.
How long we keep it
Account and workspace data is kept for as long as your account exists. If you ask us to delete your account, we delete its data within 30 days.
Until 5 October 2026 this website had a waitlist form. It has been removed, and no email addresses are collected on this website any more.
Your rights
Under the GDPR you can ask us at any time to tell you what we hold about you, correct it, delete it, send you a copy in a portable format, or object to how we use it.
Write to [email protected] and we will act within 30 days. You can also complain to the data protection authority in your country.
Who is responsible
Passmith, reachable at [email protected]. Passmith is not yet incorporated; the operating company's registration details will be published here and in the imprint as soon as that is complete.
Changes to this page
If anything here changes, we update this page and the date below it. We will not start collecting more than is listed above without saying so here first.