Privacy Policy

1. Who we are

PassFail.wtf (“PassFail,” “we,” “us”) is a community-driven platform that grades websites on their password and authentication policies. This policy explains what personal data we process when you use the site. For the rules of use, see our Terms of Service.

2. GitHub sign-in (Supabase Auth)

We use GitHub OAuth for authentication, handled by Supabase Auth. When you sign in, GitHub shares a standard OAuth profile with us and Supabase stores it. Specifically we keep:

• →Your GitHub username / handle and numeric account ID.
• →Your display name and avatar URL (used on your public profile and next to your contributions).
• →The email address associated with your GitHub account (used for account identity and, if you opt in, notifications).
• →Auth metadata Supabase needs to keep you signed in (session tokens, timestamps).

We never receive or store your GitHub password. Supabase acts as our data processor for authentication; see the Supabase Privacy Policy and GitHub's privacy statement.

3. Content you submit

Grades, evidence screenshots, tester notes, comments, and votes are stored in our database (hosted on Supabase/Postgres) and are public by design— that's the whole point of a community accountability platform. Your public profile shows your username, avatar, karma, and contributions. Please don't include private or sensitive information (including real credentials) in screenshots or notes.

4. Newsletter (Buttondown)

If you subscribe to our newsletter, we store your email address (with subscription status and a confirmation token) in our database and forward it to Buttondown, our email service provider, to deliver the emails. This is entirely opt-in with a double opt-in confirmation step. Every email includes an unsubscribe link, and you can unsubscribe at any time. See the Buttondown Privacy Policy.

5. Cookies & analytics

We use a small number of essential cookies— set by Supabase Auth to keep you signed in and to protect against cross-site request forgery. These are required for the site to function and can't be turned off without breaking sign-in.

We aim to keep tracking to a minimum. We do not sell your data or use it for cross-site advertising. If we introduce privacy-respecting, aggregate analytics to understand traffic, we'll describe it here; any such analytics are used only in aggregate and never to build advertising profiles.

6. How we use your data

• →To operate the platform: authenticate you, attribute your contributions, and calculate karma.
• →To display public grades, comments, and profiles.
• →To send the newsletter, if you opted in.
• →To moderate content, prevent abuse, and enforce our terms.
• →To comply with legal obligations.

We don't sell your personal data, and we don't share it except with the processors named here (Supabase, Buttondown) or when required by law.

7. Data retention

We keep your account and contributions for as long as your account is active. Public contributions may remain on the platform after account deletion in anonymized or attributed form to preserve the integrity of grade history, unless removal is required. Newsletter data is kept until you unsubscribe.

8. Your rights & choices

You can request access to, correction of, or deletion of your personal data, and you can unsubscribe from the newsletter at any time. Depending on where you live (e.g. the EEA/UK under GDPR, or California under the CCPA), you may have additional rights. To exercise any of these, email hello@passfail.wtf. To request removal of specific content, see the Contact & Moderation page.

9. Children

PassFail is not directed to children under 13 (or the minimum age in your jurisdiction), and we don't knowingly collect their data. If you believe a child has provided us personal data, contact us and we'll delete it.

10. Changes & contact

We'll update this policy as the platform evolves and revise the “Last updated” date above when we make material changes. Questions about privacy? Email hello@passfail.wtf.