Privacy Policy

Effective date: 29 October 2026
Data controller: Harshit Sahai — [email protected]

Taptick is a shared status board: you and the people you invite keep track of the state of everyday things together. This policy explains what data Taptick handles, why, and your rights.

What we collect

• Account: your email address and a display name you choose. Used to sign you in, to send you sign-in codes and password-reset emails, and to attribute changes ("Fed, by Anna") to you inside the Spaces you belong to.
• Your content: the Spaces, boards, items, states, and status changes you and your Space members create. A history of status changes (what changed, when, and the display name of who changed it) is kept so every member can see how things got to their current state.
• Push notification data: if you enable notifications, a device token issued by Apple is stored so we can deliver the notifications you asked for. A random installation credential stays on your device; only its one-way hash is stored on our backend to stop another account from claiming your device token.
• Optional usage analytics: sharing is off by default. If you explicitly turn on Settings → Share usage data, Taptick sends a limited set of product-interaction events (for example, that a state change succeeded), linked to a pseudonymous account UUID. Board content — Card names, state labels, Space names, display names, email addresses, and invite tokens — is never included. Automatic app-lifecycle capture and session replay are disabled. You can withdraw consent at any time by turning the setting off; this stops future collection and clears the analytics identity and queued events on the device.

We do not collect your location, contacts, photos, advertising identifiers, or anything from other apps. If you scan a QR code or tap an NFC tag, your iPhone reads it on the device only; no image is kept or sent. Taptick shows no ads and sells no data.

Where it lives (processors)

• Supabase (backend database and authentication) — hosted in the EU (eu-central-2).
• Apple Push Notification service — delivers your notifications. Notification content (item name, new state, and the display name of who changed it) passes through it and appears on your lock screen.
• PostHog (product analytics, EU hosting) — only after you enable Share usage data and only when Taptick has configured this processor.
• RevenueCat (subscriptions) — hosted in the US. Taptick identifies you to it by your account ID, and it keeps your App Store purchase history (products, dates, renewals, and cancellations) linked to that ID so your plan follows your account. Apple processes payment; Taptick never sees your payment details.
• Zoho (ZeptoMail and Zoho Mail, hosted in the EU) — ZeptoMail delivers the sign-in codes and password-reset emails Taptick sends you, so it receives your email address and that message. Zoho Mail holds the support and privacy mailboxes, so it keeps the emails you send us and our replies.
• Cloudflare — hosts the website and the item and invite pages behind links and QR codes; like any web host, it processes the IP address and request details of each visit to serve the page. It also stores Taptick's nightly database backups in the EU, encrypted before they leave our backend so Cloudflare cannot read them.

Data on your device

For instant loading, Taptick keeps a local copy of your boards (including items and member display names) on your device, filed under your account so another account on the device cannot read it. Your sign-in session and the push-installation credential are kept in the iOS Keychain, marked so they never move to another device through a backup or transfer. Home Screen widgets show a copy of your current board. Signing out, changing accounts, or losing the session clears the local copy and widget data before another account can use them.

Retention and deletion

• Delete your account any time in Settings → Account → Delete account. This permanently deletes your account, email, current display name, subscriptions, notifications, push tokens, and any Spaces only you use. If you own a Space with other members, Taptick first asks you to transfer ownership or remove those members so their shared board is not silently destroyed.
• History in shared Spaces: the status changes themselves remain in that Space's history, so other members' boards stay truthful about how things got to their current state — but your name is removed from them. Past changes show as "Former member", and the link to your deleted account is gone.
• Notifications are deleted automatically 30 days after they arrive, whether or not you have read them.
• You can also request deletion or a copy of your data by emailing [email protected]; we respond within 30 days.

Legal bases (GDPR)

Providing the service you signed up for (contract) covers account, content, and notifications; abuse prevention, security, and rate limiting are legitimate interests. Optional analytics is processed only with your consent, which you can withdraw in Settings at any time.

You have the right to access, correct, export, and erase your data, and to lodge a complaint with your supervisory authority (in Spain: AEPD, aepd.es).

Children

Taptick is not directed at children under 14 and we do not knowingly collect their data.

Changes

We will post any changes here and update the effective date. Material changes will be flagged in the app.