Privacy policy.

The short version

TapGate is built to need as little data as possible to work. Opening your gate happens between your phone and the controller over Bluetooth — that exchange doesn't touch our servers.

Some things do need a server: sending a key to someone, ringing an intercom, showing a visitor your gate page. This page describes each of those honestly, including the parts that involve your location, your photos, your camera, your address book, and your notifications.

We only collect data we genuinely need, we tell you why, and we never sell it.

What we collect

Account basics: your phone number, used to sign you in via SMS one-time code. Optionally an email address if you set a recovery email so you can get back in if you change phone. Stored with our auth provider (Supabase) inside the EU.

Profile: a display name you choose so people you share access with see who they got the key from.

Gate pairings: the controller serial your phone is paired with, the gate's nickname, its timezone, and the keys you've sent or received. We store this so you can reinstall the app without losing your setup.

Recipient phone numbers: when you send a key or an invitation, the recipient's number is stored in full, in E.164 format, on the key record. It has to be — that number is what the recipient signs in with, and what the key is matched against. A hashed copy also travels inside the signed key token, but the stored copy is not hashed.

Activity logs: a record of opens, key shares, revocations, intercom rings, and account events on gates you own or have access to.

Technical records: IP address and browser user-agent when a visitor rings your intercom or opens a gate page, and IP address for rate limiting on our API. These are used to make abuse expensive, not to profile anyone.

Customer support: emails you send us, so we can reply and follow up.

Location

TapGate asks for location in exactly two situations, and never in the background. Background location is switched off at the build level on both iOS and Android, and our Bluetooth scanning is declared as never deriving location.

Pinning your gate (owners): when you tap "Set this location" in the app, we take a single foreground GPS reading and store it as the gate's coordinates, together with a radius you choose (100, 250 or 500 m). This records where the gate is, not where you are — it's stored on the gate, not on you. We reject readings less accurate than 50 m rather than save a bad pin. You have to be standing at the gate for this to be worth anything, which is why it's a deliberate button and not a silent capture. The activity log records that a pin was set and how accurate the reading was — never the coordinates themselves.

Checking a location-restricted key (visitors): if a key was issued with "only works at the gate" turned on, the visitor's browser is asked for its position when they press open. That reading is sent to our server, compared against the gate's coordinates, and discarded. It is never written to the database. If the check fails, the owner's log records only a coarse distance band (for example "over 1 km") — not the visitor's position.

Be clear-eyed about what this restriction is worth: browser location is supplied by the visitor's device and can be faked with a browser setting. It deters a forwarded link from working somewhere else; it is not a security boundary.

Your gate's coordinates leave our systems in one case: if you save a key to Google Wallet, we send the gate's nickname and coordinates to Google so the pass can surface near the gate and offer directions.

Photos and camera

Gate photo (owners): if you add a picture of your gate to the page visitors see, we read that one image from your photo library and upload it to private storage. We ask for photo-library permission only to open the picker — we never scan or index your library, and we can't see any picture you don't choose. The photo is shown to visitors through a short-lived signed link; the storage bucket itself is private. Replacing or removing the photo deletes the previous file.

Invitation artwork (hosts): artwork for an event invitation can come from three places. A pattern generated on our own server from the words you type. An image model — the text you type is sent to Google's Gemini image API, and no photo of yours is ever sent to it. Or an image you import yourself, which we store. All artwork lives in a private bucket and reaches a guest only composited into their own invitation.

Visitor photo (intercom): a visitor ringing your gate may optionally take a photo of themselves with their device camera, so you can see who is at the gate before you answer. It is a single still, captured in their browser at their explicit tap, stored in a private bucket, and shown to you on the incoming-call screen. The camera is not opened without that tap and nothing is captured continuously.

Camera and microphone permission on your own phone is requested only for intercom calls — so you can see and be heard during a call.

The intercom

Audio and video during an intercom call are peer-to-peer over WebRTC. We do not record, store, transcribe, or listen to any call. There is no recording feature and no stored media stream.

When two networks can't reach each other directly, the encrypted stream is relayed through a TURN server operated by Metered. Relayed traffic stays encrypted end-to-end, we don't hold the keys, and the relay retains nothing. Credentials for that relay are short-lived and minted per call.

What we do store for each ring, so your activity feed can show it: the name and reason the visitor typed, their optional photo, their IP address, their browser user-agent, and the connection-setup data the call needs. Session records are automatically deleted after 30 days. The durable entry that stays in your activity log afterwards carries no photo, IP address, or connection data.

If nobody answers, a visitor may leave a short written message — text only, up to 500 characters, once per ring, within 30 minutes. There is no voice or video voicemail.

Contacts

When you build a guest list for an event, you can open your device address book. If you allow it, the app reads names, phone numbers and email addresses on the device to show you a picker.

That read happens on your phone and stays there. We do not upload your address book, copy it to our servers, or keep a shadow copy of it. Nothing is synced, and permission is asked only at the moment you open the picker.

Only the people you actually select leave the device. For those guests we store the name, phone number and email address you picked, because that is what an invitation is sent to. Everyone you didn't select is forgotten the moment you close the picker.

You can skip contacts permission entirely and type or paste numbers instead. The feature works the same way.

Notifications

To ring your phone when someone is at your gate, we store a push token for each device you sign in on, along with the platform (iOS or Android) and a device name. A push token identifies a device installation, not you personally, and it is tied to your profile so it is deleted with your account.

