Effective October 7, 2026
GivePass is operated by SKM Digital. This policy explains what the platform collects and what it does not.
GivePass uses participant activity only to operate the campaign, prevent abuse, calculate aggregate campaign results, and direct charitable impact. We do not sell participant data or create cross-campaign consumer profiles.
What we collect. The minimum necessary to prove a campaign worked: scan events tied to a per-location code, and, if you choose to provide one, a recovery contact so a lost passport can be restored. Providing a recovery contact is optional and is never required to participate.
What adding an email means. If you add an email to your passport, you agree to two things: we can use it to recover a lost passport, and we can send you occasional emails about your passport, like a reminder to pick your cause. We store those as two separate records. Every reminder email has an unsubscribe link, and unsubscribing stops those emails without affecting recovery. We never sell your email address.
A note about your network address. When you scan a sign or ask for a recovery code, we record a one-way fingerprint of the network address the request came from — never the address itself, which is not stored anywhere. It exists so that one person cannot generate a town’s worth of visits from a photograph of a sign, and so that the code screen cannot be turned into a way of sending mail to strangers. It is a pseudonym: it does not name you, but the same network produces the same fingerprint, so it can link activity from one place. It is used for those two protections and for nothing else — never to build a profile, never to identify a participant, and never shared.
What we never do. We do not access point-of-sale or purchase history. We do not build advertising profiles from participant activity. We do not sell participant data to any third party.
Aggregate reporting. Figures we publish about a campaign are reported in aggregate, at a group size meant to prevent identifying any one participant. Cause-choice data is never sold or published at any level of detail.
How long we keep things. Campaign records are kept for as long as the campaign needs them and for a reasonable period afterward, so a settlement can be audited. Technical records used only to detect abuse are kept on a rolling basis and then discarded. If you gave a recovery contact and want it removed, ask us and we will remove it.
Who else sees it. We use service providers to host the platform and to send email, and they may process this information only to provide that service to us. A campaign operator sees its own campaign's aggregate results, not another campaign's. We do not sell participant data to any third party.
Children. The platform is not directed at children under 13, and we do not knowingly collect their information.
Changes to this policy. We will post updates to this page and change the effective date above.
Contact. Questions about this policy, or a request to remove a recovery contact, can be sent to hello@givepass.app.