Privacy policy
What Tapwah collects, why, who helps us run it and how to delete it.
Who we are
Tapwah (“we”, “us”) runs tapwah.com and app.tapwah.com and is responsible for the personal data described here (the “controller”, in GDPR terms). Contact us about privacy at hello@tapwah.com.
This website
tapwah.com sets no cookies and runs no analytics or advertising trackers. Our hosting provider, Cloudflare, processes basic request data such as IP addresses and browser details to deliver the pages and protect them from abuse.
If you type an app idea into the box on our homepage, it isn’t sent anywhere until you continue to the app. It travels in the part of the web address after the “#”, which browsers don’t send to servers.
What we collect when you use Tapwah
- Account details: your email address, a normalized form of it (used to spot duplicate sign-ups), when you signed up, your plan and account status. If you sign in with Google, Google also shares the basic profile details you allow, such as your name and profile picture.
- What you build: your chat messages (including earlier chats after you start a new one), the code and files of your app, and the AI agent’s working record of the conversation, including web searches and pages it looks up for you.
- Your app’s backend data: records, files and app user accounts (email addresses and passwords, stored hashed) that your app saves in Tapwah’s backend. For this data you decide what is collected, and we store it on your behalf (see “Data your app collects”).
- Usage: how many seconds you use a simulator each day and how much AI work you use, so we can apply the daily limits.
- Technical data: IP addresses, browser details, sign-in events and server logs (which can include your user ID, email address and build output that quotes your code), used to run and secure the service.
- What you send us: emails to hello@tapwah.com, such as support requests or a request to join the Pro list.
The live iPhone screen is streamed to your browser as video. We don’t record it. Please don’t put sensitive personal data, such as health or financial details, in your chats or your app.
Why we use it, and our legal bases
- To provide Tapwah to you: create and run your account, sign you in, write, build and show your app, keep your chat and app between sessions, and run your app’s backend. Legal basis: performance of our contract with you.
- To keep Tapwah fair and secure: apply the daily limits, block duplicate and disposable-email sign-ups, prevent and investigate abuse and security issues, and enforce our terms. Legal basis: our legitimate interests in protecting Tapwah and its users.
- To support you and improve Tapwah: answer your messages, fix problems, and understand how Tapwah is used through aggregated or de-identified data, such as numbers of builds, time and AI cost. Legal basis: our legitimate interests in running and improving the service.
- To meet legal obligations: respond to lawful requests and comply with the law. Legal basis: legal obligation.
We don’t sell your personal data, we don’t share it for cross-context behavioral advertising, and we don’t use your content to train AI models. We email you only about your account, such as sign-in codes and important changes, or when you ask us to. We may look at your chats and code when you ask for support, to fix a problem, to investigate abuse or a security issue, or when the law requires it.
We don’t make decisions with legal or similarly significant effects about you based solely on automated processing. Automated checks do apply the daily limits and refuse sign-ups that look like duplicates or use disposable email domains. If you think one got it wrong, email us and a person will look at it.
Who helps us run Tapwah
These providers process personal data for us, under their terms and data processing agreements:
- Anthropic runs Claude, the AI model that writes your app. Your messages, your app’s code and the agent’s web searches are sent to it to do that work. Under its commercial terms, Anthropic doesn’t train its models on this data.
- Supabase runs sign-in and stores accounts, usage and chat history (in the United States), and stores your app’s backend data.
- Cloudflare hosts this website, carries traffic to the app, protects it from attacks, and streams the iPhone screen to your browser.
- Mailfully sends sign-in emails, so it receives your email address and the one-time code.
- Google confirms your identity and shares your basic profile with us if you choose “Sign in with Google”, under Google’s own privacy policy. To show that button, the app.tapwah.com sign-in page loads a script from Google, so Google receives your IP address and browser details when you open that page, and may read or set its own cookies, even if you sign in with email.
