Privacy Policy

1.1 Who is responsible

Quokka For Good LLC runs HeyPass. For your HeyPass account, billing and our website, we decide how your data is used. In privacy law, that makes us the "controller".

For the mail your organization forwards to HeyPass, your organization decides what to forward and who can see it. Your organization is the controller, and we process that data on its behalf as a "processor". Part 4 of this policy, the Data Processing Agreement, sets out the terms for that work.

1.2 What we collect

Account details. Your verified email, optional display name, security factors and sign-in settings.

Workspace details. Workspace name, members, connected accounts, access grants, mailbox and format configuration, and consent records.

Forwarded messages. The emails and headers your selective forwarding rules send to HeyPass. Messages are processed by machine to check eligibility and find the login credential. Full message bodies and login credentials are not intentionally persisted in HeyPass application databases.

Request records. Requester, account, timestamps and recorded outcomes. A delivery or acknowledgement is not proof of vendor sign-in.

Billing details. Opaque customer, subscription, checkout and transaction references, plan, status and confirmed paid period. Dodo Payments handles payment details on its hosted checkout; HeyPass does not store card details.

Operational and support data. Content-free diagnostics, security and audit metadata, reports you submit, and optional product-news preferences. Do not put secrets in support messages. With your optional consent, we use PostHog for usage analytics. It receives an anonymous browser identifier and fixed event labels and bounded measurements such as signup, setup progress, sample and model-analysis results, sign-in request outcomes, billing actions and observed subscription status, feature use, page engagement, device-size category, role, and performance or error categories. Error messages, model prompts and model responses are not collected. Structural diagnostics can describe whether an email contains code or link markers, a six-digit code marker, the model’s purpose category, and the prompt version; they do not include original text or credential values. These consented browser observations are incomplete and are not our financial or security records. We do not send account or workspace identifiers, email addresses, codes, message contents, form text or secret-bearing URLs to PostHog. Referral attribution is a separate optional choice. If you allow it when arriving through a partner link, our server records the referral with Affonso. The most recent eligible referral within 30 days can be attached to a new verified signup. We send a random referral user identifier rather than your signup name or email. For attributed purchases, the referral identifier is included in Dodo Payments checkout metadata. Dodo Payments sends its subscribed payment, subscription, refund and dispute events to Affonso, including events without a referral. The earlier Creem integration may continue to send its subscribed checkout, subscription and refund events. These provider payloads can include billing customer information. Affonso uses eligible events to attribute referral results. Refusing attribution does not affect signup, pricing or access.

Optional Google Tag Manager. A separate choice allows the Google Tag Manager container to load on public marketing pages. This installation blocks Google Analytics and other executable tracking tags, including advertising, conversion-linker, custom tags and additional recording services. Loading the container sends Google technical connection data, such as the network IP address. All Google storage consent remains denied. We do not send page measurements, profile information, form values, mailbox contents, codes or secret-bearing URLs through its data layer. It does not run inside the HeyPass account application or support chat document. Existing PostHog consent does not enable Google Tag Manager. Enabling any measurement service later requires a separate implementation and privacy review.

Optional partner dashboard. When you choose to apply or open your partner dashboard, Affonso receives your verified HeyPass email and profile name to identify or create your partner account. The dashboard is isolated from the authenticated app, uses a short-lived session, and cannot read HeyPass mailbox contents or login credentials. Affonso processes your chosen partner details and technical connection data under its service terms.

Optional support chat. If you choose Open support chat, Crisp processes the messages you send and technical connection data, such as your IP address and browser information. We use a random support token to keep the conversation separate from other signed-in sessions and workspaces. We do not automatically share your account email, workspace name, login credentials, forwarded mail, diagnostic reports or model prompts with Crisp. Do not paste those into chat. Support conversations follow Crisp’s service retention and our support handling; they are not covered by the 24-hour email-diagnostics retention. Closing chat stops the connection but does not delete messages already sent. Contact hello@heypass.io to request help or deletion of a support conversation.