Sending a notification means handing that token, plus the notification's title and body, to Expo's push service, which relays it to Apple (APNs) or Google (FCM) for delivery. Notification text can include a visitor's name and the reason they gave — which means it is visible on your lock screen, and passes through Apple or Google to get there.

Tokens that the platform reports as dead are removed automatically. Turning notifications off in your OS settings stops delivery; deleting your account removes the token.

Lawful basis (GDPR Art. 6)

Account, profile, pairing, key, and guest data: necessary for the performance of our contract with you (Art. 6(1)(b)) — you can't open a gate without us holding the keys, and you can't invite someone without an address to invite them at.

Gate coordinates, intercom records, and push tokens: also contract performance (Art. 6(1)(b)) — these are the features working, and each is switched on by a deliberate action on your part.

Visitor location checks: legitimate interest of the gate owner (Art. 6(1)(f)) in restricting a forwarded key, balanced by the fact that the reading is evaluated and discarded rather than stored.

Activity logs, IP addresses, and rate-limit records: legitimate interest (Art. 6(1)(f)) for security, abuse prevention, and giving an owner a truthful account of what happened at their gate.

Crash and error diagnostics: legitimate interest (Art. 6(1)(f)) in the app not being broken.

Customer support: legitimate interest (Art. 6(1)(f)) so we can answer your question.

What we don't collect

We never collect location in the background, and never track where you or your visitors go. The only coordinates we keep are the gate's.

We don't record intercom audio or video, and we don't have a way to listen to a call.

We don't upload your address book or your photo library.

We don't collect your home address, and we don't build advertising or behaviour profiles. There is no third-party ad tracking on tapgate.app.

We don't read the contents of messages sent from your own phone's Messages or WhatsApp app when you share a key that way.

Who we share it with

Infrastructure: Supabase (auth, database, file storage) and Vercel (web hosting and our image endpoints) process data on our behalf under GDPR-compliant Data Processing Agreements.

Notifications: Expo's push service, and through it Apple (APNs) and Google (FCM), receive push tokens and notification content in order to deliver it.

Messaging: Twilio sends the SMS one-time codes you sign in with, and sends invitation texts when you choose the SMS channel — which means the recipient's number and the message text reach Twilio. Resend sends invitation emails, receiving the recipient address and the email body.

Intercom relay: Metered operates the TURN relay used when a direct connection fails. It relays encrypted packets and stores no call content.

Artwork generation: Google's Gemini image API receives the text prompt you type when you ask for generated invitation artwork. No photo of yours is sent.

Google Wallet: if you save a key as a Wallet pass, Google receives the gate nickname and coordinates for that pass.

Diagnostics: Sentry receives crash reports and error traces from the app in production builds. We identify sessions with an anonymous id, never your profile id or phone number.

Payment processors (Stripe, when we add subscriptions) will receive whatever is strictly necessary to complete a transaction — we never see your full card details.

We don't share, sell, or transfer your data to advertisers, data brokers, or third parties for their own use.

How long we keep it

Account, profile, gates, keys, and guest lists: kept while your account is active; deleted within 30 days of account deletion.

Activity logs: the activity log is append-only by design — it is the record of who opened your gate, and an entry that could be quietly removed would be worth nothing. Entries are kept for the life of the gate and are not on an automatic expiry schedule. Deleting your account detaches your entries from you: the actor is set to null, so the gate keeps a truthful history without keeping your identity.

Intercom session records (name, reason, IP address, user-agent, connection data): 30 days, then automatic deletion.

Visitor link sessions: expire within 24 hours to 7 days depending on the link, and are deleted a day after expiry. Short links carrying a key token: deleted 7 days after expiry.

Rate-limit and failed-attempt records: 1 day.

Photos in storage — your gate photo, invitation artwork, and visitor intercom photos: kept in private buckets. Gate photos are deleted when you replace or remove them. Visitor intercom photos and invitation artwork are not currently on an automatic deletion schedule; email us and we will delete them.

Support emails: 2 years, in case you come back with a follow-up question.

Invoices: 10 years (French accounting law).

Your rights

Under GDPR you can request a copy of what we hold about you, ask us to correct or delete it, restrict processing, object to processing, or port it elsewhere. Email privacy@tapgate.app and we'll respond within 30 days.

You can delete your account directly from Settings → Account in the mobile app. This removes your account and everything that hangs off it — profile, gate pairings, keys you hold, push tokens, guest lists — and revokes every key you've issued. Entries in a gate's activity log survive, with your identity detached from them.

If you are a visitor rather than an account holder — you rang someone's intercom or opened a gate from a link — you have the same rights over what that produced. Email privacy@tapgate.app with roughly when and which gate, and we'll find and delete it.

You also have the right to lodge a complaint with your national supervisory authority (in France: the CNIL, www.cnil.fr).

Cookies

tapgate.app uses strictly-necessary cookies only (session, auth). No advertising or third-party tracking cookies. We don't use third-party analytics that profile visitors.

Changes

If we update this policy materially we'll notify account holders by SMS or email (whichever you have set up) and update the date at the top. Minor clarifications happen in place.

Contact

Email privacy@tapgate.app for any privacy question or to exercise your rights. We're ISN Security Networks, a family-run business operating under EU law. Our full postal address is on the purchase invoice and the Terms page.