Privacy: what leaves your machine

Compass keeps your data on your computer and sends as little as it can. This page lists what stays, what leaves and for how long.

What stays on your machine

Your access token and refresh token stay in your computer keychain. The access token goes only to the AWS Events API. The refresh token goes only to the sign-in service.
The session catalog cache and a snapshot of your schedule stay in a folder on your computer. The snapshot is purged 30 days after the event ends, or when you run forget_me.
The record of the passes you have issued stays in that same folder.
Your week spec stays in your workspace. Compass offers to add it to .gitignore, because a public repo would publish where and when you will be.
The result of the code scan stays in memory. The week spec gets service names and depth only, with no file paths.
The pass files, calendar files and itinerary page that Compass generates stay in a folder on your computer.

Your ID token goes only to the Compass API, as proof that you are signed in. It is never stored there. The server keeps only a one-way keyed hash of your sign-in identifier.
The printable pass fields go to the Compass API: the session code and title, the venue and room, the times, the walk from the previous session and the next connection. They are kept until the session ends plus 24 hours.
Your name is sent only if you choose to add it. It is typed on your machine and never taken from your sign-in token.
For Apple Wallet, your device push token is kept until your device unregisters the pass or the pass record expires.
For Google Wallet, Google holds the pass object. A voided pass is set to inactive, and every pass expires at its session end.
The Compass server runs in the AWS us-east-1 Region (N. Virginia, United States), outside South Africa, in the AWS account of the owner.
When you add a pass to a wallet, Apple (the push token) and Google (the pass object) also process data. Google acts as a processor.
No human reads server data in normal operation.

A hand-off lasts 15 minutes. After that, the link stops working.
The hand-off link keeps its secret in the part of the web address after the # sign, which a browser never sends to the website.
forget_me voids every pass for you and deletes your pass records, device registrations and hand-offs on the server. The local forget_me also deletes your schedule snapshot, your issued-pass record and the generated files on your computer.
forget_me does not delete the server rate counters, which are tied to a one-way hash of your sign-in identifier, so that it cannot reset the limits. They are deleted when their one-hour window ends plus 2 minutes.
No wallet allows a pass to be deleted remotely
Compass voids the pass of a cancelled session, and every pass expires at its session end.

This website has no sign-in, no cookies, no analytics and no requests to other websites.
The demo runs in your browser on made-up sessions. Nothing in it touches a real schedule.
The board page keeps your hand-off link in the memory of the page only. It removes the link from the address bar as soon as it has read it, and it never stores, logs or shares it.

forget_me is how you use your POPIA rights for the data Compass keeps on the server.
To ask about your data, use private vulnerability reporting on the project repository on GitHub.
You may also complain to the Information Regulator (South Africa).