Privacy Policy

2. Information You Give Us

3. Information We Collect When You Use Tapd

When you use the app, we record the following about your focus sessions:

• •The time a session starts and the time it ends.
• •Which NFC tag was used to start the session, identified by the tag's registered identifier and the name you gave it.
• •Which blocking preset was applied to the session. Presets are stored as your device's app identifiers, meaning the list of applications your preset covers. This list is stored so your presets work across sessions.
• •A focus quality rating that you assign to the session yourself. We do not measure, infer, or generate this. You choose it.
• •Groups you belong to, and your participation and standing within those groups where the Services include group or leaderboard features.

That is the complete list of what the app records about your usage.

4. Server Logs

Our servers run on Amazon Web Services and write operational logs to AWS CloudWatch. These logs are generated automatically as part of running the service and may include:

• •IP addresses
• •Request timestamps
• •The type of request made and whether it succeeded
• •Error and diagnostic messages

We use these logs only to operate the Services, diagnose problems, and detect abuse or attacks. We do not use them to build profiles, track you across sites, or for advertising. Server logs are retained for 30 days and then deleted automatically.

5. What We Do Not Collect

We want to be specific about this, because a lot of apps in this category collect far more than we do. Tapd does not collect:

• •Your location. Not GPS, not approximate location, not location inferred from your IP address.
• •Device identifiers. No advertising ID, no IDFA, no device fingerprint.
• •Crash logs or diagnostic telemetry from your device.
• •Contacts, photos, calendar, microphone, or camera data.
• •Browsing history or activity in other apps, beyond the preset list described in Section 3.
• •Biometric information.

We also do not use any third-party analytics, attribution, advertising, or crash reporting service. There is no Firebase, no Mixpanel, no Sentry, no advertising SDK, and no tracking pixel in the app.

6. Screen Time and Family Controls

Tapd uses Apple's Screen Time and Family Controls frameworks to block applications during a focus session.

Data from these frameworks never leaves your device. It is processed entirely on-device by iOS and is never transmitted to our servers, never stored by us, and never shared with anyone.

What we do store is your preset, meaning the list of app identifiers you chose to block, so your presets are available across sessions. We do not receive information from Apple about what you actually did on your device, what apps you opened, or how long you used them.

7. How We Use Your Information

We use the information described above to:

• •Create your account and sign you in using one-time codes sent to your phone.
• •Provide the Services, including running focus sessions, applying presets, and maintaining your session history.
• •Show you your own focus history, streaks, and statistics.
• •Operate group and leaderboard features where you have joined a group.
• •Show parents, guardians, coaches, advisors, and administrators the dashboard information described in Section 9.
• •Process purchases, deliver hardware, and send receipts, through Stripe.
• •Send you account and transactional messages, including verification codes, billing notices, and notices about changes to our terms.
• •Provide customer support.
• •Keep the Services secure, detect and prevent fraud and abuse, and investigate violations of our Terms of Service.
• •Comply with law and respond to lawful requests.

We do not use your information to train machine learning models, to build advertising profiles, or for any purpose unrelated to running Tapd.

8. Children and Minors

Tapd is designed to be used by children and teenagers, and we take that seriously.

9. Dashboards: Who Can See a User's Activity

Tapd includes dashboards for parents, guardians, coaches, advisors, and administrators. Where a user is connected to one of these people, that person can see a study log for that user, which shows:

• •The user's focus sessions
• •When each session started and ended
• •The tag and preset associated with each session, including any tag name the user entered
• •The focus quality rating the user assigned
• •Group participation and leaderboard standing, where applicable

This is the same information described in Sections 2 and 3, presented in a readable format. Dashboards do not show anything we have not already told you we collect. They do not show location, device activity outside of Tapd, or anything derived from Screen Time.

If you are a minor using Tapd, the adult connected to your account can see this information. If you are a parent, coach, or advisor, you are responsible for handling what you see appropriately.

10. Who We Share Information With

We share personal information only with the following:

• •Twilio Inc. Receives your phone number in order to deliver one-time verification codes and other account messages by SMS.
• •Stripe, Inc. Receives your email address, billing address, shipping address, and payment details in order to process payments and subscriptions. Stripe processes this as its own controller under its own privacy policy.
• •Amazon Web Services, Inc. Hosts our database and servers. All data is stored on AWS infrastructure located in the United States.
• •Apple Inc. Distributes the app. Apple may receive information related to your download and, where applicable, your device, under Apple's own privacy policy. Apple does not receive your Tapd session data from us.

