Privacy Policy

Effective 27 September 2026

Tical doesn't collect personal data. Your tickets are read on your device, and their details are never sent to the developer or anyone else. To sign a Wallet pass, Tical sends only a fingerprint of the pass to its signing server.

What Tical collects

No personal data. Tical has no accounts, no analytics, no advertising, and no tracking. It doesn't send your tickets, their details, or anything about you to the developer or to third parties. The only thing it sends is what the signing server needs to sign a Wallet pass, described below.

If you've chosen to share analytics with app developers in your device's settings, Apple may share anonymous crash reports with the developer. That's an Apple feature you control in Settings; Tical itself contains no analytics code.

How Tical reads your tickets

When you give Tical a screenshot, photo, or PDF, it reads it on your device: Apple's Vision framework finds the code and the text, and, where available, the Apple Intelligence model on your device works out the details. Tical doesn't use cloud processing, including Apple's Private Cloud Compute.

Tical keeps the ticket in memory while you review it and doesn't save it. When you share a ticket to Tical from another app, it's held in Tical's private storage on your device until Tical opens it, and deleted right after.

Photos, files, and the clipboard

Tical doesn't ask for access to your photo library, files, or clipboard. The photo picker, including the row of recent screenshots, and the file picker are system screens that give Tical only the items you pick. Tical reads the clipboard only when you tap Paste.

Calendar

Tical doesn't ask for access to your calendar and can't read your events. It fills in Calendar's own event editor, and iOS saves the event when you tap Add.

Apple Wallet passes

Wallet only accepts passes signed with a certificate from Apple. Tical builds each pass on your device, then has Tical's signing server sign it. For each pass, it sends the server:

• the SHA-256 fingerprint of the pass's file list. It's a hash of hashes, and can't be turned back into the ticket or its details;
• an App Attest key identifier and an assertion. Apple's App Attest service creates these on your device to prove the request comes from Tical on a real device. The key is random and belongs only to this installation of Tical.

The server returns the pass's signature. It never receives the event, date, venue, seat, booking number, code, or image.

To prevent abuse of Tical's certificate, the server keeps each App Attest key's public key, Apple's attestation receipt for it, and a counter, and deletes a key when it hasn't been used for about 13 months. It counts how many passes each key signs per day, and deletes those counts after two days. It doesn't store IP addresses or the fingerprints it signs.

The server runs on Cloudflare, with its data stored in Western Europe. To deliver each request, Cloudflare processes your device's IP address and keeps short-lived operational logs, as described in Cloudflare's privacy policy.

Your own certificate

If you're in the Apple Developer Program, you can have Tical sign passes with your own Pass Type ID certificate instead. Tical then signs on your device and doesn't contact its server.

Tical stores your certificate and its private key in your device's keychain, marked to stay on this device: they don't sync to iCloud Keychain and can't be restored onto another device. You can remove them at any time in Tical under Settings › Wallet Passes › Remove Certificate.

When you import a certificate file that doesn't include Apple's intermediate certificate, iOS downloads that public certificate from the address listed in your certificate. No ticket or personal data is sent.

Settings

Tical stores two preferences on your device: the default event length and the start time for tickets that show only a date.

Links

Links to Apple's developer website open in your browser, where Apple's privacy policy applies.

Children

Tical doesn't collect personal data from anyone, including children.

Changes

If this policy changes, the new version will be posted on this page with a new effective date.

Contact

Questions about privacy? See the support page.