Your privacy matters
Last updated: 5 November 2026. This policy explains what we collect, why, and the choices you have.
Introduction
Passflow (“we”, “us”, “our”) provides an open source authentication platform with passkeys, magic links and MFA, available as a hosted cloud service and as self-hosted software. This Privacy Policy describes how we handle personal information when you visit our website, use Passflow Cloud, or contact us.
1. Information we collect
We collect only what we need to provide and improve our services:
Account information — such as your name, email address and organisation when you sign up or contact us.
Authentication data — public keys for passkeys, hashed credentials and MFA settings processed on your behalf. We never store passkey private keys; they stay on your device.
Usage and device data — IP address, browser type, pages visited and timestamps, collected through server logs and analytics.
Communications — messages you send us through forms, email or support channels.
2. How we use your information
We use personal information to:
Provide, operate, secure and maintain Passflow and our website.
Authenticate users and prevent fraud, abuse and security incidents.
Respond to enquiries and provide customer support.
Understand how our website is used so we can improve it.
Send service-related notices. Marketing emails are only sent with your consent, and you can unsubscribe at any time.
3. Self-hosted deployments
When you self-host Passflow, your data stays on your infrastructure. We do not have access to user data, credentials or logs from self-hosted instances, and you are the controller responsible for that data.
4. Cookies and analytics
We use essential cookies to keep the website working and Google Analytics to understand aggregate traffic. Analytics data is used in summary form and is not used to identify you personally. You can block or delete cookies in your browser settings at any time.
5. How we share information
We do not sell your personal information. We share it only with trusted service providers that help us run our business (such as hosting, email and analytics providers) under appropriate confidentiality and data protection terms, or when required by law.
6. Data retention
We keep personal information only for as long as needed to provide our services, meet legal obligations and resolve disputes. When it is no longer needed, we delete or anonymise it.
7. Security
We protect data using industry-standard measures, including encryption in transit and at rest, access controls and regular security reviews. No method of transmission or storage is completely secure, but we work hard to protect your information.
8. Your rights
Depending on where you live — including under the GDPR, the Australian Privacy Act and the CCPA — you may have the right to:
Access the personal information we hold about you.
Correct inaccurate or incomplete information.
Request deletion of your information.
Object to or restrict certain processing, and withdraw consent.
Receive a copy of your data in a portable format.
Lodge a complaint with your local data protection authority.
9. International transfers
Your information may be processed in countries other than your own. Where this happens, we use appropriate safeguards, such as standard contractual clauses, to protect it.
10. Children’s privacy
Passflow is not directed at children under 16, and we do not knowingly collect their personal information. If you believe a child has provided us with data, please contact us and we will delete it.
11. Changes to this policy
We may update this policy from time to time. When we make significant changes, we will update the date at the top of this page and, where appropriate, notify you.
12. Contact us
If you have questions about this policy or want to exercise your rights, email us at i@madappgang.com.