We may also disclose information:

• •To comply with law, a subpoena, a court order, or a lawful government request.
• •To enforce our Terms of Service, or to investigate suspected fraud, abuse, or security incidents.
• •To protect the rights, safety, or property of Tapd, our users, or the public.
• •In connection with a merger, acquisition, financing, reorganization, or sale of assets. If that happens, we will notify you and the acquiring party will remain bound by this policy for information collected before the change, unless you agree otherwise.

We do not share personal information with advertisers, data brokers, or marketing platforms.

11. We Do Not Sell or Share Your Information

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act and similar state laws.

We have never done so, including in the twelve months preceding the date of this policy.

12. How Long We Keep Information

• •Account information, including your phone number, name, and email. Kept while your account is active. Deleted within 30 days after you delete your account.
• •Focus session records, tag names, and presets. Kept while your account is active so you can see your own history. Deleted within 30 days after you delete your account.
• •Payment and transaction records. Retained by Stripe under its own policies, and retained by us as required for tax, accounting, and audit purposes, generally 7 years.
• •Server logs. Retained for 30 days, then deleted automatically.
• •Support correspondence. Kept for 2 years after the issue is resolved.

Where we are required to keep information longer to comply with law, resolve disputes, or enforce our agreements, we will keep only what is necessary for that purpose.

13. How We Protect Information

Our database runs on an Amazon Web Services RDS instance with automatically rotating database credentials. Data is encrypted in transit. Access to production systems is limited to personnel who need it to operate the Services.

We use phone-based one-time codes rather than passwords, which removes the risk of password reuse and password database breaches.

No system is perfectly secure. If we become aware of a breach affecting your personal information, we will notify you and any regulator as required by applicable law.

14. Your Rights and Choices

Regardless of where you live, you can:

• •Access your information. See your account details and session history in the app.
• •Correct your information. Update your name and email in your account settings. To change the phone number on your account, contact us at team@usetapd.com.
• •Delete your account and information. Delete your account from within the app, or email team@usetapd.com.
• •Opt out of marketing messages. Reply STOP to any marketing SMS, or use the unsubscribe link in any marketing email. You cannot opt out of transactional messages such as verification codes and billing notices, because those are necessary to operate your account.

To make a request, email team@usetapd.com. We may need to verify your identity, usually by confirming control of the phone number on the account. We will respond within the time required by applicable law, generally 45 days.

We will not discriminate against you for exercising any of these rights.

15. State Privacy Rights

If you live in California, Colorado, Connecticut, Delaware, Iowa, Indiana, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, or in another state with a comprehensive privacy law, you may have the following rights:

• •The right to know what personal information we collect, use, and disclose
• •The right to access a copy of your personal information
• •The right to correct inaccurate personal information
• •The right to delete your personal information
• •The right to opt out of sale, sharing, or targeted advertising. As stated in Section 11, we do not sell or share personal information or use it for targeted advertising, so there is nothing to opt out of.
• •The right to opt out of profiling that produces legal or similarly significant effects. We do not engage in this.
• •The right not to be discriminated against for exercising your rights
• •The right to appeal a denied request. If we deny your request, you may appeal by replying to our response. If we deny your appeal, you may contact your state Attorney General.

You may use an authorized agent to make a request on your behalf. We will ask for proof of authorization.

To exercise any of these rights, email team@usetapd.com.

Categories of personal information we collect. Under California law, the categories are: identifiers (phone number, name, email address, IP address), commercial information (subscription and purchase records), internet or network activity (server logs), and, where you choose to enter them, geolocation-adjacent information in tag names you create. We collect these for the business purposes described in Section 7, from the sources described in Sections 2, 3, and 4, and disclose them only to the service providers listed in Section 10.

16. Institutional and School Accounts

Where a school, athletic department, tutoring center, or other institution subscribes to Tapd for its students or athletes, additional terms may apply.

Information associated with those accounts may be visible to coaches, advisors, or administrators at that institution as described in Section 9. The institution is responsible for obtaining any consent required by its own policies or by applicable education privacy laws before enrolling a student.

Where an institution is subject to the Family Educational Rights and Privacy Act or a state student privacy law, we will enter into a separate written agreement addressing our obligations. Contact team@usetapd.com to discuss.

17. Do Not Track and Global Privacy Control

There is still no uniform standard for Do Not Track browser signals, and we do not respond to them.

Because we do not sell or share personal information or use it for targeted advertising, a Global Privacy Control signal does not change how we handle your information.

18. Changes to This Policy

We may update this policy. When we do, we will update the date and version at the top.

If we make a material change, we will notify you by email to the address on your account, by SMS to the phone number on your account, or by prominent notice in the app before the change takes effect.

If a change materially affects information we have already collected from a child under 13, we will obtain new verifiable parental consent before applying it to that information.