Privacy Policy

1. Overview

At TapFree.me (“TapFree,” “we,” “us,” or “our”), we take your privacy and data security seriously. This Privacy Policy describes how we collect, use, store, and protect your information when you visit our website, use our link-in-bio platform, or subscribe to our Pro software services.

We do not sell personal data to third parties. We collect only what is necessary to operate our SaaS platform, provide reliable link analytics to creators, and process payments securely.

2. Information We Collect

We collect information in the following categories:

• Account & Identity Data: When you sign up via Magic Link or Google OAuth, we collect your email address, chosen handle (username), and display name.
• Profile & Content Data: URLs, link titles, social media handles, avatar image URLs, bio text, and custom theme selections you configure in your creator dashboard.
• Visitor & Click Analytics Data: When visitors click links on your public bio page, we log the link ID, timestamp, and referring domain (e.g., Instagram, TikTok, Twitter) to provide CTR metrics. We do not store personally identifiable profiles of your bio page visitors.
• Billing & Payment Data: When subscribing to Pro, your credit card number and billing address are collected directly by our PCI-compliant payment processor, Stripe Inc. TapFree never stores or has access to your full credit card numbers.

3. Third-Party Service Providers (Subprocessors)

We partner with trusted enterprise cloud infrastructure providers to operate TapFree:

4. Cookies & Security

TapFree uses strictly necessary session cookies to keep you signed into your dashboard (tapfree_magic_session) and prevent cross-site request forgery attacks (tapfree_csrf_token). We do not use third-party advertising cookies or cross-site tracking pixels.

All data transmission between your browser and our servers is encrypted using modern TLS 1.3 / HTTPS protocols. Sensitive tokens and password hashes are protected using scrypt/bcrypt cryptographic algorithms.

5. Your Rights (GDPR & CCPA)

Regardless of your location, you have full control over your personal data:

• Right to Access: You can view all links, social profiles, and collected metrics directly from your dashboard.
• Right to Rectification: You can update or correct your profile data at any time with one click.
• Right to Erasure (“Right to be Forgotten”): You can request full deletion of your account, handle, and data by contacting support.
• Right to Restrict Processing: You can export or remove individual links and newsletter subscriber lists at will.

6. Data Retention Policy

We retain your account profile data as long as your account remains active. Analytics click event records are automatically pruned and deleted after 95 days via automated MongoDB TTL indexes to ensure minimal data retention.