Last updated: October 26, 2026
This policy explains what information Passdown collects, why, who can see it, and what you can do about it.
In short
- You sign up with your institutional email address, or your institution's Google account. We use the address to check that you're a student, to send you sign-in codes, and to tell you about a suspension.
- Your name, program, year of study, and profile photo are visible to the students at your institution: that's the point of Passdown. Everything else has its own rules, set out below.
- Your timetable is yours alone.
- Anonymous posts don't show your name to anyone, but Passdown keeps who wrote them, to deal with abuse.
- No ads, no selling information, and no tracking cookies.
- You can delete your account, and your information with it, at any time: in Settings, or by writing to us while your account is suspended.
1. Who we are
Passdown (passdown.space) is run by Amit Kerub, who controls the information described here (the database controller under Israel's Privacy Protection Law, 1981). Contact: passdown.space@gmail.com.
2. What we collect, and why
No law requires you to give us any of this. You give it by choice, and each item says what it's for and what happens without it.
Your account. Your institutional email address, to check that you're a student of an institution Passdown supports, to send you sign-in codes, and to tell you about a suspension. Without it you can't sign up. When you sign in, our sign-in provider records the time, your IP address, and your browser, to keep accounts secure. If you sign in with Google (only where your institution's student mail is on Google), Google sends us your institutional address, confirms it's yours, and also sends the name and profile photo on that Google account. We keep only the address and Google's number for the account: the name and photo are dropped as they arrive, apart from our sign-in provider's technical logs, which keep the name and your address for up to 7 days. Google learns that you signed in to Passdown.
Your profile. Your first and last name, program, and year of study, so the students at your institution know who they're learning with. A profile photo and a handle for Global are optional. We also keep your settings, such as your language, notifications, and who sees your course list. Course pages need a profile.
Your timetable PDF. When you add courses from your timetable PDF, Passdown reads it on your device: the file never leaves it, and your ID number, address, phone, and email in it are never read. Only the semester, your courses and groups with their times and rooms, and the file's program are sent; the program goes into your profile only if it has none yet (a program not on the list yet is added to the list, or kept as your request while it waits). When you first set up your profile, your name and year are sent too. You can add courses by hand instead.
Your exam table PDF, and exam dates. When you add exam dates from your exam table PDF, Passdown reads it on your device: the file never leaves it, and your name, ID number, and the rooms in it are never read. Only its rows are sent: each exam's course, lecture group, moed, date, and hour, with the date the table was printed. The dates join their courses for every student at your institution, with no link to you, and when a date moves, the students who take that course are notified, with only the course's name. A date you change or add by hand in an exam's panel is sent the same way, with no print date, and it's yours: only you see it. Other students at your institution may see that a different date was reported, the one the most students sent, never who sent it. We keep what you sent about each exam, your latest word, so moderators can find and undo a wrong date. You can add dates by hand instead, or not at all.
Your courses and your week. The courses you join or save, your groups, the rooms from your own PDF, the events you add to your week (and their place, if you type one), and which weeks a class meets, as you answered. They show your week, your courses, and what's new in them. A course or group from your PDF that isn't on the course list yet joins it, with its times and rooms (a new course may first wait for another student's PDF), with no link to you. Courses and groups you pick by hand never do. Your courses and groups also count, without your name, toward your program and year's common weeks and popular courses: each shows only to the students of your program and year, only once at least 3 of them share it, and with no number saying how many. A common week also marks a course where at least 3 of them are in each of two groups or more, so you check your own group if you pick that week.
What you post. Posts, comments, polls and your answers to them, reviews, ratings, links, tags, quotes, files, photos, and their descriptions. They're shown where you posted them. Each photo also has a small copy, for showing many photos together: only those who see the photo see it, and it's deleted with the photo. Before a Word, PowerPoint, or Excel file is posted, our server looks inside it, only to refuse what could harm whoever opens it (such as macros, or links that load content from elsewhere), and keeps nothing from inside it. For anonymous posts and comments, we keep who wrote them (section 4).
Your activity that features need. Your votes, saved posts, which of your own posts you muted (until you unmute one, or delete it or your account), reports (and any details you add), which posts in your courses you've read (for the "new" marks), when you last opened your notifications and Global (for the bell's count and the Feed tab's dot), your notifications (and which ones you've read, from a push or in the app), and counts of your recent actions that stop abuse, such as how many posts you wrote today.