1.3 How we handle forwarded mail

Members receive only the eligible verification for their authorized request, not mailbox access. HeyPass checks the receiving destination, verified source and sender authentication, approved login purpose and format, and active request.

Received mail bodies and credentials are processed transiently. Email codes may be delivered to the workspace's chosen destination; supported sign-in links are claimed in the requesting browser. In-app links and forwarding-confirmation values expire in memory within five minutes and are cleared on use where applicable. HeyPass cannot recall already delivered or copied credentials.

Rejected-message metadata and deduplication records have a 24-hour maximum policy with maintenance margins. Authenticated format failures may produce a structural redacted preview retained for up to 24 hours. Original prose, addresses, codes, link tokens and attachments are omitted. Request and security history has a 30-day policy.

Password-reset, account-recovery and prohibited-purpose messages are ineligible. Unsupported or ambiguous messages are rejected. Mail providers' queues, inboxes and records follow their own retention rules.

1.4 Why we use your data

• To run HeyPass and deliver each verification to the right person. Legal basis: to perform our contract with you.
• To keep HeyPass secure and stop fraud, abuse and multiple free accounts. Legal basis: our legitimate interest in a safe service.
• To take payments and keep tax records. Legal basis: our contract with you and our legal duties.
• To answer your support messages. Legal basis: our contract with you.
• To send product news and offers. Legal basis: your consent. You can unsubscribe at any time.

We do not sell your personal data. We do not use your forwarded mail for advertising, and we do not use it to train AI models.

1.5 Who we share data with

We share data only with the service providers that help us run HeyPass. Part 3 of this policy names them. We also share data if the law requires it, for example a valid court order. When the law allows, we will tell you first.

Inside your workspace, the owner can see request records and access grants. Members see their own requests and granted applications, not other members' verifications.

1.6 How long we keep data

1.7 International transfers

Quokka For Good LLC is based in the United States. Providers may process data in Switzerland, the European Union, the United States and, for DeepSeek, China. HeyPass does not promise EU-only inference or zero provider retention. When we transfer personal data out of the EU, UK or Switzerland, the safeguards in the Data Processing Agreement apply.

1.8 Your rights

Depending on where you live, you can ask us to show you the data we hold about you, correct it, delete it, limit how we use it, or send it to you in a portable file. You can also object to some uses and withdraw consent at any time.

To use any of these rights, email hello@heypass.io. We reply within 30 days. If your data is part of a workspace your organization controls, we may pass your request to the workspace owner.

If you are in the EU or UK, you can also complain to your local data protection authority.

1.9 Age

HeyPass is not for anyone under 18. We do not knowingly collect data from children. If you think a child has given us data, tell us and we will delete it.

1.10 Changes to this notice

If we change this notice in a way that matters, we will email account owners and update the date at the top of this page.

2.1 What we use

HeyPass uses essential authentication cookies to maintain a session. If you choose Remember this device on a personal device, a remembered credential can last up to 48 hours. Credentials are hashed and rotate when a session is restored. You can revoke remembered browsers in Account security; signing out forgets the current browser.

Non-secret setup drafts can be retained in the browser for the current task. Credentials and OTPs must not be stored in these drafts. Optional analytics uses a first-party event sender to PostHog in the United States. Our PostHog integration does not use autocapture or advertising tracking. Separately consented public-website tags are described below. You can separately opt in to masked session recordings on the website and app. We serve a pinned PostHog recorder from our own domain. Recordings show page layout, clicks, scrolling and interactions; all text and input values are hidden before transmission. A second structural filter removes private attributes, secret-bearing URLs, comments, embedded content and media. We do not record audio, video, console logs, network requests or response bodies. Recordings are limited to 20 minutes and 10 MB per page visit; they may end earlier if a limit or technical restriction is reached. Our current PostHog project retains recordings for 30 days. When you allow analytics, hpa_id stores a random browser identifier for up to 180 days. It is shared between the public website and app to understand the signup and setup journey. Signing out clears that identifier. The hpa_consent preference cookie lasts up to 180 days and can also remember your refusal; refusing analytics does not create an analytics identifier. The separate hpa_replay cookie remembers your recording preference for up to 180 days; recording is off until you select Include masked session recordings. A random recording session ID is held in tab memory and is not an account identifier. These cookies are separate from sign-in cookies.

