Passa Cookie and Similar Technologies Policy
Prepared: 26 October 2026
Effective date: 26 October 2026
1. Who is responsible?
Passa is operated by PYRAMID TECHLAB LTD, company number 17351892, registered in England and Wales. Our address is 4 Brick Kiln Lane, Rainham, ME8 8FR, United Kingdom. Contact hello.pyramidtech@gmail.com, telephone 07867 290129, or write to us marked “Passa privacy”.
This policy explains cookies and related technologies used on devices when you use Passa. Read it with the Privacy Policy, which explains broader use of personal information and your rights.
2. Cookies, local storage and related technologies
A cookie is a small record a site can store through your browser and receive on later requests. Local storage and IndexedDB are other browser storage mechanisms. They do not work in exactly the same way as cookies, but rules about storing or accessing information on a device can also apply to them.
A service worker is a browser component that can support functions such as push notifications. A push subscription includes information needed to deliver a notification to your browser. Browser notification permission is separate from agreement to these terms or permission for unrelated tracking.
Some storage is limited to a browsing session. Persistent storage can remain until it expires, you sign out, you remove permission or you clear browser data, depending on the technology and feature. A device used by several people can retain information from an earlier user.
3. Storage used for Passa features
The inventory below describes the current application features, not every possible provider cookie. Names and behaviour managed by a third-party SDK may vary by browser or SDK version. Contact our privacy team if you need details about storage used in your browser session.
| Feature / storage | Purpose | Typical duration or control | When it is used |
|---|---|---|---|
| Firebase Authentication persistence, using SDK-managed browser storage | Keep a requested sign-in session available and support secure authentication. Storage may use IndexedDB or other browser persistence. | Depends on the persistence mechanism, sign-out and browser settings; clearing relevant site data can remove the stored session. Token expiry is not the same as the lifetime of a persisted login. | When authentication is used. |
passa-saved in local storage | Remember the listing identifiers you choose to save on that browser. It does not store the item’s full private collection details. | Remains until updated by your saved-item choices or cleared through browser storage controls. | When the saved-items feature is used. |
| Web Push permission and subscription / service-worker registration | Deliver browser notifications you request. The subscription endpoint and encryption information may also be stored server-side. | Browser/device permission can be revoked. Server-side subscription removal follows the service’s operational process. | When you choose to enable browser push. |
| Essential hosting, network or security technologies, if used in the deployed configuration | Deliver requests reliably, protect access and maintain necessary network/security functions. | Provider and configuration dependent; the verified inventory must identify any actual cookies and their lifetimes. | Only where the deployed service uses them. |
The local development preview can also store passa-demo-identity to switch synthetic demo identities. Demo mode is not intended for a public production deployment, and that development key is not a production analytics feature.
The use of Firebase, Cloudinary image delivery, Vercel hosting, Resend emails or Stripe infrastructure does not mean that every cookie a provider might offer is installed by Passa. Loading an image, processing an email or keeping a server log is also not automatically a browser cookie. Check the actual production configuration rather than treating a vendor’s entire catalogue as a site inventory.
4. Essential and optional technologies
Some storage or access can be strictly necessary to provide a service you have requested or fall within another applicable legal exception. Other uses need a clear choice and, where required, prior consent. A feature being convenient or commercially useful does not automatically make it strictly necessary.
Our intended approach is to keep essential functions separate from optional analytics, advertising and personalisation. Optional technologies that require consent must remain off until you actively agree. Continuing to browse, creating an account or accepting the Terms is not by itself consent to non-essential tracking.
The current application does not include a Passa advertising tracker or a general analytics SDK as a product feature.
We do not treat the use of a saved-items preference as permission to create advertising profiles. The legal classification and user-control design of each storage purpose must be checked in the final inventory. Where prior consent is required, that storage must be gated accordingly.
5. What happens if optional tracking is introduced?
Before enabling a use that requires consent, Passa must provide an appropriate consent control that explains the purpose and relevant providers. It must offer a genuine way to accept or reject optional purposes, with no preselected agreement or misleading design. Refusing optional tracking should not stop you using the ordinary service unless a lawful and clearly explained exception applies.
You must be able to change or withdraw a choice through an accessible control. We must retain an appropriate record of consent where required and seek a fresh choice if the purposes or providers change in a way that requires it.
A general preference centre or consent banner is not currently implemented. If optional consent-based tracking is added, the necessary control and technical blocking must be in place before that tracking starts.
6. Managing browser storage and push permission
Your browser’s site settings usually let you inspect and remove cookies and site data, block some storage and manage notifications. Instructions depend on your browser and device. You can also use private browsing, but it does not prevent every form of server logging or make your activity anonymous.
Clearing Passa site data can sign you out and remove locally saved items. Blocking storage needed for authentication may prevent sign-in or the requested persistence of a session. Removing notification permission prevents that browser from displaying future permitted pushes, but it does not automatically close your Passa account or erase unrelated server records.
Do not rely solely on a “Do Not Track” signal as a universal way to control storage: support and legal treatment can differ. Use the site’s available controls and your browser settings. Contact us if a choice appears not to work.
7. Younger members
Passa is intended for people aged 13 and over. We should explain choices in language younger members can understand, minimise device tracking and avoid nudging children into weaker privacy settings. Consent and age-appropriate design are separate questions: reaching 13 is not a blanket permission for profiling or intrusive tracking.
If you are 13–17, ask a trusted adult to help if you are unsure about browser permissions or privacy settings. We do not require optional marketing or tracking consent as a condition of receiving an ordinary free item.
8. Updates and questions
We will update this policy when purposes, relevant technologies or the verified inventory change. A revised policy alone does not switch on a purpose for which a new consent is required. The published page will show its last-updated date.
Contact the privacy address above with concerns. You can also complain to the UK Information Commissioner’s Office at ico.org.uk/make-a-complaint about cookies, device storage or related privacy issues.