Privacy

The privacy policy is published in German, and the German version is the one that counts. Here is a short summary in English. Read the German privacy policy

In short

TapNu shows no ads, uses no trackers and sells no data. Page statistics work without cookies and without storing IP addresses.

Where your data is processed

TapNu runs on our own server at Hetzner in Germany, behind Cloudflare, which protects it from attacks. E-mails go through our own mail server and are delivered by Amazon SES in Stockholm. Cloudflare and Amazon may transfer data to the USA under the EU-US Data Privacy Framework.

Visiting a TapNu page

We count views and clicks with the page, the clicked link, the referring domain, the device type, the country and a campaign. Instead of your IP address we store a value made from it with a random salt that is replaced every day, so we cannot recognise you the next day. YouTube and Spotify only load after you click them.

Your account

We store your name, e-mail address, page name, language, a hash of your password, passkeys, authenticator data, hashed backup codes, active sessions, your page and your uploads. Sign-ins are logged for your security and deleted after 180 days. We only use cookies that TapNu needs to work.

Sign in with Google

Signing in with Google is optional. Google Ireland Limited learns that you sign in to TapNu and processes your data under its own privacy policy. TapNu only requests the basic scopes openid, email and profile. We receive your Google ID, name, e-mail address, whether Google verified it, and the address of your profile picture, and use them only to create your account and recognise you at the next sign-in. We do not access Gmail, contacts, calendar, Drive or any other data in your Google account. We do not store the tokens Google issues. We never share, sell or use Google data for advertising. You can remove the connection at myaccount.google.com/connections, and deleting your TapNu account deletes the data we received from Google. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Bot protection and payment

Sign-up, password reset and the report form are protected by Cloudflare Turnstile, which receives your IP address and browser details. If you buy TapNu Pro, Stripe Payments Europe in Ireland sells it to you, collects VAT and processes your payment details under its own privacy policy. We only receive a customer number, the subscription status and the end of the paid period.

Fan lists on TapNu pages

Some pages offer a fan list. If you leave your e-mail address, we send you a link to confirm, and only then are you on the list. We store your address, the language, the consent text you saw and the times of sign-up and confirmation, but not your IP address. The owner of the page is responsible for the list and can export confirmed addresses to send you news. TapNu stores the list on their behalf (Art. 28 GDPR) and only sends the confirmation e-mail. The legal basis is your consent, which you can withdraw at any time. The link in the confirmation e-mail deletes your entry at once, unconfirmed entries are deleted after 48 hours, and the list goes when the page is deleted.

Deleting your data

To delete your account, write to [email protected] from your address. We delete account, page, media and statistics within 30 days. Encrypted daily backups of the database and media, on our server and at Cloudflare R2 in Western Europe, are deleted after 14 days at the latest.

Your rights

You have the right to access, correction, deletion, restriction, data portability and objection. Write to [email protected]. You can also complain to a data protection authority.