TAPP Privacy Policy

Last updated: 14 October 2026

TAPP is a tap-based game with global leaderboards. This policy explains what the app and tapptheworld.com collect, why, who else sees it, how long it is kept and how to delete it. It describes TAPP 1.3.0 and later; where older versions behave differently, it says so.

TAPP is run by Kellits PO Ltd, a private limited company registered with Companies House in the United Kingdom (company number 16493607), whose registered office is 128 City Road, London, EC1V 2NX, United Kingdom. Kellits PO Ltd is the data controller. You can reach us at myboroughuk@gmail.com at any time.

The short version

You play first and save your account second. A TAPP account is a player name, a country, your scores and progress, and — once you save it — the sign-in you chose: Sign in with Apple or an email address. There is no password. We do not collect your real name, your phone number, your contacts or your location, and we never see your payment details. TAPP never asks to track you across other companies' apps.

What we collect

You give us:

Username — the name you pick when you set up the app (or a generated one such as quickfox_21 on older accounts). It is shown publicly on the leaderboards in the app and on tapptheworld.com, which is the whole point of it.
Country — a two-letter country code. Taken from your device's language and region settings when your account is created, and changeable by you at any time. Shown publicly next to your scores.
A sign-in, when you save your account — either your Apple ID, of which we receive only the email address Apple shares with us (Apple's Hide My Email relay address if you choose that; we never ask Apple for your name), or an email address you type in. We use it for exactly one thing: emailing you a one-time code so you can sign back in. It is never shown to other players and is never used for marketing.
Feedback, if you give it — after some games TAPP may ask how the round felt. If you answer, we keep your rating, any comment you type (up to 500 characters), which game it was about, the app version and whether you use iPhone or Android, linked to your account. Only we read it. Please don't put personal details in the comment.
"Tell me when it's here" — if you ask to hear about a feature that is not out yet (such as Friends Leagues), we keep that request, whether you want a notification on launch day, and your app version and platform.

Created automatically when you play:

An account ID — a random identifier that lets our servers tell players apart, created the first time you open the app. It is not derived from your device or from anything that identifies you personally. Saving your account attaches your sign-in to this same ID; it does not create a new one.
Gameplay data used to verify scores — for each Classic and Dodge run, the timing of every tap and where on the screen you tapped; for each Spot On round, the timing of every tap and which target it hit. Our servers replay these to calculate and check your score, which is how we keep fake scores off the leaderboards. We do not keep the taps themselves: we keep the result, the number of taps and a fingerprint (a one-way code) of the taps, which lets us spot a replayed run.
Your scores and results in Classic, Dodge, Reaction Time and Spot On, and when you set them; for Reaction Time, the time of each of your reactions; your TAPP Points, streak and progress.
Your subscription status — whether you have TAPP Pro, which plan, and when it renews or ends; and whether you bought the earlier one-time ad removal. We never see your payment details.
Your agreement to the Terms — which version of the Terms and this policy you accepted, and when.

Only if you turn notifications on (Settings → Notifications, or "Remind me tomorrow" while setting up — all off until you choose them):

Notification preferences — which switches you turned on, which boards Competition alerts cover, your quiet hours, your device's time zone so a reminder arrives at a sensible local hour, and a record of each time you turned a switch on or off and which wording you were shown. Daily reminders are scheduled on your phone from your own progress; the reminder itself is never sent from our servers.
A push token and your app language — only if you turn on Competition alerts: a device token that lets us send you a notification when another player passes you. From TAPP 1.3.0 we may also store with the token whether your app is set to English or Japanese, so the alert can arrive in your language. The token is deleted the moment you turn the switch off, when you sign out on that phone, and with your account. We keep a record of each competition alert we sent (who was sent what, and which player passed them) for 90 days so we never send the same one twice.

Only if you set a Wake Up alarm (iPhone, iOS 26 and later):

Your alarm settings — the time, days, difficulty, game, sound and vibration you chose. These stay on your phone; the alarm is scheduled by iOS on your device. TAPP asks for iOS's alarm permission (AlarmKit) when you set up an alarm, so it can ring when your phone is locked or on silent.
Your wake-up history — for each alarm morning: when the alarm was due, whether it rang, whether you stopped it with the iPhone's Stop button, any snoozes, whether you opened TAPP, when you started and finished the round, which game and difficulty, how many targets you hit and how long it took, and how the morning ended. It is kept on your phone for your streak and saved to your account. It is never on a leaderboard and never shared with other players.

Kept only on your phone: your app language, your ad choice (see "Where TAPP shows ads"), your analytics choices, the country TAPP last looked up for ads, sound and tutorial settings, and games waiting to be sent when you are offline. Deleting the app removes them.

We do not collect: your real name, phone number, contacts, photos or your location. TAPP never requests location access and has no location permission. Your country comes from a device setting and from your own choice — not from GPS, and not from your IP address. When you share a result, iOS may ask for access to your photo library; TAPP only uses it to hand over the image you chose to share.

Some of the companies below receive your device's IP address as a normal part of handling a request and may work out an approximate location (country or city) from it: TAPP's own website, to tell which country ads may be shown in (see "Where TAPP shows ads"); Unity, for ads (in the consent regions listed under "Where TAPP shows ads", only if you allow ads); Google, for the website analytics you allow on tapptheworld.com; and our hosting providers, in their server logs. We have switched off IP-based location in our own analytics.

Who else receives data

Other players — your username, country, scores and ranks are public on the leaderboards in the app and on tapptheworld.com. If you pass a player who has Competition alerts on, their notification names you.
Apple — if you use Sign in with Apple, Apple verifies your identity and passes us the email address you chose to share. Apple also handles all payments for TAPP Pro, and delivers notifications and Wake Up alarms to your iPhone. See https://www.apple.com/legal/privacy/
Supabase — hosts our database, accounts and server functions, in the EU (Frankfurt). Everything in "What we collect" that is not kept only on your phone is stored there. See https://supabase.com/privacy
Resend — sends the one-time sign-in code to your email address. It receives your email address and the email. See https://resend.com/legal/privacy-policy
RevenueCat — manages the TAPP Pro subscription and the earlier ad-removal purchase, and tells our servers whether they are active. RevenueCat receives your account ID and your purchase history, never your card details. See https://www.revenuecat.com/privacy
Unity (Unity LevelPlay and Unity Ads) — our ad partner, and the only ad company in TAPP. It chooses and serves the banner and full-screen ads in free TAPP. TAPP never gives Unity your name, email, account ID, username or scores. For every player, TAPP sends Unity a "do not sell" signal (used under US state privacy laws) and tells Unity that ad requests are not directed at children (TAPP does not ask your age, so it cannot identify a child). Unity's software runs inside TAPP only when ads may be shown (see "Where TAPP shows ads"). While it runs, Unity's software can store and read information on your phone and, according to Unity's own documentation, collects device and network details such as the device model, operating system, language, screen size, connection type, an app-specific device identifier (Apple's "identifier for vendor"; TAPP never asks for Apple's advertising identifier), your IP address and an approximate location worked out from it, and which ads you saw and tapped. Unity uses this to show and count ads, avoid repeating them, prevent ad fraud and choose which ads to show, which can include personalising them. How Unity itself uses and keeps this data, including any use outside TAPP, is set out in Unity's own privacy policy. Unity's software may also report its own crashes to Unity. See https://unity.com/legal/game-player-and-app-user-privacy-policy
PostHog — detailed product analytics, only if you turn Detailed analytics on in Settings → Privacy (it is off until you do, and while it is off TAPP does not start PostHog and nothing is sent). When it is on, TAPP sends PostHog which screens you open, what you do in the app (for example which game you played and how it ended), when the app is opened and closed, and basic device details (operating system, app version, device model), under a random ID for this phone that is not your account ID. Advertising events are never sent to it. It does not receive your email address or your name, and does not work out your location. Turning it off deletes that ID from your phone. TAPP uses PostHog's EU hosting. See https://posthog.com/privacy
Expo — delivers app updates (it receives an installation ID for this copy of the app and its version) and, if you turned on Competition alerts, relays those notifications: Expo receives your push token and the message text. See https://expo.dev/privacy
Vercel — hosts tapptheworld.com, including the country lookup the app uses for ads. It receives your IP address with each request and may keep it in its server logs. See https://vercel.com/legal/privacy-policy
Google Analytics — on tapptheworld.com only, and only if you accept analytics cookies on the website. The TAPP app does not use Google Analytics. See https://policies.google.com/privacy

TAPP 1.3.0 has no Meta (Facebook) software. Some earlier versions of TAPP (from 1.1.2 up to 1.2.0) included Meta's SDK, which told Meta when the app was installed and opened, when games were finished, when the TAPP Pro screen was opened and about App Store purchases, so we could measure Facebook and Instagram ad campaigns. Updating to 1.3.0 removes it. Versions before 1.1.2 used Google AdMob for ads and could ask for Apple's tracking permission.

