passubly
passubly Privacy Policy
Last updated: September 22, 2026
passubly (the "App") is a password and subscription management app designed on the principle that "your data stays only on your device." Unless you choose to enable sync, your registered data never leaves your device. Even when sync is enabled, your data is stored in encrypted form and the encryption key remains on your device.
1. Information We Collect
The App does not require an account, and the developer does not obtain or hold personal information such as your name or email address. However, for ad delivery (Google AdMob) and, if you consent, usage analytics (Firebase Analytics), the respective service providers process your IP address, device information, and an app-specific identifier (app instance ID) (see Sections 2 and 8). Passwords and subscription information you register are encrypted with AES-256 and stored on your device; they are never sent to the developer's server. There is no way for the developer or any third party to access or read this information. (If you enable sync, encrypted data is also stored in your own iCloud, but the encryption key exists only on your device, and neither Apple nor the developer can decrypt it.)
2. Communications
The App communicates with the Internet only in the following cases:
| Feature | Data sent | Data not sent |
|---|---|---|
| Password breach check (optional) | Only the first 5 characters of the password hash (Have I Been Pwned API) | Password itself, information identifying you |
| Exchange rate retrieval (subscription summary) | Only exchange rate request (once per day) | Any of your data |
| Website icon retrieval (on by default, can be turned off in settings) | Only an icon request to the host of a URL you registered (no third-party icon delivery service is used) | Passwords, usernames, the content of your registered data, information identifying you |
| Ad delivery (automatic) | Only ad request (Google AdMob, non-personalized) | Passwords, registered data, personal information of any kind |
| Purchase and restore with the App Store / Google Play | Information required to process a purchase or restore (handled by each store) | Passwords, the content of your registered data, personal information such as your name |
| iCloud sync (iOS only, Premium, optional; enabled only when activated) | Data encrypted with AES-256 (stored only in your iCloud) | Encryption keys, plaintext data (neither Apple nor the developer can decrypt) |
| Usage analytics (optional, enabled only when you consent) | Pseudonymized usage statistics such as screen views, whether a feature was used, and the approximate number of stored items (Firebase Analytics; the App assigns no identifier of its own, but Firebase automatically assigns an app-specific instance ID) | Registered passwords and other content, personal information |
Usage analytics is enabled only when you consent at first launch and can be disabled anytime from settings. All features are available even if you do not consent.
Even with no network connection (offline), all core features such as storing, viewing, and editing your items remain fully available.
About Website Icons
To make your list easier to scan, the App retrieves and displays each site's own icon (favicon) from the host of the URL you registered (on by default). You can turn this off at any time in settings, which also deletes the icons already cached. No third-party icon delivery service (Google, DuckDuckGo, etc.) is used. Requests go only to the host of the registered URL, and no cookies or credentials are sent. Retrieved icons are stored encrypted on your device and are not included in backups, sync, or CSV exports.
About Ads
The ads displayed in this App are non-personalized ads from Google AdMob. The ads are non-personalized, and we do not perform tracking using advertising identifiers (IDFA / AAID). AdMob may process IP addresses and device information for ad delivery and fraud prevention. For details, see:
About the consent form: In the European Economic Area (EEA), the United Kingdom, and Switzerland, a consent form provided by Google is shown inside the App. Because that form uses Google's standard wording, it refers to personalized advertising; however, the App never requests personalized ads regardless of your choice, and only non-personalized ads are served. If you do not consent, no ads are requested or displayed.
On iOS, ad performance measurement that does not identify individuals (SKAdNetwork) may take place as an OS-level mechanism. By Apple's design, this method does not identify individual users.
3. Purposes of Use
The App uses the information it collects or processes only for the following purposes:
- Providing features (password breach check, exchange rate retrieval, website icon display, purchase and restore, iCloud sync)
- Delivering ads
- Understanding usage in order to improve quality, only if you consent
- Responding to your inquiries
We do not use the information for any other purpose.
4. Children's Privacy
The App is not directed at any specific age group and does not knowingly collect personal information from children under 13.
5. Data Storage, Retention, and Deletion
- Registered data is stored in encrypted storage on your device (if you enable sync, it is also stored, in encrypted form, in your own iCloud)
- When you delete the App, data on your device is also deleted
- Deleted items are kept in Trash for 30 days and are then permanently deleted. You can also permanently delete them from Trash at any time
- Since the developer does not hold your data, no deletion procedure is needed from the developer
- Usage analytics data (only if you consent) is retained for up to 14 months and is then deleted automatically
- When you edit an item, the previous values are saved on your device as "change history", with no limit on the number of entries or on how long they are kept (this history is encrypted and is deleted together with the item)
- If you have enabled sync, a "deletion record" for a deleted item (which does not include the item's content) remains in the sync file for 90 days and is then erased automatically
- The camera (for scanning two-factor authentication QR codes), notifications (reminders about upcoming renewals), and autofill all operate entirely on your device and send nothing externally. Data used for autofill is encrypted with AES-256-GCM and stored in a shared area on your device, and the key is stored only in the device's Keychain / Keystore
6. Security Measures and Requests Regarding Your Data
Data you register is encrypted with AES-256 (AES-GCM) and stored on your device. The encryption key is stored only in the iOS Keychain or the Android Keystore, and the developer does not hold it.