The hpa_gtm cookie remembers your separate public-website analytics and marketing choice for up to 180 days. With that consent, Google Tag Manager runs published tags, currently Google Analytics, Microsoft Clarity, Affonso and a conversion linker. These services can measure page visits, navigation, interactions and referral or campaign activity, receive technical browser and connection information including IP address, and use their own identifiers or cookies. Clarity records masked page interactions; all page text and inputs are masked. These tags are absent from signed-in app pages and the isolated support chat. The earlier container-only choice does not authorize tracking: a new choice is required. Withdrawal stops future loading, clears known first-party tracking cookies and refreshes the page to unload executed tags; it cannot delete data already received by those services. The hpa_referral_consent cookie remembers referral attribution consent for 30 days across the website and app. With consent, an HttpOnly heypass_referral cookie holds an opaque visit token for up to 30 days; referral IDs remain on our server. Withdrawing referral consent stops unsent signup attribution and future checkout attribution, but does not erase transactions already processed or change an already-created checkout. Declining analytics does not by itself enable or disable this separate referral choice. Support chat is separate from analytics. Crisp loads only after you choose Open support chat and may use cookies or browser storage to operate that conversation. Declining chat leaves guided help, in-app reports and email support available. Chat is isolated from the authenticated app page; it cannot read the app’s codes, email contents or form fields. It does not automatically send support messages. A new HeyPass sign-in or workspace uses a different random support token. Browser privacy settings may prevent the chat from connecting.

2.2 Your choices

You can block or delete cookies through your browser settings. Blocking essential session cookies prevents sign-in. Optional analytics is off until you choose Allow analytics. Existing analytics consent does not enable session recording. Recording requires its separate checkbox. Deselect it and save your preference to stop recording, or choose Essential only to stop analytics, recordings, Google Tag Manager and referral attribution. Withdrawal discards unsent recording data; other open tabs check the shared preference every second. Signing out also stops recording and clears its opt-in. Choose Essential only to decline, or use Analytics preferences in the footer to change your choice. Declining does not restrict HeyPass features. We respect Global Privacy Control and Do Not Track by keeping optional analytics off. Withdrawal stops future analytics and clears the analytics identifier; it does not remove events already processed. PostHog necessarily receives the network IP during transmission, but its project settings discard client IP data, and our events disable GeoIP enrichment. No analytics person profile is created.

2.3 What we do not do

We do not use advertising cookies, and we do not sell data to advertising networks.

4.1 What we process

The personal data is the data in the messages you forward, plus names, email addresses and request records of your workspace users. The people concerned are your staff, contractors and other workspace users, and anyone named in a forwarded message. We process this data only to run HeyPass for you, for as long as you use HeyPass.

4.2 Your instructions

We process the data only on your documented instructions. Your use of the HeyPass settings, together with these Terms, counts as your instructions. If we think an instruction breaks the law, we will tell you.

4.3 Confidentiality

Only staff who need access to run or support HeyPass can access the data. Each of them has a duty of confidentiality.

4.4 Security

We use the measures in the Security and Data Retention Notice part of our Security and Data Policy to protect the data. We review them and update them over time.

4.5 Subprocessors

You allow us to use the subprocessors in the Subprocessor List part of our Privacy Policy. We have a written contract with each one that gives the data the same level of protection. We will email you at least 30 days before we add or replace a subprocessor. If you have a reasonable objection, tell us. If we cannot solve it, you may end your plan and get a refund for the unused paid time.

4.6 Transfers

When we transfer data out of the EU, UK or Switzerland, we use Standard Contractual Clauses or another lawful safeguard.

4.7 Helping you

We will help you answer requests from people who use their data rights. We will also help with impact assessments and with questions from regulators, where this relates to HeyPass.

4.8 Data breaches

If we find a breach that affects your data, we will tell you without undue delay, and within 72 hours at the latest. We will tell you what happened, what data is involved, and what we are doing about it.

