Privacy Policy

Effective October 31, 2026. Last changed October 31, 2026.

This policy covers Tapkeep: the Tapkeep app for iPhone and Android, the card builder at tapkeep.me, and the card pages Tapkeep publishes for its users. It says what we collect, why, how long we keep it, and what you can do about it. The tapkeep.me website's own pages (the waitlist and Book a demo) have a separate policy at tapkeep.me/privacy.

The short version. We keep what Tapkeep needs to work and to stay safe. We do not sell your information, we show no ads, and we do not track you across other apps or websites. The people who open a card are counted, not followed.

Who we are

Tapkeep is run by TAPKEEP LLC, 5225 Trents Pl, Baton Rouge, LA 70817, USA, which is responsible for the information described here. Write to privacy@tapkeep.me about anything in this policy.

If you have a Tapkeep account

Your account. Your email address, to sign you in and to write to you about your account. Your password is never stored as you typed it, only as a scrambled value that cannot be turned back into it. When you sign up or reset your password, we email you a code. On the website, one cookie keeps you signed in for 30 days. In the app, a sign-in key is kept in your phone's secure storage on that phone only.

Your cards. Everything you put on a card: your name, title, company, phone, email, website, socials, buttons, testimonials, pictures, video and design. A draft is private. A published card is a public web page that anyone with its link, QR code or Tapkeep NFC card can open, and search engines such as Google can list it. On a paid plan, you can ask search engines not to list a card in its settings. On any plan, taking a card offline takes its page off the web.

Tapkeep Search. A published card also appears in Tapkeep Search, so people can find it by anything it shows, such as your name, company, title, phone number or email, or by job and city if you chose them. Search shows your name, title, company, photo, the city you chose and the card's score, never your email or phone, but someone who already has your phone number or email can use it to find your card. A phone, email or social link you hide on your card is not searched. You can hide a card from Tapkeep Search at any time, and it leaves at once.

Pictures. The app saves each photo again on your phone before it is uploaded, which removes the location and camera details a phone stores inside a photo.

Your contacts. Tapkeep keeps the people you collect: details someone shared through your card, cards you scanned, and the notes, dates and follow-ups you add. They are other people's details, kept for you to use. The app never reads your phone's own contacts; Save to contacts opens your phone's own form.

Your time zone, taken from the phone or computer that opened Tapkeep most recently, so follow-up days and your card's counts fall on your days.

Scanning a paper card. The photo of the card and the text on it are read on your phone (by Apple's Vision on iPhone and Google's ML Kit on Android). The photo never leaves your phone. Only the details you choose to keep are saved to your contacts.

Searching. When you search, what you type and the city or position you search near are used to answer and then discarded. To stop overuse, we count how many searches an account makes in an hour, under a scrambled form of your email, and that count is deleted within about two hours. A vote you give a card is kept with your email so you can change it; others see only the card's total score.

Location. The app asks for your location only when you use "cards near you" in Search, and only if you allow it. On Android it asks only for an approximate location. On either phone, the app rounds your position on the phone to a grid of about 3 kilometers before sending it. Our server uses it to find the nearest city and keeps nothing; the city is kept on your phone. You can type a city instead.

Tapkeep NFC cards. When you set up a Tapkeep NFC card, the app writes your card's link to the chip and locks it. We keep the chip's code, which card it opens, and the password that locks it.

Wallet passes. Tapkeep can make an Apple Wallet pass or a Google Wallet pass from your card. For Google Wallet, your card's details are sent to Google when you tap Add to Google Wallet, and again when you change the card.

Messages to us. When you use Message us, your message and your email address are sent to our support mailbox so we can reply. They are not stored in Tapkeep's database.

Purchases. Plans are bought on the website, not in the app. Stripe takes the payment; we send it your email address and our own reference for the order, and it handles your card details under its own privacy policy. We never see your card number. We keep what you bought, when, and Stripe's references for it.

