Human Pass lets websites and apps ("sites") know that each of their accounts belongs to a different real person, without them learning who that person is. This policy explains what we collect to do that, what we keep, who sees what, and your choices. It's written to be read; if anything is unclear, ask us at [PRIVACY EMAIL].
Who we are. Human Pass is run by [COMPANY], [ADDRESS] ("Human Pass", "we", "us"). We are the controller of the personal data described here. [EU REPRESENTATIVE, if required].
The short version
- To create a Human Pass you verify a government ID once. An identity-verification provider checks it, with a short selfie video to make sure the ID is yours.
- We don't keep your ID, its number, your photo, your selfie, your name or your date of birth. We keep one-way fingerprints of them, so the same ID can't be used to make a second Human Pass, and a few facts derived from them (the document type and expiry month, the country and state that issued it, whether you're 18 or over and 21 or over).
- Sites don't learn who you are. A site gets confirmation that you're a verified, unique person and an ID that is the same every time you sign in to it and different on every other site. Some sites can ask for more (whether you're 21 or over, or your ID's country and state), only if you agree, separately for each site.
- We keep no list of the sites you use.
- Your email address is kept encrypted, for signing in and for security notices.
- You can delete your Human Pass from your account at any time.
What we collect, and why
When you verify your ID
| What | How we use it | Kept |
|---|---|---|
| The details on your ID (document type and number, issuing country and state, expiry date, name, date of birth) | Read by our provider and passed to us once. We turn them into one-way fingerprints (keyed, slow hashes that can't be turned back into the details), check you're 18 or over, check the document hasn't expired, and note whether you're 21 or over. | The details themselves: never stored; they exist only in our server's memory for the moment it takes. The fingerprints and derived facts: see "How long we keep it". |
| Images of your ID, and a short selfie video | Taken and checked by our identity-verification provider (Didit), to confirm the ID is genuine and yours, and that you're a real person present at the time. This is biometric data: see our biometric data policy. | We never receive them. We ask the provider to delete them as soon as the check finishes (and, as a backstop, the provider deletes them within 30 days). |
| A digital licence from your phone's wallet (where offered) | Your wallet shares your licence number, issuing state and country, name, date of birth and expiry date directly with us, signed by the issuing state. No selfie. | Turned into the same fingerprints; the details are never stored. |
| The result of the check, and which provider did it | To decide whether to create or recognise a Human Pass, and for support and disputes. | While you have a Human Pass. |
Why: to make sure each person has one Human Pass, so sites can trust "one person, one account", and to protect against stolen and fake IDs. Legal basis (where GDPR applies): performing our contract with you, and for the face check, your explicit consent (GDPR Article 9(2)(a)), which we ask for on a separate screen before each check.
Your account
| What | How we use it | Kept |
|---|---|---|
| Email address | Signing in, confirming it's you, security notices (for example a new sign-in method added), account recovery, and replies from support. | Encrypted, until you delete your Human Pass. |
| Password (if you choose one) | Signing in. Stored only as a slow one-way hash. | Until you change it or delete your Human Pass. |
| Passkeys, authenticator app, recovery codes | Signing in and recovery. We keep a passkey's public key (never your fingerprint or face, which stay on your device); an authenticator app's secret, encrypted; recovery codes only as hashes. | Until you remove them or delete your Human Pass. |
| Preferred language | The language of our pages and emails. | While you have a Human Pass. |
| Your agreement to these terms and to each face check | Proof of what you agreed to and when (the notice's version, the provider, the time; never any face data). | See "How long we keep it". |
| Payments (only if you buy an extra verification) | Processed by Stripe; we never see your card details. We keep that a purchase was made, when, and its amount. | Until it's used, or you delete your Human Pass. |
When you sign in to a site
- The site sends you to us; you sign in; we send the site an ID for you that's specific to that site, and confirmation that you're a verified, unique person (plus anything else you agreed to share with that site).
- We record that you agreed to share with that site as a pair (the site, your ID for that site), not as a link between you and the site. Your list of sites on your account page is worked out when you look at it.
- Sign-in sessions that do refer to you and the site expire within 12 hours and are deleted.
- We count sign-ins and new users per site and per day, as totals only, to run the service and bill sites. We record the latest month in which each site-specific ID signed in, to count monthly active people for some sites' billing; no history.
Security and abuse prevention
- Bot check: before an ID check we use Cloudflare Turnstile, which looks at signals from your browser and device to tell people from bots. Cloudflare processes your IP address for this.
- Limits: to stop abuse we count attempts per email address, per network (IP address) and per email domain, stored only as keyed one-way hashes, and deleted after 2 days.
- Audit records of security-relevant events (for example a sign-in method added, a recovery, a support action), using a keyed reference to your Human Pass, never together with which site you used.
