Skip to content
FFN Pass Open your pass
How it works For sites Privacy & security FoFo Network Open your pass

Privacy & security

Built to know as little about you as it can

FFN Pass exists so you don't have to hand your documents to every site. Here is exactly what FFN keeps, what it never keeps, and how your pass is protected.

What FFN keeps

  • Your recovery email, used only if you lose your passkey.
  • Your passkey's public key, so your device can prove it's you.
  • Your vault, encrypted. FFN can't open it when your passkey locks it.
  • A record of each credential it issued: its ID, type and status, the evidence entries, and the ID partner's reference for the check.

What FFN never keeps

  • Images of your ID or your face.
  • Your address, or your full date of birth unless you share it.
  • A list of the sites you share with. Remembered sites live in your encrypted vault.
  • Account contents. No posts, connections, messages or access tokens.
  • Your legal name after a name check. It's used once and discarded.

How your vault is locked

  • Your pass is protected by a passkey (WebAuthn). Passkeys are bound to pass.fofo.network, so a lookalike site can't use yours.
  • Where your passkey supports it, the key that encrypts your vault is derived from the passkey itself (the PRF extension). FFN stores only ciphertext it can't decrypt.
  • Where it doesn't, FFN keeps your vault key wrapped in its own key service. This is weaker, and your pass and your credentials say “custodial” so you and sites can see it.
  • The open vault key lives only in the tab's memory. Reloading, 15 quiet minutes, or tapping Lock all close it.

ID checks

  • “Scan your ID” uses our verification partner, Didit. It's document only by default. A selfie and face match run only if you switch them on for that scan.
  • FFN reads the result from the partner, keeps only the fields your credential needs, and asks the partner to delete its copy after your credential is issued.
  • A check that doesn't complete is never stored as a negative fact about you and never shown to anyone. FFN doesn't keep why it didn't complete.

When you share

  • A site sees only the claims you switch on, each with its evidence.
  • Each site gets its own identifier for you, so two sites can't match you up by it.
  • Every presentation is signed for one request by one site, so it can't be replayed somewhere else.
  • Sites verify the signature themselves, and FFN keeps no record of when or where you share.

Signing keys

FFN's issuer key lives in Google Cloud KMS and never leaves it. The list of issuers and sites your pass trusts is a registry file signed with a separate key, which is pinned into your pass. If a site or issuer isn't in that registry, your pass won't share with it or accept from it.

Your controls

  • Hide or show each linked account and vouch.
  • Forget a remembered site, so it asks again next time.
  • Delete your pass. FFN revokes every credential it issued to you, then deletes your passkey records, your vault and your email.

How to spot a fake

FFN will never call, text or email you to ask for a code, your passkey or a photo of your ID. Your pass only ever lives at pass.fofo.network.