Privacy Policy

TapAura exists to share the details you choose to share, with the people you tap. We collect what the product needs to work, we never sell your data, we don't run ads, and you can delete everything yourself in Settings → Account at any time.

Account: your email address, a password (stored only as a salted hash), and your first and last name.

Profile: everything you add to your card — job title, company, bio, location text, photo, contact channels, social/payment links, and appearance choices. Your public card shows exactly the fields you fill in, and only those with visibility switched on.

Analytics: when a card or band is opened we record the event type (tap, save, exchange), the source (NFC, QR, or link), a timestamp, and — for new contacts — the approximate city and region derived from the visitor's network connection. We never request precise GPS location.

Website visits: we count visits to tapaura.io pages with Vercel Web Analytics: the page, the site that sent you, your country, and your browser and device type. It uses no cookies, and private links (claim and join links) are masked before anything is counted.

Contacts you receive: when someone exchanges info through your card, we store their name, a phone number or an email (or both), and an optional message. If they give a phone number, we also store the exact texting consent wording they agreed to. That data belongs to the conversation between you and them; we process it to show it to you and to send both sides the notification emails.

A page for people who share an email: when someone shares an email, we create a basic TapAura page with their name so they can claim it. They can remove it with one tap right after sharing. Unclaimed pages are turned off after 30 days and deleted after 90.

On the visitor's phone: the card page remembers, on the visitor's own phone, whether they've already shared their info with that card, so it doesn't ask again. That note never leaves their phone.

We don't sell or rent personal data. We don't show ads or share data with ad networks. We don't read your contacts, camera roll, or anything on your device. Cookies are used only to keep you signed in — there are no tracking or advertising cookies.

Supabase hosts our database and authentication (US region). Vercel serves the application and counts website visits. Resend delivers transactional email from no-reply@tapaura.io. Each processes data solely to provide the service.

Edit or remove any profile field at any time. Every contact channel has a visibility toggle. Deleting your account (Settings → Account) permanently erases your profile, digital card, contacts, analytics, and photos; physical bands reset to factory state. To exercise any data right by email, write to info@tapaura.io.

TapAura is for people 13 and older and is not directed at children.

If this policy changes materially we'll note the new effective date here and, for significant changes, email account holders.

TapAura is operated by Colossal Enterprises LLC. For any privacy question or data request, reach the operator at: