tapwardTapward helps businesses manage NFC cards and understand when their links are opened. Our scan analytics record activity on a card, not a customer’s identity or the contents of their reviews.
Who this policy covers
This policy covers the Tapward iPhone and Android apps, our websites and API, and visits through Tapward card and access-request links. The operator and contact details appear at the end of this policy.
A business that owns a card controls its destination and who may view its scan statistics. A website you open through a card, including Google, has its own privacy practices. This policy does not cover that website’s collection of information.
Information we collect
- Account information: your Apple or Google sign-in account identifier, display name, Tapward account ID, account role, timezone, and notification preferences. We process authentication credentials to maintain your session. We do not receive your Apple or Google password.
- Card and sharing information: card IDs and NFC chip serials, names you give cards, business names and destination links, ownership and membership records, and access requests and their status. Your display name is visible to people who manage or share the relevant card.
- Scan activity: the card opened, the time it was opened, a broad device category (iPhone/iPad, Android, or other), and the type of destination. We derive the device category from the browser’s user-agent information; we do not save the full user-agent in scan records. A scan record does not contain the visitor’s name, email address, raw IP address, or review text.
- Notifications: an Apple Push Notification service device token on iPhone, or a Firebase Cloud Messaging token and Firebase installation identifier on Android if you enable notifications. Firebase may also process device and SDK metadata needed to operate its messaging service. This allows us to send access-request or weekly-summary notifications according to your preferences.
- Business searches: the business name or location you type into search is sent to Google Places to find matching businesses and review links. Search does not request your phone’s precise location.
- Support and service operation: information you choose to send when contacting us, and technical request information needed to serve and protect the service. Our application request logs include a request ID, method, response status, and duration. Our hosting, network, and security providers may process IP addresses and other connection information even though we do not store IP addresses in scan analytics.
How we use information
We use this information to sign you in, maintain your account, prepare and link cards, send visitors to the destination you select, display statistics, manage access, deliver requested notifications, answer support requests, prevent misuse, and operate and troubleshoot Tapward.
Tapward does not include advertising SDKs or cross-app advertising tracking. We do not sell personal information or use it for targeted advertising. We do not collect the content of reviews submitted on another service, and a recorded scan does not tell us whether a visitor completed a review.
Storage and retention
Account, card, and sharing records are retained while needed to provide the service. Individual scan records are scheduled for deletion after 90 days. Aggregated daily and interval scan counts remain for the lifetime of the card’s current ownership, unless the owner unlinks the card or deletes their account.
Access-request links expire after seven days; an expired link does not immediately delete the associated request record. App Review demo accounts are scheduled for removal after seven days. Expired sign-in session records are removed by routine cleanup.
Deleting your account removes your account data, memberships, access requests, device notification tokens, and sign-in sessions from the active service. Cards you own are reset: their destinations and scan history are cleared and linked users lose access. The physical card’s inventory ID, serial, and preparation status remain so it can be linked again right away. Cards owned by someone else and their scan history remain when you leave or delete your account.
If Apple is temporarily unavailable, an encrypted credential needed to revoke Apple authorization is retained until revocation succeeds, separately from your deleted account. Limited copies may remain in backups or operational records until they expire or are no longer needed for recovery, security, or legal obligations. We do not promise that deleting the app deletes your account.
Your choices and rights
Delete your account in Tapward under Settings → Account → Delete account, or request deletion at https://tapward.app/delete-account. You can also leave a shared card, remove members from a card you own, or turn off new access requests in Tag settings. Unlinking an owned card resets its destination and history and removes every member.
Change notification preferences in Tapward, or disable notifications for Tapward in your phone’s system Settings. You can change your appearance preferences on your device. Signing out ends the current session; it does not delete your account.
Depending on where you live, you may have rights to access, correct, receive a copy of, delete, or restrict or object to certain uses of personal information, withdraw consent where applicable, or complain to your local privacy authority. Contact us to exercise a right or ask about retention. We may need to verify that the request is yours. Applicable law determines the scope of these rights and any exceptions.
Google Maps services
Business search uses Google Maps Platform. Your typed query is shared with Google to return matching businesses. Google’s Privacy Policy explains its handling of that information. Google Maps content and services are subject to Google’s terms.
On your device and on the web
The app stores sign-in credentials and pending share links in the iPhone Keychain or encrypted Android storage protected by Android Keystore. Appearance preferences use local app storage. NFC access is used to read or prepare compatible cards; it is not continuous location tracking.
These public pages do not use advertising scripts, third-party analytics scripts, or application cookies. Network and security providers may use their own security mechanisms. Destination websites have their own cookies and storage policies. Tapward does not track your activity across unrelated websites for advertising and does not change its data handling in response to a browser’s Do Not Track signal.
Security
Tapward uses HTTPS, authenticated account access, owner/member permissions, and encrypted storage for Apple credentials. No system can guarantee complete security. Keep your Apple or Google account and device secure, and only approve people you intend to give access to your card’s statistics.
Children
Tapward is a business-management service and is not directed to children under 13. If you believe a child has provided personal information to Tapward, contact us so we can investigate and address it.
Changes to this policy
We may update this policy as Tapward or its data practices change. We will update the date on this page and provide additional notice or request consent where applicable law requires it.
Let’s talk
Contact Tapward
Tapward is operated by Tapward, based in California, United States.
[email protected]For support, privacy requests, or questions about these terms.