Your app’s files, the AI agent’s working records and the simulators are on Macs we operate. When the agent reads a public web page for you, the request comes from our Mac, not your device. We may also disclose personal data if the law requires it, to protect the rights, safety or property of Tapwah, our users or others, or as part of a merger, acquisition or sale of assets, in which case this policy will continue to apply to it.
International transfers
We and our providers process data in the United States and other countries, which may have different data protection laws from yours. When we transfer personal data from the EU, the UK or Switzerland, we rely on safeguards such as the European Commission’s Standard Contractual Clauses and the UK addendum, as included in our providers’ data processing terms, or on the EU-US Data Privacy Framework where a provider is certified.
How long we keep it
- We keep your account, chat history, app and its backend data while your account exists.
- When you delete your account from the account page, we delete your account details, chat history, usage records and your app’s backend data, files and app users, and remove your app’s files and the agent’s records from our Macs, usually within minutes and at most about 10 minutes later.
- We keep a record that a deleted account existed (its ID and when it was deleted) for 30 days, so we can finish the cleanup.
- For up to 4 days we keep the normalized form of your email address with that day’s usage, so deleting an account and signing up again doesn’t reset the daily limits.
- If you ask for a sign-in code but never enter it, your email address stays in our sign-in system with no account attached. Email us to have it removed.
- If we suspend an account for breaking our rules, we may keep the data we need to prevent the same person returning, and to handle any legal claims, for as long as that is needed.
- Server logs and our providers’ logs and backups may keep data for a limited time after deletion, until they are cleared or expire.
- Data your app saves on the simulator itself is erased when your session ends.
Data your app collects
If your app stores data about other people in Tapwah’s backend, such as its users’ accounts, you are responsible for that data: for telling those people how it is used and for answering their requests. We process it on your behalf and only to run your app’s backend. When you delete your account, it is deleted too.
Cookies and similar storage
tapwah.com sets no cookies. app.tapwah.com uses only what it needs to work: one cookie, tapwah_session, that keeps you signed in, and your browser’s local storage for the sign-in session and session storage for an app idea you brought from the homepage. These are strictly necessary, so we don’t ask for consent, and none are used for analytics or advertising. On the sign-in page, Google’s sign-in button may read or set Google’s own cookies, as described above. Because we don’t track you, we have nothing to change in response to Do Not Track or Global Privacy Control signals.
Security
We protect your data with measures such as encrypted connections, per-person sandboxes and keeping no administrator keys on the Macs that run apps. No service is perfectly secure, so we can’t guarantee that your data will never be accessed without permission. Our security page has the details and how to report an issue.
Your rights
You can delete your account at any time from the account page. You can also email hello@tapwah.com from the address you sign in with to ask us to:
- give you a copy of your personal data, or send it to you in a portable format;
- correct it or delete it;
- restrict how we use it, or object to our use of it based on legitimate interests.
EU and UK: you have these rights under the GDPR and the UK GDPR, and you can complain to your local data protection authority (in the UK, the Information Commissioner’s Office).
California and other US states: depending on where you live, you may have the right to know what personal data we collect, use and disclose, to access, correct and delete it, and to opt out of its sale or sharing (we don’t sell or share it) and of profiling. The categories we collect are those listed above: identifiers (such as email address and IP address), account details, user content, internet activity (such as sign-in and usage data) and, if you use Google sign-in, basic profile details. We collect them from you, from your use of Tapwah and from Google, for the purposes above, and disclose them only to the providers listed. We won’t treat you differently for using your rights. You may use an authorized agent, and if we refuse your request you may appeal by replying to our answer.
We’ll check that the request comes from you, usually by asking you to write from your sign-in address, and answer within the time the law requires (normally within a month).
Children
Tapwah isn’t meant for anyone under 16, and we don’t knowingly collect personal data from them. If you think a child under 16 has given us personal data, email us and we’ll delete it.
Changes
We may change this policy. We’ll post changes here and update the date at the top. If a change is material, we’ll make reasonable efforts to tell you, for example by email.
Contact
Privacy questions and requests: hello@tapwah.com.