Your tickets.
Your iPhone.

What stays on your iPhone

• Your passes. For each code you save, Pittari keeps what the code says and its kind, the details you keep with it (title, dates, place, seat and other fields, colors), a crop of the code as it appeared in your file, and the name and page of that file. The file you shared is read to find codes and is not kept.
• Pictures you add. A logo, banner, thumbnail or background you choose for a pass is stored with it. Pictures come from the system photo picker, which shows Pittari only the ones you pick.
• Widgets, the control and the Live Activity. They read the same passes from a file Pittari shares with them on your iPhone. A Live Activity is started on your iPhone; there is no push server.
• The Share extension reads only the file you share with it, finds its codes on the device and saves the passes you choose.

Code detection and text reading use Apple’s on-device frameworks. Nothing in this list is sent to Neorgon or anyone else, except as described under Apple Wallet.

Apple Wallet and your account

Adding a pass to Apple Wallet is optional, and it is the only part of Pittari that uses an account and Pittari’s backend.

• Linking with Apple. You link Pittari with Sign in with Apple. Pittari asks Apple for no name and no email. Apple gives Pittari an identifier for your Apple Account; the backend stores only a keyed hash of it, never the identifier itself and never an Apple token.
• This iPhone. Each request carries an App Attest proof, Apple’s way to show it comes from Pittari on a genuine device. The backend keeps that device key’s public part, a counter and when it was last used, and which account it is linked to (up to five iPhones).
• Signing a pass. To sign a pass for Wallet, Pittari sends its text (the pass.json file: title, dates, seat and other fields, and what the code says) with the fingerprints of its files, never its pictures. The backend checks it, signs it and discards it at once. It is never stored or logged.
• Kept passes. Each pass you add is kept for a year, 50 at most, so you can restore it on another iPhone or add it to Wallet again. Before it leaves your iPhone, Pittari seals the copy (AES-256-GCM) with a key that stays in your iCloud Keychain. The backend keeps the sealed copy, its size and its dates; Neorgon cannot open it.
• Limits. To keep the service fair, the backend counts how many passes an account and a device sign each hour and each day.

Pittari’s backend runs on Convex (Convex, Inc.), which hosts this data for Neorgon and processes it only to run the backend. Nothing in it is used for advertising, sold or shared with anyone else. A pass in Wallet is Apple’s to handle, under Apple’s terms.

Apple services and sharing

Apple Maps place search

When you search for a venue in a pass’s editor, the words you type are sent to Apple Maps to find matching places. Apple handles that request under the Apple Privacy Policy; Neorgon doesn’t receive it. The place you pick (its name, address and coordinates) is saved with the pass on your iPhone.

Photos

Choosing a picture uses the system photo picker and needs no permission. If you save a code image to your photo library, iOS asks first for permission to add photos; Pittari can’t read your library with it.

Sharing

Share Code Image and the pass picture go through the system share sheet, to wherever you send them. Remember that a ticket’s code is the ticket.

Siri, Shortcuts and Create a Pass

Pittari’s Siri phrases and Shortcuts actions run on your iPhone. Siri processes your voice under Apple’s terms. If you use Wallet’s own Create a Pass with a pass picture, that is Apple’s feature and Apple’s processing.

Downloads, TestFlight and diagnostics

Apple handles downloads, updates, TestFlight and crash reports under its own terms and your device settings. If you choose to share analytics with app developers, or to send TestFlight feedback, Apple may pass crash reports or that feedback to Neorgon. Pittari adds no analytics or crash-reporting code of its own.

Keeping and removing data

A pass stays on your iPhone until you delete it: Delete Pass on the pass, or Delete All Passes in About. Deleting Pittari removes all its passes and pictures from your iPhone. Your iCloud or computer backups may hold copies according to your own backup settings; manage those through Apple or your computer.

A kept pass is deleted from the backend a year after you add it or keep it another year, or at once when you delete it in About, Kept Passes. An iPhone unused for 400 days is removed. About, Apple Wallet, also unlinks this iPhone or the others.

Delete Account, in About, deletes everything the backend holds for you: every kept pass, the account and its linked iPhones. It also asks Apple to revoke Pittari’s Sign in with Apple token. If you stop using Sign in with Apple with Pittari in your Apple Account settings, Apple tells Pittari, and the account is deleted the same way. Your passes stay in Pittari on your iPhone and in Wallet.

Neorgon cannot open your kept passes, so it can’t read, retrieve or restore them for you. Without your iCloud Keychain key they can’t be opened at all.

If you write to us

If you email support, Neorgon receives your address, your message and anything you attach, and uses them only to answer you and handle your request, never for advertising and never sold. Email providers process the messages to deliver and store them. Support messages are kept only as long as the request needs; ask and they are deleted. Please don’t send a ticket that’s still valid.

Children

Pittari is a general utility, not made for children. It doesn’t ask anyone for their name, email or age.

Questions or changes

For privacy questions or requests, write to Neorgon at support@neorgon.org.

If Pittari’s handling of data changes, this policy is updated before that version ships and the date above changes.

Pittari support