Privacy Policy

Who this applies to

Three groups use tapitfindit: owners, who create an account and set up tags; buyers, who purchase physical NFC tags; and finders, who tap or scan a tag and may contact the owner. This policy covers all three. A person can be more than one of these.

Information we collect

From owners

• Account: your email address and a securely hashed password. If you enable two-factor authentication, an encrypted authenticator secret and hashed recovery codes.
• Profile and preferences: an optional display name and default phone number, notification settings, and default values you choose to prefill onto new tags.
• Tag details you enter: an item name, and optionally a phone number, email, address, a note, and an item photo. If you use Trips, your travel dates, flight numbers, and hotel name, address and phone. You choose which of these are shown publicly on the scan page; the rest stay private.
• Private contents: any items you record inside a tag (name, quantity, note, serial number, photo). Contents are never shown on the public scan page; they are visible only to you when signed in.

From buyers

• Order details: your name, email, phone (optional), and shipping address, and what you ordered. Card payments are processed by Stripe; we never receive or store your full card number (see “Payments” below).

From finders

• Scan events: the time of the scan, a coarse location derived from the network (country and, where available, city), and the browser user-agent. We do not collect precise location unless a finder explicitly chooses to share it.
• Messages: any message and optional reply contact a finder submits through the contact form, which we relay to the owner.
• In-app found reports: if you are a signed-in tapitfindit user and use the app to report that you found someone else’s tag, we share your account name and email with that item’s owner so they can arrange its return.

From your device and use of the service

• Security and sign-in logs: to protect accounts, we record sign-in events and similar security activity, including the IP address, an approximate location (country), and device or browser information. We use this to alert you to a sign-in from a new device and to detect and prevent abuse.
• Push tokens: if you use the iPhone app and allow notifications, a device push token so we can send you scan and found-item alerts.
• Newsletter: if you subscribe, your email address (double opt-in, with one-click unsubscribe in every email).
• Cookies and analytics: on our marketing site we use cookies for analytics and advertising measurement, but only after you accept them via our consent banner. Non-essential cookies are off by default. The dashboard and scan pages use a strictly-necessary session cookie and bot-protection (Cloudflare Turnstile) to keep accounts secure.

How we use it

• To operate your account and the tags and scan pages you create.
• To process tag orders and payments, and to ship your order.
• To notify you when one of your tags is scanned or found, and to relay finder messages to you.
• To secure accounts: authentication, two-factor, account lockout, rate limiting, bot protection, new-device alerts, and checking new passwords against known-breached password lists (using a privacy-preserving method that never sends us your password).
• To improve the product and measure marketing, where you have consented to analytics.
• To meet legal, tax and record-keeping obligations.

Where the GDPR applies, our lawful bases are: performance of a contract (running the service and fulfilling orders), legitimate interests (security, fraud prevention, and relaying messages), consent (analytics and advertising cookies), and legal obligation (financial records).

What finders see

A scan page shows only the fields the owner marked public. Private fields and tag contents are filtered out on our servers and are never sent to a finder’s device. The owner’s email is never shown to a finder; messages are relayed without revealing it.

Payments

Payments are processed by Stripe. When you pay, your card details are entered with and handled by Stripe under its own terms and privacy policy; we do not receive or store your full card number. We retain order records, your shipping details, and the Stripe customer and subscription identifiers needed to manage your plan and orders.

Service providers we share with

We do not sell personal information. We use a small set of providers to run the service, each only with the data they need:

• Cloudflare — hosting, database, file storage, content delivery, network-level coarse geolocation, and bot protection (Turnstile).
• Stripe — payment processing for plans and tag orders.
• Resend — sending transactional email (verification, password reset, scan, found-item and relay notifications, and newsletter confirmations).
• Apple Push Notification service — push notifications, if you use the iPhone app.
• Google (Analytics, Tag Manager and Google Ads) — website analytics and advertising measurement, only with your consent.

Some of these providers are based, or process data, outside Australia (including in the United States and the European Union). Where we transfer personal information overseas, we take reasonable steps to ensure it is handled consistently with this policy and applicable law. We may also disclose information where required by law, or to protect our rights, users, or the public.

How long we keep it

We keep account, tag and contents data while your account is active. Scan history is retained to show you activity. When you delete a tag, its fields, photos, contents and scans are deleted; when you delete your account, your tags, contents, photos, sessions and security logs are deleted and your tags stop resolving. Order and payment records are retained for the period required by tax and financial-record laws even after an account is closed. Backups are cycled out on a rolling basis.

Your rights and choices

• Access, correct, or delete your account, tags and contents at any time from your dashboard.
• Control which tag fields are public, and turn notifications on or off.
• Sign out of other devices, and review your active sessions, from your settings.
• Withdraw analytics consent at any time via “Cookie settings”, and unsubscribe from the newsletter from any email.
• Request a copy of your personal information, or make a privacy complaint, by contacting us (below). If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au, or, in the EU/UK, your local data protection authority.

Security

Passwords are hashed with a strong, salted key-derivation function and never stored in plain text. Two-factor secrets are encrypted at rest. Sessions can be individually revoked, and a password reset ends all existing sessions. All traffic is served over HTTPS, and access to owner data is scoped to the authenticated owner. No system is perfectly secure, but we take reasonable steps to protect your information and to notify you and the relevant authorities of any eligible data breach as required by law.

Children

tapitfindit is not directed to children under 16, and we do not knowingly collect their personal information. If you believe a child has provided us personal information, contact us and we will delete it.

Changes

We may update this policy from time to time. Material changes will be posted here with a new “last updated” date, and where appropriate we will notify you by email.

Contact

For privacy questions or requests, contact us at [email protected]. tapitfindit is operated by Spherify Pty Ltd (ABN 91 675 450 718), Australia.