Privacy Policy

TapAura exists to share the details you choose to share, with the people you tap. We collect what the product needs to work, we never sell your data, we don't run ads, and you can delete everything yourself in Settings → Account at any time.

Account: your email address, a password (stored only as a salted hash), and your first and last name.

Profile: everything you add to your card — job title, company, bio, location text, photo, contact channels, social/payment links, and appearance choices. Your public card shows exactly the fields you fill in, and only those with visibility switched on.

Analytics: when a card or band is opened we record the event type (tap, save, exchange), the source (NFC, QR, or link), a timestamp, and — for new contacts — the approximate city and region derived from the visitor's network connection. We never request precise GPS location.

Contacts you receive: when someone exchanges info through your card, we store what they typed (name, phone, optional email and message) along with the exact consent wording they agreed to. That data belongs to the conversation between you and them; we process it to show it to you and to send both sides the notification emails.

We don't sell or rent personal data. We don't show ads or share data with ad networks. We don't read your contacts, camera roll, or anything on your device. Cookies are used only to keep you signed in — there are no tracking or advertising cookies.

Supabase hosts our database and authentication (US region). Vercel serves the application. Resend delivers transactional email from no-reply@tapaura.io. Each processes data solely to provide the service.

Edit or remove any profile field at any time. Every contact channel has a visibility toggle. Deleting your account (Settings → Account) permanently erases your profile, digital card, contacts, analytics, and photos; physical bands reset to factory state. To exercise any data right by email, write to support@tapaura.io.

TapAura is for people 13 and older and is not directed at children.

If this policy changes materially we'll note the new effective date here and, for significant changes, email account holders.