Skip to content

Privacy policy

This policy explains what personal information EPASS collects when you create and use an EPASS, why we need it, who can see it, and the choices you have.

What we collect

We only ask for what we need to run your EPASS and verify that you are who you say you are.

  • Account details: your email address and password (we store a one-way hash, never the password itself). If you sign in with Google or Discord, we receive the account details that service shares with us.
  • Profile details you enter: first and last name, date of birth, gender, phone number, address, profile photo and preferred language.
  • Identity verification: the type of identity document you chose, photos of its front (and back, if it has one), a selfie, and the result of the review, including the reason if it was not approved.
  • Security information: your two-step verification setting and the one-time codes we send you, and whether your account is in good standing.
  • Connected apps: which apps you connected with “Verify with EPASS”, what you allowed them to see, when you connected them and when they last used your EPASS.
  • E-Score: tournament results that connected platforms report for your EPASS, once this feature is available.
  • Messages: your email address if you subscribe to our newsletter, and what you send us through the contact form.

How we use it

We use your information to provide EPASS, not to advertise to you.

  • To create your account and your player passport, and to let you sign in.
  • To verify your identity: we compare your ID document, your selfie and your profile details.
  • To keep your account secure, for example by sending sign-in and confirmation codes and by enforcing suspensions or bans.
  • To let you sign in to other apps with EPASS and share only what you approved.
  • To calculate your E-Score from reported tournament results, once this feature is available.
  • To send you service emails (codes, verification updates) and, only if you subscribed, our newsletter.

Your ID document and selfie

These are the most sensitive things you give us, so they are handled separately.

  • The photos you upload are stored with our image-hosting provider, Cloudinary.
  • They are reviewed by the EPASS team to decide whether your identity can be verified.
  • They are never shared with connected apps.

What connected apps receive

When you use “Verify with EPASS”, the app asks for permissions and you decide whether to allow them. Depending on what you allow, the app receives:

  • Your EPASS account ID.
  • With the “profile” permission: your name, username and profile photo.
  • With the “email” permission: your email address and whether it is confirmed.
  • Always: whether your EPASS is verified.
  • Never: your ID document, your selfie, your date of birth, your address or your phone number.
  • Tzone: when your verification is approved or rejected, EPASS tells Tzone your email address and the result, so that a Tzone account with the same email shows the correct status.
  • You can disconnect an app at any time from your dashboard. It then loses access to your EPASS. Information it already received is covered by that app's own privacy policy.

Who else handles your information

We use a small number of service providers to run EPASS:

  • Cloudinary stores uploaded images (profile photos, ID photos and selfies).
  • Resend delivers our emails.
  • Twilio delivers text messages, only if you choose to receive codes by SMS.
  • We may disclose information to authorities when the law requires it.
  • We do not sell your personal information.

What we store on your device

EPASS keeps a few things in your browser so the site works:

  • Your sign-in session is kept in your browser's local storage. Clearing it signs you out.
  • Your language choice is kept in a cookie named NEXT_LOCALE.
  • If you sign in with Google or Discord, our server uses a session cookie while that sign-in completes.
  • The EPASS website does not use advertising or analytics cookies.

Your choices

You stay in control of your information:

  • You can update your profile, email address, password and language in Settings.
  • Once your identity is verified, your name and date of birth can only be changed by contacting support.
  • You can see and disconnect connected apps on your dashboard.
  • To stop receiving the newsletter, contact us.
  • You can ask us for a copy of your information or ask us to delete your account by contacting us.

Contact us

Questions about this policy or your information? Contact the EPASS team.