Privacy Policy
Last updated July 2026
Overview
This Privacy Policy explains what information Passage collects when you use earnpassage.com, how we use it, and what choices you have.
Short version: we collect only what is needed to run the service, we do not sell your data, and your essays belong to you.
1. What We Collect
Account information
When you create an account, we collect:
- Your email address, required to send you sign-in links and service notifications.
- Your name, optional; provided only if you sign in with Google.
- Your Google profile photo, optional; received from Google if you use Google sign-in.
Essay content
When you submit an essay for evaluation, we collect:
- The essay text you paste in.
- Context inputs you provide: the essay prompt, target school, intended major, and any application context.
- The name you give each essay in your dashboard.
Evaluation results
We store the output of each evaluation: the AI reader responses, the synthesized feedback, and A/B comparison results (Pro plan). These are tied to your account.
Plan and purchase data
We record your current plan (Free, Per-essay, or Pro), when each grant was applied, and its source (Stripe payment or otherwise). We do not store your credit card number, expiry, or CVV. That data goes directly to Stripe and never touches our servers.
Session data
We maintain a server-side session after you sign in. Your session token is stored in a secure, HTTP-only cookie. Sessions expire when you sign out or after a period of inactivity.
Technical data
If our error-tracking system is active, it may capture stack traces and technical context (for example, which route failed, your browser type, and an anonymized IP address) when something goes wrong. This data is used only for debugging.
2. How We Use Your Data
| Data | Purpose |
|---|---|
| Email address | Sign-in links, account security, service updates |
| Essay text and context | Running the AI evaluation you requested |
| Evaluation results | Displaying feedback in your dashboard |
| Plan status | Enforcing access to paid features |
| Technical error data | Diagnosing bugs and improving reliability |
We do not use your essay text for AI model training, advertising, or any purpose other than providing the evaluation you requested.
3. Third-Party Services
We share data with the following third parties as part of providing the service:
Stripe (payment processing)
When you make a purchase, your payment information is collected and processed by Stripe, Inc. We receive only a confirmation of payment and your plan status. Stripe privacy policy: stripe.com/privacy.
Google (authentication)
If you choose "Sign in with Google," Google authenticates you and shares your name, email address, and profile photo with us. Governed by Google Privacy Policy: policies.google.com/privacy.
Resend (email delivery)
We use Resend to send sign-in magic links and transactional emails. Resend receives your email address for this purpose. Resend privacy policy: resend.com/legal/privacy-policy.
Anthropic (AI evaluation)
When you run an evaluation, your essay text and context inputs are transmitted to Anthropic via their API. Anthropic processes this data to generate the AI reader responses. Under Anthropic standard API terms, submitted content is not used to train their models. Anthropic privacy policy: anthropic.com/legal/privacy.
OpenRouter (AI routing, optional)
Depending on the evaluation configuration, your essay text may also be routed through OpenRouter, which can forward it to various AI model providers (including OpenAI, Google, and others). OpenRouter privacy policy: openrouter.ai/privacy.
Error tracking (self-hosted)
We use a self-hosted error tracking system running on our own infrastructure. Error data does not leave our systems and is not shared with third parties.
Analytics
Passage does not currently run any analytics or behavioral tracking. If we add analytics in the future, we will use a cookieless, no-PII provider and update this policy before enabling it.
4. Cookies
We use one session cookie to keep you signed in. It is:
- HTTP-only (not accessible to JavaScript)
- Secure (transmitted only over HTTPS)
- Session-scoped (expires when you sign out)
We do not use advertising cookies, cross-site tracking cookies, or third-party cookies.
5. Data Retention
We retain your data for as long as your account is active. When you delete your account, we delete:
- Your email address, name, and profile data.
- All essays and evaluation results associated with your account.
- Your session data.
Deletion happens within 30 days of your request, unless we are required by law to retain certain records longer.
We may retain anonymized, aggregated data (for example, summary statistics about service usage) that cannot be linked back to you.
6. Data Security
Your data is stored in a hosted PostgreSQL database protected by:
- Encrypted connections (TLS) between the application and the database.
- Row-level security policies that limit access to each user own data.
- No public or unauthenticated access to the database.
If we become aware of a security incident that affects your data, we will notify you by email promptly, as required by applicable law.
7. Your Privacy Rights
Access and portability. You can request a copy of the personal data we hold about you.
Correction. If your data is inaccurate, contact us and we will correct it.
Deletion. You can request deletion of your account and all associated data at any time by emailing us at [email protected].
California residents (CCPA). You have the right to know what personal information we collect, to request deletion, and to opt out of the "sale" of personal information. We do not sell personal information.
EEA/UK residents (GDPR). The legal basis for processing your data is:
- Contract performance: processing necessary to provide the service you signed up for (account data, essay content, evaluation results).
- Legitimate interests: technical error logging and security.
To exercise any of these rights, contact us at [email protected].
8. Children Privacy
Passage is not directed at children under 13. We do not knowingly collect personal information from anyone under 13. If we learn that a user is under 13, we will delete their account promptly.
If you believe a child under 13 has used Passage, please contact us at [email protected].
9. Changes to This Policy
We may update this Privacy Policy to reflect changes in our practices or applicable law. When we make material changes, we will email you and update the "Last updated" date at the top of this page. Continued use of the service after the effective date constitutes acceptance of the updated policy.
10. Contact Us
For privacy questions, access requests, or deletion requests:
Devfeed, LLC
12165 Meadows Ln, Alpharetta, GA 30005
Email: [email protected]