Privacy Policy

1.Information we collect

Account information. When you create an account we collect your email address, display name, and sign-in credentials. Authentication is handled by our identity provider, Clerk; if you sign in with Apple or Google, we receive the basic profile information those providers share.

Collection & activity data. When you tap, scan, or claim a pin, we record which pin was linked to your account and when. Event check-ins record that your account tapped a specific reader at a participating event. Achievements, rewards, and promotion entries are stored with your account.

Camera & scanning. Some features use your camera to recognize pins. Camera frames are processed in the moment to identify the pin and are immediately discarded — they are never stored. The app requests camera permission only when you use these features.

Usage & device data. We collect app interaction events (screens viewed, features used), device type, OS version, and app version through our analytics provider, PostHog, and technical logs (including IP address and error diagnostics) needed to keep the Services reliable and secure.

Support communications. If you email us, we keep the correspondence so we can help you and improve the Services.

2.What we don't collect

• No precise location. We do not collect GPS or background location data. Tapping a pin or event reader records only the tap itself, not where your device is.
• No contacts, photos, or files beyond what you explicitly use in a feature.
• No advertising identifiers or third-party ad SDKs.
• No payment card details — purchases are processed entirely by Apple and Google.

3.How we use information

• Operate your account, collection, and pin experiences.
• Verify pin authenticity and prevent fraud and duplicate claims.
• Run events, achievements, rewards, and promotions you participate in (including administering giveaway entries where you enter).
• Understand aggregate usage to improve the app.
• Send service communications — claim confirmations, security notices, and support replies. Marketing messages are opt-in.
• Comply with legal obligations.

4.Service providers

We share information only with the processors that run the Services, each bound by their own data protection commitments:

• Clerk — account creation, authentication, and session management.
• PostHog — product analytics (usage events, device info).
• Render — cloud hosting for our backend and database.
• Better Stack — server log management and uptime monitoring.
• Apple App Store / Google Play — payment processing and app distribution.
• Anthropic (Claude) and OpenAI (ChatGPT) — power in-app conversational experiences such as DM with the Devil. Messages you type in those experiences are sent to these providers to generate responses; your account credentials and payment information are never shared with them.

We do not sell your personal information, and we do not share it with third parties for their own advertising.

5.Data retention

We keep your information for as long as your account is active. If you delete your account, personal information is deleted or de-identified within 30 days, except records we must retain for legal, security, or accounting purposes (for example, purchase records). Technical logs are retained for a short operational window and then deleted automatically.

6.Your rights & choices

• Access & portability — ask us for a copy of the personal information we hold about you.
• Correction — fix inaccurate account information in the app or by contacting us.
• Deletion — delete your account in-app (Me → Settings → Account → Delete Account) or see pintap.xyz/account-deletion for all options.
• Marketing opt-out — unsubscribe links are included in any marketing email.

To exercise any of these rights, email support@threadtap.xyz. Depending on where you live (for example the EEA, UK, or California), you may have additional rights under local law, and we honor them.

7.Children

The Services are not directed to children under 13, and we do not knowingly collect personal information from them. If you live in a region that sets a higher minimum age for consenting to data collection, you must meet that age to use the Services. If you believe a child has created an account, contact us and we will delete it.

8.Security

We use industry-standard safeguards: encryption in transit, scoped access controls, and signed pin identities that prevent counterfeiting. No system is perfectly secure, so please use a strong, unique password for your email account.

9.Changes to this policy

If we make material changes we will notify you in the app or by email before they take effect. The "Last updated" date above always reflects the current version.

10.Contact us

ThreadTap, Inc., 1000 Brickell Plz, Unit 4015, Miami, FL 33131. Email: support@threadtap.xyz.