Blocks. When you block a student, we keep whom you blocked and when, until you unblock them or either of you deletes their account. Between the two of you, both ways, posts and comments under your names, your course lists, and the notifications they'd bring are hidden, and the student you blocked can't open your profile. Anonymous posts and comments, and handles in Global, aren't affected. The student you blocked isn't told, but can tell from what disappears. The person responsible for moderation can look blocks up when a safety report needs it.
Moderation. When a post or comment is reported, your institution's moderators see it in their queue: its text, photos, or file, its author as students see them (never who wrote an anonymous one), and the reports' reasons and details, never who sent them. That copy goes once they decide. Each decision is kept in a log: what was done, by which moderator, when, where, and a line of the post or comment while it exists. The log also records the student a decision concerns, which moderators don't see, so repeated breaches can be dealt with. If your post or comment is removed, you're told why in your notifications, with its first line, which only you see. If a breach is serious or repeated, a moderator can also block your uploads or suspend your account, for a day, a week, 30 days, or for good. You're told of either in your notifications, with the reason and its end, and you also see a block on uploads where you'd upload. A suspension stops sign-in (our sign-in provider records on your account until when) and anything you'd post until it ends, and turns off notifications on your devices, so we also email it to you. An early lift of either reaches you the same way. Each is a decision in the log, which moderators see without seeing whose it is. While either is in force, we keep a fingerprint of your email address (a one-way hash), so deleting the account and signing up again doesn't undo it.
What timetables and photos add. Moderators also review what students' timetable PDFs add to the catalog (a course, a group, or a course's name) and the programs they name, and every photo posted, profile photos included. They see a course, group, or program with how many students have it, as a number, never who, and a photo with where it's posted, never who posted it; a profile photo shows with its name, as your profile does. A removed photo disappears for everyone, and can be brought back. These decisions go in the same log, which names the course, program, or photo's course, never a student.
Push notifications. If you turn on notifications on a phone or computer, we store a push address for that device, which your browser gives us, to send it your notifications. Your browser's maker (Apple, Google, Microsoft, or Mozilla) delivers each one from its own servers, encrypted so it can't read it. Without them, your notifications wait in Passdown. On devices that allow it, the app's icon shows how many of your notifications are new, and each push carries that number.
Feedback. What you write in the feedback form, with your name, your institutional address, the page you came from, and your browser, so we can reply and fix bugs.
Technical information. Error reports, anonymous usage statistics, and short technical logs kept by our providers (section 8).
3. Who can see what
| What | Who sees it |
|---|---|
| Your name, program, year of study, and profile photo | Every student at your institution |
| Posts and comments under your name | The students who can see where you posted them |
| Your course list, and the list of your posts on your profile | Your setting, in Settings under Privacy: every student at your institution (the default), or friends only, which means only you until Passdown has friends |
| Anonymous posts and comments | Whoever can see where you posted them, without your name |
| Your handle in Global | Students at your institution, with no link to your name |
| Your timetable, groups, events, rooms, and class weeks | Only you. Your courses, and the groups your own PDF brought, count without your name toward your program and year's popular courses and common weeks, from 3 students (section 2) |
| Exam dates from exam tables, and when they changed | Every student at your institution, never who sent them. A date you set by hand: you, and other students may see it as a reported date, never who sent it. What you sent about each exam: only you and Passdown's moderators |
| Your votes, poll answers, and ratings | No one: others see only totals |
| Your reports | No one sees who reported |
| A reported post or comment, and its reports' details | Your institution's moderators, until they decide: never who reported, and never who wrote an anonymous one |
| Moderators' decisions | Your institution's moderators. The student a decision concerns: no one |
| What timetables and photos added, while it waits for review | Your institution's moderators: courses, groups, and programs with how many students, never who; a photo with where it's posted, never who posted it (a profile photo with its name) |
| A suspension or a block on your uploads | You, in your notifications (a suspension by email too) and where it applies. Moderators see the decision in their log, never whose it is |
| Your saved posts, muted posts, read marks, notifications, and settings | Only you |
| Whom you blocked | Only you, in Settings. The student you blocked isn't told, but can tell from what disappears |
| Your email address | No student. It's used for signing in and for notices about a suspension, and it comes with feedback you send us |
Your name, program, year of study, and profile photo
Who sees it: Every student at your institution
Posts and comments under your name
Who sees it: The students who can see where you posted them
Your course list, and the list of your posts on your profile
Who sees it: Your setting, in Settings under Privacy: every student at your institution (the default), or friends only, which means only you until Passdown has friends
Anonymous posts and comments
Who sees it: Whoever can see where you posted them, without your name
Your handle in Global
Who sees it: Students at your institution, with no link to your name
Your timetable, groups, events, rooms, and class weeks
Who sees it: Only you. Your courses, and the groups your own PDF brought, count without your name toward your program and year's popular courses and common weeks, from 3 students (section 2)
Exam dates from exam tables, and when they changed
Who sees it: Every student at your institution, never who sent them. A date you set by hand: you, and other students may see it as a reported date, never who sent it. What you sent about each exam: only you and Passdown's moderators
Your votes, poll answers, and ratings
Who sees it: No one: others see only totals
Your reports
Who sees it: No one sees who reported
A reported post or comment, and its reports' details
Who sees it: Your institution's moderators, until they decide: never who reported, and never who wrote an anonymous one
Moderators' decisions
Who sees it: Your institution's moderators. The student a decision concerns: no one
What timetables and photos added, while it waits for review
Who sees it: Your institution's moderators: courses, groups, and programs with how many students, never who; a photo with where it's posted, never who posted it (a profile photo with its name)
A suspension or a block on your uploads
Who sees it: You, in your notifications (a suspension by email too) and where it applies. Moderators see the decision in their log, never whose it is
Your saved posts, muted posts, read marks, notifications, and settings
Who sees it: Only you
Whom you blocked
Who sees it: Only you, in Settings. The student you blocked isn't told, but can tell from what disappears
Your email address
Who sees it: No student. It's used for signing in and for notices about a suspension, and it comes with feedback you send us
Visitors who aren't signed in see no profiles and no names. A course's public page, which anyone with its link can open and search engines may list, shows only the course's own details (its name, number, credits, and this semester's lecturers) and how many posts, past exams, and solutions it holds, never a post, a comment, a name, or a file. A link to it previews the course's name, its number, and these counts (in WhatsApp, for example).
4. Anonymous posts
When you post or comment anonymously, students see "Anonymous" (or your handle, in Global) instead of your name. Passdown records who wrote it, and in the app only you can see that. Moderators don't see it, even when they decide a report about it. The person responsible for moderation can look it up when it's needed to deal with abuse, and keeps it to themselves. We'd disclose it only when the law requires it, such as under a court order.
Anonymity can't hide what you write yourself, or what's inside a file. Photos are redrawn on your device without their hidden details (such as where they were taken), and past exams lose their file properties. Other PDFs, and Word, PowerPoint, and Excel files, keep their properties, which may include an author's name, and an Office file's comments and tracked changes keep their writers' names, so check a file before posting it anonymously.
5. Who we share information with
We don't sell information, don't share it for advertising, and don't build profiles of you for anyone. We share it only:
- with other students, as section 3 describes;
- with the service providers that run Passdown for us (section 6);
- when the law requires it, such as under a court order, or to protect someone from serious harm;
- with a new operator, if Passdown moves to one. This policy would still apply, and we'd tell you beforehand.
6. Our service providers
| Provider | What for | Where the information is |
|---|---|---|
| Supabase | The database, signing in, and file storage | Germany (EU) |
| Vercel | Hosting the site | Germany (EU), served through its worldwide network |
| Mailgun | Sending sign-in codes, notices about a suspension, and feedback emails | The EU |
| Sentry | Error reports | The EU |
| Umami | Anonymous usage statistics | The US and the EU |
| Our inbox (Gmail), which receives feedback and your emails, and signing in with Google, for those who choose it | The US and worldwide | |
| Apple, Google, Microsoft, Mozilla | Delivering push notifications to your devices, encrypted | Their servers, worldwide |
Supabase
What for: The database, signing in, and file storage
Where the information is: Germany (EU)
Vercel
What for: Hosting the site
Where the information is: Germany (EU), served through its worldwide network
Mailgun
What for: Sending sign-in codes, notices about a suspension, and feedback emails
Where the information is: The EU
Sentry
What for: Error reports
Where the information is: The EU
Umami
What for: Anonymous usage statistics
Where the information is: The US and the EU
Google
What for: Our inbox (Gmail), which receives feedback and your emails, and signing in with Google, for those who choose it
Where the information is: The US and worldwide
Apple, Google, Microsoft, Mozilla
What for: Delivering push notifications to your devices, encrypted
Where the information is: Their servers, worldwide
Some of these companies are based in the US. They handle information for us under their own terms, which commit them to protect it and to use it only to provide their service.