4.9 Deletion

When you delete your workspace, we delete live workspace data after the seven-day undo window as the Data Deletion and Offboarding policy describes. Cancelling a paid subscription alone does not delete the workspace. Older backups and provider copies require separate coordination. You can request an export before deletion.

4.10 Audits

We will give you the information you need to show that we follow this agreement. If that is not enough, you may audit us once a year, at your own cost, with 30 days' notice, during business hours.

4.11 Liability

The limits on liability in our Terms of Service apply to this agreement, unless the law does not allow it.

What HeyPass stores

We store your verified email, optional display name, workspace membership, application configuration, permissions, encrypted connection credentials when used, security-factor records and request/audit metadata. Dodo Payments handles paid subscriptions as merchant of record. Payment details are entered on Dodo Payments’s hosted checkout. HeyPass stores opaque customer, checkout, subscription and transaction-event references, billing status, plan, dates and confirmed paid-period information, not card details. Dodo Payments separately retains receipts and financial records under its own terms and legal obligations. Authentication challenges are hashed. Received application mail bodies and login artifacts are not intentionally persisted in HeyPass application databases. A confirmed login format stores the application sender, redacted subject and login context, code shape or direct-link origin/path/query pattern, and revision as workspace configuration—not the full email, recipient or live URL token. These saved formats remain private to the workspace. HeyPass does not use them to train a model. They remain until replaced, removed or the application is archived. Change audits contain account/revision metadata, not the saved text. Database backups may contain older configuration until separately expired. Keep real secrets out of feedback.

Forwarded samples during setup

An owner can open a ten-minute learning window for a paused application after verifying its original inbox. The owner manually forwards one original login email from that inbox to the application's receiving address. HeyPass verifies the forwarding mailbox's signature and processes the sample in memory; quoted application headers are untrusted hints, not proof of application identity. The full sample and its code or tokenized link are not saved. A reduced redacted draft is held in memory until confirmation, cancellation, restart or expiry of that window. After authenticated format failures during forwarded-sample learning, connection tests or delivery, HeyPass may keep a structural preview for up to 24 hours: instruction categories, code lengths, link structure and formatting markers. Original prose, email addresses, codes, link tokens and attachments are omitted. Up to five previews per app account and 100 per workspace are retained. Owners can inspect, copy or delete these previews; they are excluded from member activity and monitoring exports. Content-free learning and receipt diagnostics follow the 24-hour retention policy. The owner reviews the detected fields before saving the format. Learning does not deliver the sample or enable access: a fresh original, authenticated forwarding test and explicit enablement are still required. The sender's mailbox and upstream mail providers may retain their own copies.

Retention in the application

Rejected-message metadata and deduplication records have a 24-hour maximum policy with maintenance margins. Request and security history has a 30-day policy. In-app links and forwarding-confirmation values expire in memory within five minutes and are cleared on use where applicable. Link claims are restricted to the requesting HeyPass session. This does not establish vendor-side browser binding or invalidate a link already revealed; the vendor controls its own token and session expiry. Open feedback, support cases and access requests remain until resolved; resolved cases are retained for 30 days after resolution. Optional diagnostic summaries expire after seven days; queue tickets after fifteen minutes, with closed queue metadata retained for up to 24 hours. Billing webhook event identifiers are retained for 30 days. Active identity, configuration, ownership attestations and security-factor records remain while needed for the account; they are not covered by the message-history timer.

Assisted format learning

When enabled for a workspace, unfamiliar setup samples can be analyzed by DeepSeek after local sanitization. Only restricted instruction wording, credential shapes and link structure are sent; arbitrary words, personal details, addresses, codes and URL token values are removed. If sanitization cannot be completed, no request is made. DeepSeek receives no tools or authority to deliver credentials. Its own terms govern processing and retention, including processing in China; HeyPass does not promise zero provider retention or EU-only inference. Validated inactive proposals and content-free analysis records remain in HeyPass for up to seven days. For accounts not using adaptive login, the owner reviews a proposal, then a fresh authenticated application test and explicit enablement are still required, and everyday sign-ins do not invoke the model. Only configuration and controlled results are stored, not provider prompts or responses. Older backups can retain previous records.