Requests regarding retained personal data — notification of the purpose of use, disclosure, correction, suspension of use or erasure, and disclosure of records of provision to third parties — are accepted at support@join-circle.net. We verify that the request comes from you and respond in accordance with applicable law. As a rule, no fee is charged. Because the developer does not hold your registered data, most of these can be carried out directly within the App.
7. Third-Party Sharing
The App does not provide or sell the data you register (passwords, subscription information, etc.) to third parties (the developer does not hold it). Only the information described in Section 2 is sent to service providers such as Google (ads and analytics) in order to provide the relevant features. This is limited to the purposes of ad delivery and analytics; we do not sell personal information and do not share it for cross-context behavioral advertising.
8. Where Data Is Processed and International Transfers
The App does not store your registered data on the developer's servers. Only information arising from the use of the following services may be processed outside Japan.
- Ad delivery (Google AdMob) and usage analytics (Firebase Analytics, only if you consent): handled on servers in countries and regions determined by Google (such as the United States)
- Password breach check (optional): only the first 5 characters of the password hash are sent to Have I Been Pwned (United States and elsewhere)
- iCloud sync (iOS only, optional): data already encrypted on your device is stored in your own iCloud (Apple)
- Exchange rate retrieval: only currency rate requests are sent to
api.frankfurter.dev,cdn.jsdelivr.net, andopen.er-api.com(none of your data is sent). These services are operated on servers outside Japan - Website icon retrieval (can be turned off in settings): only an icon request is sent to the host of a URL you registered (its location varies by site)
- Purchase and restore (App Store / Google Play): processed on Apple's or Google's servers (United States and elsewhere)
For such transfers we rely on safeguards such as the standard contractual clauses provided by each service provider.
9. For Residents of the European Economic Area (EEA) and the United Kingdom (GDPR)
- Controller: Join Circle LLC (2627-10 Mihocho, Midori-ku, Yokohama, Kanagawa 226-0015, Japan / support@join-circle.net)
- Legal bases: analytics = consent (withdrawable in settings); non-personalized ads = consent (an in-app consent form shown after you unlock the App; you can change or withdraw it at any time under Settings → "Ad privacy settings". Without consent, no ads are requested or shown); breach check, iCloud sync, and website icon retrieval = consent (optional features you enable or change in settings); purchase and restore = performance of a contract
- Your rights: access, rectification, erasure, restriction of processing, data portability, objection, and withdrawal of consent. Because the developer does not hold your registered data, most of these rights can be exercised directly within the App
- You have the right to lodge a complaint with the data protection supervisory authority in your country or region
- Retention: the retention period for information processed by Google in connection with ad delivery follows Google's policies (https://policies.google.com/technologies/ads)
10. For California Residents (CCPA / CPRA)
The App does not sell personal information and does not share it for cross-context behavioral advertising (ads are non-personalized only, with no tracking via advertising identifiers). You have the right to request disclosure and deletion, and the right not to be discriminated against for exercising your rights. The categories the developer collects are limited to (a) internet or other electronic network activity information (statistics on screen views and feature use; only if you consent) and (b) identifiers (IP address and app instance ID, processed by the advertising and analytics providers). We do not collect sensitive personal information. To exercise your rights, contact support@join-circle.net. Requests submitted by an authorized agent are also accepted.
11. Changes to This Policy
Any changes to this policy will be announced on this page.
12. About This Website (passubly.com)
This section covers the handling of information when you browse this website (passubly.com), as distinct from the App.
This site uses Google Analytics 4 to help us improve its content and presentation. We collect statistical information such as the pages viewed, the referring source (search engine, linking site, and so on), an approximate location, and the type of browser and operating system. Cookies and your IP address are used for this purpose, and the IP address is anonymized before processing.
Site analytics never collect personal information such as your name or email address. The information collected here is never linked to the data you store in the App (passwords, subscription information, and the like).
If you visit from the European Economic Area (EEA), the United Kingdom, or Switzerland, we measure your visit only if you select "Agree" in the consent banner. If you select "Decline", no analytics cookies are stored.
You can withdraw consent or stop analytics at any time by either of the following:
- Clearing this site's cookies and site data in your browser settings (you will be asked again on your next visit)
- Installing the Google Analytics Opt-out Browser Add-on
For how Google handles this information, see the Google Privacy Policy and Google's privacy information for businesses.
13. Contact
For questions about this policy, please contact:
Join Circle LLC
2627-10 Mihocho, Midori-ku, Yokohama, Kanagawa 226-0015, Japan
support@join-circle.net