If you have TAPP Pro (including a free trial) or bought ad removal, no ads are requested; if you already have it when TAPP opens, the ad software is not started at all.

Sharing a score builds the image on your phone and hands it to the app you choose through the system share sheet. The link on the image goes to tapptheworld.com and carries no information about you. Nothing about who you shared it with comes back to us.

Where TAPP shows ads

Never before your first finished game, and never with TAPP Pro or the earlier ad removal. Ads appear as banners on some screens and occasionally as a full-screen ad between games when you play again.
In the UK (including the Channel Islands, the Isle of Man and Gibraltar), the EU/EEA and Switzerland TAPP asks you first. After your first game, TAPP asks whether our ad partner Unity may store and read information on your device to show ads. We rely on your consent for this. If you choose "Allow ads", Unity's ad software starts and free TAPP shows ads. If you choose "Don't allow" — or until you answer — Unity's ad software is never started, no ads are requested and the game is exactly the same. You can change your answer at any time in Settings → Privacy → Ad choices; if you withdraw it, ads stop straight away and Unity is told. Your answer is kept on your phone only.
Elsewhere (for example the US or Japan) free TAPP shows ads without asking.
How TAPP knows: the app asks TAPP's own website (tapptheworld.com) which country the request comes from. The website works that out from your IP address and answers with just the two-letter country; our code keeps no IP address and no identifier. The app keeps the country on your phone for up to a day. If TAPP cannot tell, it shows no ads. If your phone's region setting or your leaderboard country is in the UK, the EU/EEA or Switzerland, TAPP asks you first even if the website saw another country.
TAPP never shows Apple's "Allow tracking" prompt and does not ask for your advertising identifier. If you allowed tracking for an earlier version of TAPP, TAPP now shows no ads at all rather than rely on that permission; until TAPP has read that setting on your iPhone, it does not start Unity's software either. Allowing ads in TAPP is not the same as allowing tracking across other companies' apps.

Analytics

Settings → Privacy has two separate analytics choices, and neither affects ads:

Help improve TAPP — simple counts of how TAPP is used (for example how many games are started and finished, and which screens are opened), sent to our own server. Each count says what happened, the app version, iPhone or Android and the day — no name, email, account, score, or ID for you or your phone, so we cannot tell which counts came from the same person. Your IP address is seen as with any request but is not kept with the counts. Daily totals are deleted after 90 days and weekly totals after 14 months. It is off unless you turn it on; in some countries we may later switch it on by default after showing you a notice, and you can turn it off at any time. At the time of writing, collection is switched off for everyone.
Detailed analytics — PostHog, described above. Off unless you turn it on. Not available in China, Russia or Egypt.

Why we use your data

To provide the game you asked for (your account, sign-in, scores, leaderboards, progress, Wake Up, TAPP Pro): because it is necessary to provide the service.
To keep leaderboards fair and the service secure (verifying runs, detecting replayed or automated scores, hiding cheating accounts, server logs): our legitimate interest in a fair and secure game.
Ads in the UK, EU/EEA and Switzerland, notifications, Detailed analytics, and Help improve TAPP where you turned it on: your consent, which you can withdraw at any time in Settings.
Ads elsewhere, and Help improve TAPP where it is on by default: our legitimate interest in funding and improving a free game; you can avoid ads with TAPP Pro and turn the counts off.
Feedback you send us: our legitimate interest in improving the game.
Keeping records we must keep (for example about purchases): legal obligation.

Where your data is processed

Our database (Supabase) is in the EU, in Frankfurt, Germany. When Detailed analytics is on, TAPP uses PostHog's EU hosting. Apple, Resend, RevenueCat, Expo, Vercel and Unity are companies (or groups) based in the United States and may process data in the United States and in other countries. UK and EU data protection law require a recognised safeguard when personal data leaves the UK or the EU/EEA, such as an adequacy decision, the provider's certification under the EU–US Data Privacy Framework (and its UK Extension), or Standard Contractual Clauses (with the UK Addendum or the UK's international data transfer agreement). You can ask us which safeguard applies to a particular provider.