Adaptive login

When adaptive login is enabled for a workspace, HeyPass learns each application's login email automatically. If a login email that arrives for an open request is not yet recognised, its wording is sent to DeepSeek, including at sign-in time. Before sending, HeyPass replaces codes, link tokens, email addresses, the account holder's name, IP addresses and other long numbers with placeholders. DeepSeek only identifies which placeholder is the login credential; HeyPass reads the value from the original, sender-verified email and checks it appears there verbatim. Password-reset, account-recovery and account-change emails are never delivered, whatever the model returns. HeyPass saves the learned format (wording anchors and credential shape), not the email. A format that works identically for two or more workspaces with different owners may be shared with other workspaces that use the same application. DeepSeek's own terms govern processing and retention, including processing in China.

Providers and inbox copies

The hosted setup uses Infomaniak for the application and Mailgun's EU region to receive forwarded login messages. Resend handles outgoing transactional delivery. Cloudflare can continue to provide DNS. HeyPass processes received message bodies in memory; this does not describe copies held in Mailgun's delivery queues, operational records or other providers' mailboxes. Provider retention is subject to their configuration and terms. Permanent receiving-address reservations retain the address and an opaque workspace identifier so an address is never assigned to another organization. Your source/destination email provider also handles messages. Historical Cloudflare email activity may contain sender, recipient and subject metadata; a subject itself may contain a code. Resend may retain sent-message content. Provider copies, recipient inboxes, backups and operating-system snapshots are outside HeyPass's in-memory deletion promise. We do not promise automatic deletion from someone else's inbox or exclusively Swiss processing.

Remembered sign-in

If you choose Remember this device on a personal device, an essential authentication cookie can keep that browser signed in for up to 48 hours. We store hashed credentials, a browser label and creation, use and expiry timestamps; not a browsing history or a device fingerprint. Credentials rotate when restoring a session. A completed security-factor check can remain valid within that trusted session. Restoring a lost session requires the enrolled security factor again. Remembering does not count as fresh email or security-factor verification for sensitive changes. You can revoke remembered browsers in Account security. Signing out forgets the current browser; expired device records and token history are removed by scheduled maintenance. Backups are subject to the separate backup policy.

What an owner can see

Owners see their workspace's members, access grants, application/source setup, request outcomes, security evidence and feedback submitted to the workspace. Members see only their own requests and granted applications. HeyPass's activity interface does not include email subjects, message bodies or code values. Support reports contain the text you choose to submit and a screen/account reference, not automatically captured mailbox content or browsing history. A member can optionally select a HAR file in the browser: only an allowlisted summary of HTTP methods, status numbers, durations and sizes is uploaded. Original URLs, headers, cookies, bodies and filenames are excluded. Summaries are encrypted in the workspace database and visible only to their submitter and the owner. Images and PDFs are not accepted.

Google API data and Limited Use

For separately authorised Google API connections, use and transfer of Google API data must follow the Google API Services User Data Policy, including its Limited Use requirements. Mail data is used for the disclosed access-delivery feature, not advertising, resale, credit scoring or model training.

Optional application authenticators

Where enabled by the operator and workspace owner, an authorised owner can enroll an application's TOTP setup key separately from email forwarding. This long-lived key is encrypted in HeyPass storage and decrypted for code generation. It is not covered by the email in-memory retention promise. Pending enrollment expires after ten minutes; enrolled keys remain until removed or the workspace is deleted. Request/session metadata is retained for up to 24 hours with maintenance margins; security audit metadata follows the 30-day policy. Generated codes are returned only in the requesting browser, not sent by email or intentionally saved in the database or logs. Owners and requesters need recent personal MFA. Removing access stops future reveals, but cannot recall a copied code, invalidate a leaked key or terminate vendor sessions; rotate compromised keys at the vendor. Removing a key deletes active records, not older encrypted backups or snapshots, which require operator coordination. Owner confirmation records an attestation of a successful vendor test, not independently verified account ownership.