- Operational logs of our servers, which never contain document details, are kept for [LOG RETENTION, e.g. 30 days].
Legal basis (GDPR): our legitimate interest in keeping the service and its users safe, and preventing fraud.
Support
If you contact support, we keep your message and the address to reply to (encrypted). Our support staff can see limited information about a Human Pass to help you (for example its status, how it was verified, recent security events), never your ID details, which we don't have, and never a list of the sites you use. Each time staff look, it's recorded.
Who we share it with
Sites you choose to sign in to get, for each sign-in: your ID for that site, that you're a verified unique person, and, only if you agree on that site's consent screen, whether you're 21 or over, the country that issued your ID, and its state. Each site handles what it gets under its own privacy policy.
Our service providers, who process data on our behalf, under contract:
| Provider | What for | Where |
|---|---|---|
| Didit | Identity verification (ID check and face check) | [DIDIT LOCATION, e.g. European Union] |
| Stripe | Payments for extra verifications, and billing sites | United States / Ireland |
| Amazon Web Services | Hosting, database and encryption keys | [HOSTING REGION] |
| [EMAIL PROVIDER] | Sending email | [LOCATION] |
| Cloudflare | Bot checks, and visit counts on our website (below) | Global |
The provider never learns which site you came from.
Visit counts on our website. Our website (humanpass.co), developer docs, developer dashboard and demo sites use Cloudflare Web Analytics to count visits: which pages are viewed, the referring site, and the browser, device type and country. It uses no cookies and doesn't track you across sites or build a profile of you. It's never used on the pages where you sign in, verify your ID or manage your Human Pass.
Nobody else, except when the law requires it (for example a valid court order), and then only what's required. We tell you about such a request unless the law forbids it. We never sell or rent your personal data, or use it for advertising.
International transfers
We're based in the United States. If you're in the European Economic Area, the UK or Switzerland, your data is transferred to the US and to our providers' locations above, using the European Commission's Standard Contractual Clauses [or the EU-US Data Privacy Framework] and the safeguards described in this policy.
How long we keep it
| What | How long |
|---|---|
| ID images and selfie video (at our provider) | Deleted at our request as soon as the check is done; at most 30 days |
| Your ID's details (number, name, date of birth) | Never stored |
| Document and person fingerprints, document type and expiry month, issuing country and state | While you have a Human Pass. After you delete it: [24 months], so the same ID can't be used to escape a ban by deleting and starting again. During that time, verifying the same ID again restores the same Human Pass. Then deleted. |
| Whether you're 21 or over; for adults under 21, the last day of the month you turn 21 | While you have a Human Pass; the date is deleted on that day |
| Email, passwords, passkeys, authenticator app and recovery codes | Until you delete your Human Pass (then immediately), or remove them |
| An email address replaced during a recovery | 90 days (so the change can be undone), or until you delete your Human Pass |
| Unfinished sign-ups (no ID verified) | 7 days |
| Records of your consent to face checks and terms | [PERIOD SET WITH COUNSEL], as proof |
| Limit counters | 2 days |
| Support messages | Kept for support history; no longer linked to you after you delete your Human Pass |
Your rights and choices
- See and correct your information on your account page, or ask us for a copy.
- Delete your Human Pass on your account page. Sites you used see that the ID they had is deleted. We keep only what's described under "How long we keep it".
- Stop sharing with a site from your account page.
- Withdraw consent to a face check at any time before it's done (go back on the consent screen). The check can't be undone after it's finished, but the images are deleted.
- Object, restrict, or ask for portability where the law gives you that right, by emailing [PRIVACY EMAIL].
- Complain to your data-protection authority (in the EU, the one where you live).
- Washington residents: see also our consumer health data privacy policy. California and other US state residents have similar rights to know, correct and delete; we don't sell or share personal data for advertising.
We answer requests within a month (or sooner where the law requires), and may need to confirm it's you first, usually by asking you to sign in.
Decisions made automatically
Whether a document can create a Human Pass, and whether it matches an existing one, is decided automatically from the fingerprints and the provider's result. If you think a decision is wrong (for example a check refused, or "you already have a Human Pass"), contact support: a person reviews it, and disputes about who an ID belongs to are always decided by a senior staff member.
Age
Human Pass is for people 18 or over. Every verification checks the date of birth; we can't create a Human Pass for anyone younger.
Security
Fingerprints are made with keys held in a hardware-backed key service; emails are encrypted; access by staff is limited and recorded. More in our security and privacy overview. Report a security problem to [SECURITY EMAIL].
Changes
If we change this policy in a way that matters, we'll tell you by email or when you next sign in, before the change applies.
Contact
[COMPANY], [ADDRESS] · [PRIVACY EMAIL]