Privacy Policy

1. Information We Collect

Account information

When you create a TapIt account, we collect information necessary to create and operate your account, including:

• your email address;
• your display name;
• your username;
• authentication credentials;
• a unique account identifier; and
• account and profile creation information.

Passwords are handled through our authentication provider, Supabase. TapIt does not store your password in its public application database.

Fitness activity and check-in information

When you use TapIt, we may process and store information including:

• completed check-ins;
• the TapIt location associated with a check-in;
• the NFC tag associated with a check-in;
• check-in date and time;
• points earned;
• weekly fitness goals;
• weekly goal progress and completions;
• bonuses;
• current and previous streaks; and
• statistics derived from this activity.

This information is used to operate TapIt's check-in, points, goal, streak, leaderboard, and recap features.

Social information

If you use TapIt's social features, we process information about:

• friend requests;
• accepted friendships; and
• fitness statistics shared with accepted friends.

Location information

Some TapIt locations may require device location verification to confirm that you are physically near the location when checking in.

When location verification is required, TapIt may request your device's:

• latitude;
• longitude; and
• estimated location accuracy.

This information is requested only when you intentionally attempt a check-in at a location requiring verification.

Your device location is used temporarily to calculate whether you are close enough to the TapIt location. TapIt does not intentionally store your device latitude, longitude, accuracy, or calculated distance in its application database.

The configured coordinates and verification radius of TapIt venues are stored separately as venue information.

If you deny location permission, you may be unable to complete a check-in at locations requiring location verification.

Technical information

Our infrastructure providers may automatically process technical information necessary to provide and secure the service, which may include:

• IP address;
• browser and device information;
• request timestamps;
• requested URLs;
• authentication/session information; and
• diagnostic or security logs.

The exact information and retention periods may depend on the infrastructure provider.

Website analytics

TapIt uses Vercel Web Analytics to understand aggregate website usage, such as page views, traffic sources and referrers, approximate country or region, browser, operating system, and device-related information. TapIt does not use this analytics feature for advertising or cross-site tracking.

2. Information We Do Not Currently Collect

TapIt does not currently collect:

• your legal name;
• date of birth;
• phone number;
• postal address;
• payment or banking information;
• medical records or diagnoses;
• Apple Health, Google Fit, or wearable health data;
• contact-book data;
• photos or file uploads;
• private messages;
• biometric identifiers;
• advertising identifiers; or
• persistent device-location history.

TapIt does process fitness-related activity, such as attendance, goals, and streaks. This information can reveal patterns about your fitness activity even though TapIt does not collect medical records.

3. How We Use Information

We use personal information to:

• create and authenticate accounts;
• maintain user profiles;
• operate TapIt check-ins;
• verify proximity to participating locations when required;
• prevent duplicate, fraudulent, or abusive check-ins;
• award points and bonuses;
• calculate weekly goals, progress, and streaks;
• provide friend functionality;
• operate leaderboards;
• generate weekly recaps;
• maintain security;
• investigate technical problems or abuse; and
• operate and improve the reliability of TapIt.

We do not currently use personal information for targeted advertising.

We do not sell personal information.

4. Social Features and Visibility

TapIt includes social and leaderboard functionality.

Your display name, username, and total points may be visible to other authenticated TapIt users through features such as leaderboards and user search.

Accepted friends may additionally see limited fitness-related information such as:

• weekly goal;
• weekly progress;
• whether a goal was completed;
• current streak;
• best streak; and
• weekly recap information.

Your email address and raw check-in history are not displayed to other users through these features.

TapIt's General leaderboard includes TapIt profiles globally and does not independently verify university affiliation.

5. Cookies and Authentication

TapIt uses essential authentication cookies provided through Supabase to keep you signed in and protect authenticated areas of the service.

TapIt does not use advertising cookies, tracking pixels, device fingerprinting, or analytics for cross-site tracking. This implementation of Vercel Web Analytics does not use analytics cookies.

Essential authentication cookies are necessary for the service to function.

6. Service Providers

Supabase

Supabase provides authentication and database infrastructure. Information processed through Supabase may include account information, authentication data, profiles, points, check-ins, goals, friendships, and temporary location-verification inputs.

Vercel

Vercel acts as TapIt's infrastructure and analytics service provider. It processes web requests required to provide the application and provides the aggregate website-usage information described above. This processing may include IP addresses, request metadata, and information transmitted through server requests.

Device and browser location services

When you authorize location verification, your browser and operating system may use their own location services. Their processing of location information is also governed by the policies applicable to those services.

We may change infrastructure providers as TapIt develops. We will update this Policy where appropriate if those changes materially affect how personal information is handled.

7. Data Retention

We retain account and activity information for as long as reasonably necessary to operate your account and provide TapIt's features, unless a longer retention period is required or permitted by law.

Some historical information, such as check-ins and weekly goals, may be retained while your account exists because it is necessary to calculate points, progress, streaks, and historical statistics.

When an account is deleted, TapIt will delete or cause the deletion of personal information associated with that account from its active application database, subject to information that must be retained for legitimate security, legal, fraud-prevention, or compliance purposes.

Information may remain temporarily in backups, security logs, or infrastructure systems according to the retention practices of our service providers before being deleted or overwritten.

We aim not to retain personal information longer than necessary for the purposes for which it was collected.

8. Account Deletion

You may delete your TapIt account through the account settings or contact us at quentin.canaguier@mail.mcgill.ca.

Deleting your account is intended to permanently remove the TapIt profile and associated application data, including check-ins, weekly goals and completions, friendships, and friend requests from the active application database.

Deletion may not immediately remove information contained in temporary backups, security records, or infrastructure logs.

Account deletion is irreversible.

9. Access and Correction

You may request access to personal information TapIt holds about you or request correction of inaccurate information by contacting quentin.canaguier@mail.mcgill.ca.

We may need to verify your identity before processing a privacy request.

Applicable privacy laws may provide additional rights or exceptions depending on your circumstances.

10. Security

We use technical and organizational safeguards designed to protect personal information.

Current measures include authenticated access controls, database Row Level Security, restricted database operations, secure server-side functions, authentication checks, and restrictions on direct modification of check-ins and points.

However, no online service can guarantee absolute security.

11. Children and Age Requirement

TapIt is intended for users 16 years of age or older.

You may not create or use a TapIt account if you are under 16.

12. Changes to This Policy

We may update this Privacy Policy as TapIt develops, including when we add new features or change how information is processed.

If changes materially affect how personal information is handled, we will take reasonable steps to inform users as appropriate.

The effective date at the top of this Policy indicates when the current version took effect.

13. Contact

For privacy questions, requests, complaints, account deletion requests, or concerns regarding this Policy, contact: