Privacy

If you own a Tap2Glance card

We keep your account email, the profiles and photos you add, the cards you link, and your renewal and payment history. You decide, field by field, what anyone who taps your card sees.

Photos lose their location data when you upload them. Health details on a medical profile are shown to people who tap your card unless you hide them.

The business that issued your card sees its validity and renewals, not your profile or your contact details.

If people can contact you through a tag or card

Messages people send you are kept for 12 months. Calls are not recorded: they pass through an encrypted relay, so neither side sees the other’s number or internet address. We keep when a call happened and how long it lasted for 13 months.

If you choose to share a phone number, it is one you confirmed with a one-time code, and people who scan see it only when they tap to call or text you.

To ring your phone we keep its notification token while you are signed in on it.

Permissions the app asks for

The camera, to scan a QR code or take a photo you choose; the microphone, only during a call; notifications, to ring you and show messages. The app asks for each when you first use the feature that needs it, says why first, and works without the ones you refuse. You can change them any time in your phone’s settings.

If you tap or scan a card

We count the scan for the card’s owner. We do not store your IP address or browser: we keep a one-way digest of them for 13 months to recognise repeat scans, then only daily totals.

If you message or call the owner, they receive your message or call, never your number — unless you call or text a number they shared, from your own phone. To stop misuse we keep a one-way digest of your browser with the message or call, so the owner can block it.

If you contact us

Partner enquiries and privacy requests are used only to reply to you. We delete closed requests 12 months after closing.

Website visits are counted without cookies.

Where it is kept, and who helps us

Supabase, in India, holds the database, logins and photos. Encrypted nightly backups are kept in Google Cloud in the United States for their retention window. The website runs on Vercel; the card viewer and dashboard are served by Google Firebase Hosting; emails are sent through Zoho ZeptoMail; notifications to your phone go through Google Firebase Cloud Messaging; internet calls are relayed by Cloudflare; phone-number codes are sent by Twilio. Each processes data only to provide its service to us.

Your agreement

Before you use the app we ask you to accept this policy and the Terms of Service, and again whenever either changes. We keep the version you accepted and when.

Your choices

Download everything we hold about your account from your account page, at any time.

Delete your account from your account page. After a 30-day cooling-off we erase your profiles, photos, contact details and scan history and unlink your cards; signing in again before then cancels it. Renewal and payment records are kept for 8 years without your name, as the law requires. Backups age deleted data out within their retention window.

Correct your details in the dashboard, or ask us with the form below — also for anything you cannot do yourself, or to make a complaint.

Ask about your data

We reply by email within 30 days. We may ask you to confirm the request from the email address on your account.