7. Cookies and storage on your device
Passdown uses no advertising or tracking cookies. It sets only the cookies it needs: one that keeps you signed in, a short one that ties a Google sign-in to your browser while it happens, and ones that remember your language and layout. Your browser also keeps a few small things for Passdown on your device, such as light or dark mode, your recent emoji, your place in a feed, this device's notification settings, and, while you sign in with Google, the institution and username you typed. They stay on your device, and we don't receive them.
Photos and files you open or download stay in your browser's private cache for up to a year, so they open quickly. Your browser also keeps one Passdown page, "No internet connection", to show when there's no connection; it holds nothing about you. Clearing your browser's data removes all of this, and signs you out.
8. Statistics, errors, and logs
- Usage statistics (Umami). We count page visits and a few actions, such as signing up, adding a course, or creating a post, with at most one detail (such as the post's type). Umami uses no cookies and keeps nothing that identifies you. Addresses are counted without their query part, and pages that identify a person, such as profiles, aren't counted. A link shared from Passdown ends in "?s=1", the same for everyone, so we can count pages opened from shared links; it says nothing about who shared or opened it. If your browser sends "Do Not Track", nothing is counted.
- Errors (Sentry). When something breaks, an error report goes to Sentry with technical details: the page, the browser and device type, and what failed. It doesn't include your name, your email, or what you wrote.
- Technical logs. Our providers keep short logs of requests (such as the IP address, the browser, and the page requested), to keep the service running and secure.
9. How long we keep information
- Everything tied to your account stays until you delete it, or your account. Deleting your account deletes your profile, photo, posts, comments, files, votes, ratings, reports, courses, timetable, what you sent about exam dates, settings, notifications, and mutes.
- After your account is deleted:
- our sign-in provider's security log of sign-ins, with your email address, stays for up to 90 days;
- a copy of feedback you sent stays in our inbox;
- database backups keep deleted information for up to 7 days;
- error reports are deleted automatically within 90 days.
- If you ask for a code and never sign in with it, the account opened for your address is deleted after a day; our sign-in provider's security log keeps the request for up to 90 days.
- A device's push address is deleted when you turn its notifications off, when you sign out on it while it's online (sign-out waits up to 3 seconds for it), when you delete your account, when your account is suspended, or when the device stops accepting notifications.
- A one-time event you added to your week is deleted, with its place, the night after its week (Sunday to Saturday) ends.
- Courses, groups, and rooms that joined the course list stay on it, as do programs that joined the program list, with no link to you. So do the exam dates your tables sent, and their history. Your dates by hand go with your account.
- A post of yours that other students quoted shows in their quote as deleted.
- A block is deleted when it's lifted, or when either account is deleted.
- The moderation log keeps its decisions on courses, programs, numbers, photos, and course families, which name no student. A photo's review goes with the photo.
- The moderation log keeps its decisions after a post, a comment, or an account is deleted, without the line of text and without the link to the student. While a suspension or a block on uploads is in force, the fingerprint of the email address stays with its decision, even after the account is deleted, and goes the night after it ends or when it's lifted. A new account with that address takes the decision over.
10. Your rights
- See your information. Ask, and we'll reply within 30 days, in Hebrew, Arabic, or English.
- Correct or delete it. You can change or delete most of it yourself: your profile in Edit profile, a post from its menu, and your settings in Settings. For anything else that's wrong, incomplete, unclear, or outdated, ask us to correct or delete it.
- Delete your account at any time, in Settings, or by writing to us while your account is suspended (a suspension stops sign-in).
- Change your mind about the optional things: remove your photo, change who sees your course list, or turn notifications off.
- Complain to the Privacy Protection Authority if you think we've mishandled your information. We'd like to hear from you first.
To ask, write to passdown.space@gmail.com from your institutional address, so we know it's you.
11. Security
We protect information with sign-in by one-time codes sent to your institutional mailbox, or through your institution's own login page via Google (there are no passwords for us to keep or lose); access rules enforced in the database itself, so each request sees only what its user may see; encrypted connections everywhere; private file storage, checked on every request; photos stripped of hidden details; limits on how many actions an account can take; and minimal access for the team. No system is perfect. If a security incident affects your information, we'll act as the law requires, including notifying the Privacy Protection Authority and, when needed, you.
12. Students under 18
Passdown is for people 18 and over. A student under 18 may use it only with the consent of a parent or guardian.
13. Changes to this policy
When we change what we collect or how we use it, we'll update this policy, and announce a significant change on Passdown before it takes effect. The date at the top shows when the policy last changed.
14. Language and contact
This policy is written in Hebrew and English. Where the two differ, the Hebrew version prevails. Questions and requests: passdown.space@gmail.com.