Privacy Policy

Last updated: April 29, 2026

What we collect

Tap Yap, Inc. ("TapYap", "we", "us") operates the TapYap mobile app. This policy explains what data we collect, what we do with it, and what control you have over it.

Identity

When you first open TapYap, we generate two random identifiers on your device:

• tap_id — your durable identity inside the app. Survives reinstalls if you've enabled Android backup; otherwise it regenerates.
• device_id — a per-install identifier paired with a bearer token used for authenticated requests to our servers.

These IDs are not derived from your phone number, email, IMEI, advertising ID, or any other identifier provided by the operating system. They are random UUIDs created locally on first launch.

Profile data

You voluntarily provide:

• A display name (any string you want)
• An avatar (an emoji or, optionally, a photo)
• An optional bio ("About" line)

None of these are validated against a real-world identity. You can use a pseudonym.

Connections

When you tap another phone, our server stores a row recording the connection (the two tap_ids and the time it happened). This is the only way TapYap knows who is allowed to message whom.

Messages

All traffic between your phone and our servers is encrypted in transit using TLS. Messages are stored on our server only as long as needed to deliver them to the recipient — typically seconds — then deleted. Undelivered messages waiting for an offline recipient are kept up to 24 hours, then expired. We do not read your message content as a matter of policy and design; full end-to-end encryption (where the server cannot read messages even if it wanted to) is on the roadmap for a future release and we'll update this policy when it ships.

Approximate location

For the operations dashboard, we resolve your phone's IP address to an approximate city via a third-party IP geolocation service when you register. This is used internally only — we do not display your location to other users. Phones connecting from private LAN IPs (home/office networks) are mapped to the location of our server, not your address.

Diagnostic telemetry

The app sends occasional pairing-process telemetry (NFC handshake steps, BLE peer-seen events, errors) so we can debug pairing failures. Each telemetry event includes your tap_id and a timestamp. No message content is ever telemetered.

What we do NOT collect

• Your phone number
• Your email address
• Your contact list
• Your precise GPS location
• Your advertising ID
• Browsing history outside the app
• Microphone or camera input outside the moments you explicitly use them (recording a voice note, taking a photo, scanning a QR code)

How we use what we collect

• To route messages between connected users
• To compute "friend-of-a-friend" reachability (your two-hop network)
• To serve presence updates (green dot for online, etc.) to your contacts
• To debug app failures via the pairing telemetry log
• To resolve your approximate region for our internal operations dashboard

How we share what we collect

We do not sell your data. We do not share your data with advertisers. We do not share your data with data brokers.

We share data only with:

• Other TapYap users: your display name, avatar, accent color, and online status are visible to your first- and second-degree contacts.
• Service providers strictly necessary to run the app: our cloud infrastructure (Hetzner), our IP-geolocation provider (ip-api.com). These providers process data on our behalf under contract.
• Law enforcement when required by law: a valid court order may compel us to produce stored data. We will produce only what we have, which is intentionally very little.

Bluetooth and offline messaging

When you enable the offline mesh, your phone advertises a short cryptographic fingerprint of your tap_id over Bluetooth Low Energy so nearby contacts can recognize you. The full tap_id is never broadcast. Mesh-routed messages are stored only briefly on relaying phones and are dropped after delivery or expiration.

Children's privacy

TapYap is not targeted at children under 13. We do not knowingly collect personal information from children under 13 except as initiated by a parent or guardian. Parents who set up TapYap for younger family members should do so themselves and supervise the tap-to-pair process.

Your rights

You can:

• Delete your account at any time. See data deletion.
• Forget any individual contact from inside the app — wipes the connection on your side.
• Export your data by emailing privacy@tapyap.com. We'll send you a JSON dump of everything we have within 30 days.
• Correct your data by emailing the same address.

EU/UK residents

Under GDPR, you have the right to access, rectify, erase, restrict, and port your personal data. You also have the right to object to processing and the right to lodge a complaint with a supervisory authority. For any of these requests, email privacy@tapyap.com.

California residents

Under the CCPA, you have the right to know what personal information we collect, the right to delete it, and the right to opt out of any sale or sharing of personal information for cross-context behavioral advertising. We do not sell or share your personal information for advertising.

Data retention

Account data is retained for the life of your account. When you delete your account, all server-side data tied to your tap_id is deleted within 30 days. Relay messages awaiting delivery are deleted after 24 hours regardless of account state.

Security

All traffic between your phone and our servers uses TLS. Messages pass through our servers in transit; we do not read message content as a matter of policy and design. Full end-to-end encryption (where the server cannot read messages even if it tried) is on the roadmap and we'll update this section when it ships. Your bearer auth token is generated server-side, transmitted over TLS, and stored in Android's encrypted DataStore.

Changes to this policy

We'll post any material changes here and bump the "Last updated" date above. If the change affects how we handle your data, we'll also show an in-app notice on next launch.

Contact

Privacy questions: privacy@tapyap.com
Legal: legal@tapyap.com
General support: support@tapyap.com