Users in Japan

TAPP is available in Japanese; this policy is currently in English. If you use TAPP in Japan, this is what the app sends to other companies, why, and where those companies are:

Supabase (our database and server functions) — your account, sign-in email address, scores, gameplay data for verification and the other data in "What we collect" that is not kept only on your phone; to run TAPP; Germany (EU).
Apple — the email address Apple shares if you use Sign in with Apple, purchases, and notification and alarm delivery; to sign you in, take payment and deliver notifications; United States and other countries.
Resend — your email address and the sign-in code email; to send the code; United States.
RevenueCat — your account ID and purchase history; to manage TAPP Pro; United States.
Unity (Unity LevelPlay and Unity Ads) — device and network details, an app-specific device identifier, your IP address and ad interactions, as described above; to show and measure ads, which can include personalising them; United States and other countries. In Japan, free TAPP shows ads without asking first.
PostHog — only if you turn Detailed analytics on: app usage, basic device details and a random ID for this phone; for product analytics; EU hosting (PostHog is based in the United States).
Expo — an installation ID and app version for app updates and, if Competition alerts are on, your push token and the alert text; United States.
Vercel — your IP address when the app asks tapptheworld.com for your country; to decide whether and how ads may be shown; United States and other countries.

To ask what personal data we hold about you, to have it corrected, deleted or no longer used, or to ask for more information about the countries above, their personal-information protection systems and the measures a particular recipient takes, email myboroughuk@gmail.com. The company running TAPP and its address are given at the top of this policy.

Keeping and deleting your data

Scores and results are kept while your account exists, because the all-time leaderboard is a permanent record.
Spot On rounds are kept for 90 days (30 days if the round was not finished); the score itself stays with your account.
Games that never produced a score are deleted after 30 days.
Competition alert records and RevenueCat event records are deleted after 90 days, by an automatic nightly clean-up.
Wake Up history, feedback and notification choices are kept while your account exists and are deleted with it.
Help improve TAPP counts contain nothing that identifies you: see "Analytics".
Backups of our database are kept for 7 days.

Signing out keeps your account. Sign back in with the same Apple ID or email address and your name, scores, progress and subscription are exactly where you left them. An account you have not saved with a sign-in cannot be recovered if you delete the app, and the app tells you so.

Turning a notification switch off cancels every reminder on your phone and, for Competition alerts, deletes your push token from our servers. Signing out does the same on that phone.

You can delete your account from Settings → Manage account. Deleting it removes your sign-in, your username, your ranks, your entire score history from every leaderboard, your Wake Up history, your feedback and your notification settings, for good; copies in our database backups disappear as those backups expire (within 7 days). Deleting your account also sends deletion requests, where our systems are set up to make them, to RevenueCat for your purchase records and, if you used Detailed analytics, to PostHog for the data held under this phone's random ID. If you want us to confirm that these were made, email us. The app warns you before deleting your account. Deleting your account does not cancel a subscription — cancel that in your Apple ID settings.

If you would rather write to us, email myboroughuk@gmail.com from the address on your account, or tell us your exact username and country, and we will delete it for you.

Your rights

Depending on where you live (for example under UK or EU data protection law, or Japan's Act on the Protection of Personal Information), you can ask for a copy of your personal data, ask us to correct or delete it, object to or restrict how we use it, and take it elsewhere. Where we rely on consent, you can withdraw it at any time. Email myboroughuk@gmail.com to use any of them. You can also complain to a data protection authority, for example the ICO in the UK (https://ico.org.uk), the authority in your EU country, or Japan's Personal Information Protection Commission (https://www.ppc.go.jp/en/).

Children

TAPP is for players aged 13 and over, and is not directed at younger children. We do not ask your age and we do not knowingly collect data from anyone under 13. If you believe a child under 13 is using TAPP, email us and we will delete the account. Because TAPP does not ask anyone's age, it treats every player the same way, including for ads (see Unity above).

Changes

If this policy changes materially, we will update the date above and note it in the app's release notes.

Contact

myboroughuk@gmail.com