A security log. When you do something that matters to your account's safety, such as signing in or failing to, asking for a sign-up or reset code, setting a password, publishing, taking offline or deleting a card, making a link or QR code, downloading a copy of your data, or sending us a message, we record the email address used, your internet connection's address (IP address) and the name of your browser or app. We use this log to keep accounts secure and to stop fraud and abuse, and we delete each entry after 90 days.

Other checks. Before a sign-in, sign-up or reset goes through, Cloudflare Turnstile may check that a person is asking, not a program; it sees your connection's address and details of your browser. When you publish a card or make a short link, and once a night after that, we may check the links on it against Google Web Risk's list of harmful sites; Google sees the links, not who made them. If you ask for a button's picture from a linked website, our server fetches that page; it sends nothing about you.

Emails we send you. Sign-up and reset codes, a daily note when your card has new reviews, and anything you ask us to send to yourself, such as your email signature.

What stays on your device. The app keeps a copy of your card and your signed-in state on your phone so it opens quickly and works offline. The website's builder keeps your drafts and the email you last signed in with in your browser's storage on that computer, so you do not lose work. Clearing the app's data, or your browser's site data, removes them.

App updates. Each time the app opens, it asks Expo, the service that delivers our app updates, whether a new version is ready. It sends a random number made for that installation, the app's version and the kind of phone system. Expo also sees your connection's address. If an update ever fails to start, the error message is sent to Expo so the app can recover. On Android, Google's ML Kit, which reads scanned cards, may send Google information about how ML Kit itself is working, such as its performance; it never sends the card's picture or text.

What the app asks permission for

The app asks for each of these only when you use the feature that needs it, and you can say no. Everything else in the app still works.

• Camera: to scan a paper card and to take a photo for your card.
• Location: for "cards near you" in Search, as described above.
• NFC: to set up a Tapkeep NFC card.
• Contacts (iPhone): only when you save a person to your phone's contacts. The app never reads them.

Choosing a picture for your card needs no permission: your phone's own picker gives the app only the pictures you pick.

If you open someone's card

Counting. We count a card's views, button taps, saves, shares and contact submissions so its owner can see how the card is used. Each count holds the card, the kind of action, the button's label and the time. It holds no IP address, no cookie, no device identifier and no details of your browser. Individual counts are combined into totals and deleted after 90 days. The owner sees totals, never a list of visitors. A click on a Tapkeep short link is counted with its time and nothing about you, for as long as the link exists.

Do Not Track and Global Privacy Control. If your browser sends either signal, we do not count your visit, your taps or your clicks at all.

Sharing your details with a card's owner. If you fill in a card's form, your name, your email or phone, your note and your reason go to the card's owner, who keeps them among their contacts. If the owner has connected their own system to their card, Tapkeep also sends your details there. The owner decides how to use what you shared; we hold it for them. We keep what you shared, and the notice you were shown, until the owner deletes it, the card or their account. If you arrived through the owner's Tapkeep QR code, the owner can see that too. We do not email you, and we do not use your details for anything of our own. To have them removed, ask the card's owner, or write to us.

Reviews. If you write a review, we ask for your name, your email, stars and your words. We email you a code to confirm the review, then a link you can use to take it down at any time. Your email is never shown to anyone, the card's owner included. We keep it as long as the review's card exists. A review never confirmed is deleted a week after its code expires. To stop floods of reviews, we keep a scrambled form of your connection's address for one day.

Adding a card to your wallet. If the owner allows it, you can add their card to Apple Wallet or Google Wallet. With Apple Wallet, your device registers for updates: we keep the pass's device identifier and a push address from Apple, so the pass changes when the owner changes their card. They are deleted when you remove the pass, when Apple tells us the device is gone, or when the card is deleted. With Google Wallet, Google receives the owner's card details, not yours.

Reporting a card. If you report a card, we keep your report, your email if you gave one, and your connection's address. Cloudflare Turnstile may first check that a person is sending it. Reports are emailed to our abuse mailbox without your address. We clear the address after 90 days and keep the report.

