Privacy Policy
This policy describes the data handled by Tapical’s initial website and account service. Contact support@tapical.us with privacy questions.
Information we collect
We store account email, name, identifiers, account status, role and sign-in timestamps. If you set a password, we store only a salted scrypt hash, never the plaintext password. We store your card groups and destinations, authentication tokens in hashed form, and administrative change records. Google sign-in provides a verified email and may provide a name.
How we use information
We use account data to sign you in, display your account, and provide support. Essential cookies maintain your session and protect forms. We do not use advertising cookies. Card-group tap records contain coarse location, browser/device category, referrer hostname and time; we do not store raw IP addresses in those records.
Service providers
Cloudflare hosts the application and structured account data in D1. Google processes Google sign-in when selected. The site also loads fonts from Google Fonts, which receives ordinary connection information such as your IP address. Our configured email delivery provider sends verification messages. Shopify operates the separate shop, cart and checkout, including shipping, billing and payment processing. Tapical stores only minimal order references for card fulfillment, not payment-card details. These providers process information under their own applicable terms and policies.
Retention and your choices
Verification challenges expire after 10 minutes and sessions after 30 days. Expired authentication records are cleaned during authentication activity. Account records remain until deletion is requested or they are no longer needed. Contact support@tapical.us to request access, correction, or deletion; applicable legal obligations may affect what can be deleted.
External destinations
A Tapical link may redirect to a website operated by someone else. That destination has its own privacy practices. Do not include sensitive personal information in a public destination URL.
Updates
We will update this page when the service or its data practices change, including before introducing Tapical Secure authentication. Secure is in development and is not currently collecting card authentication data.