Cookies and other companies. The only cookie Tapkeep sets is the one that keeps an account signed in on the website. Card pages set none. They store nothing in your browser, and their fonts and code come from Tapkeep. A card's owner may show a video, a song, a booking page, a form, a document or a post from another service on their card. That service is not contacted until you tap it; once you do, it loads inside the card, and its own privacy policy applies to it, including any cookies it sets. A picture or video the owner links from another website loads from that website when you open the card. When you tap a link on a card, the site you go to can see that you came from Tapkeep.

Tapkeep Search on the website. What you type is used to answer and then discarded. To stop overuse we count searches from your connection in an hour, under a scrambled form of its address, and delete the count within about two hours. To sort cards near you, we use the approximate location Cloudflare gives for your connection, without storing it.

Who handles your information

• Cloudflare hosts Tapkeep, stores its data and files, sends its email, runs the person check, and keeps records of the requests our servers answer (such as the connection's address, the page asked for and the browser's name) to keep Tapkeep running and safe.
• Google Workspace holds our support and privacy mailboxes.
• Stripe takes payments made on the website.
• Expo delivers app updates.
• Google checks links (Web Risk), makes Google Wallet passes, and provides ML Kit in the Android app.
• Apple delivers updates to Apple Wallet passes.

Each of these companies handles information only to provide its service to us, under its terms with us. We do not sell your information, share it for advertising, or give it to anyone for their own marketing. In the words of California law, we do not "sell" or "share" personal information. The app has no advertising or analytics code and does not use your phone's advertising identifier.

These companies may store and handle information in the United States and in other countries. When information about someone in the European Union or the United Kingdom leaves it, they use the safeguards the law provides for that.

We may review cards and links, by automated checks and by a person, to enforce our Acceptable Use Policy. We report sexual content involving minors to the National Center for Missing and Exploited Children, as the law requires. We disclose information to authorities only when the law requires it, and we tell you when we are allowed to.

How long we keep it

Your choices and rights

• Change or delete what you made. Edit or delete a card, take it offline, hide it from Tapkeep Search (and, on a paid plan, from search engines), and delete any contact, all from the app or the website.
• Get a copy. Download a copy of your account's data from the app (More) or the website (your account), as one file.
• Delete your account. In the app, go to More, then Delete my account; on the website, use Delete my account in your account; or write to privacy@tapkeep.me. Our account deletion page sets out each way. Deleting your account deletes your cards, their contacts and reviews, your pictures, links, codes and votes. If something still depends on your account, such as a plan that renews or a company you own, we tell you what to settle first. We keep records of purchases for our accounts, without your email address; reports you filed, without your email; and the security log until its entries reach 90 days. Deleted information can stay in our backups for up to 30 days. Stripe keeps its own records of your payments.
• Ask us. Write to privacy@tapkeep.me to ask what we hold about you, to correct it, or to delete it. We answer within 30 days. Using these rights never costs you anything or changes how we treat you.
• If you live in the European Union or the United Kingdom, you also have the right to have your information restricted, to receive it in a form you can take elsewhere, to object to how we use it, and to complain to your data protection authority. We use your account, cards and contacts to provide Tapkeep to you, your location only with your permission, and the security log, the person check and the link checks because keeping Tapkeep safe is in our legitimate interest.

Security

Tapkeep's app and website talk to our servers only over encrypted connections. Passwords are stored only in scrambled form, and sign-in keys are stored on our servers only in scrambled form. No system is perfectly secure; if a breach affects your information, we will tell you as the law requires.

Children

Tapkeep accounts are for people 18 and over. We do not knowingly collect information from children under 13, and we do not knowingly keep an account of anyone under 18. If you think we hold a child's information, for example from a card's form or a review, write to privacy@tapkeep.me and we will delete it.

Changes to this policy

When we change this policy, we post the new version here with a new date. If a change affects how we use information you already gave us, we tell you in the app or by email before it applies.