Privacy Policy

fobtap provides profile pages you share by tapping an NFC key fob. This policy describes what we collect, why, and what happens to it. The short version: we store what you put on your profile, the minimum needed to run accounts, and privacy-preserving tap statistics. We do not sell any of it and we run no advertising or tracking.

Controller

Alexey Krasnoperov, Zeppelinstr. 73, 81669 Munich, Germany, is the controller (Verantwortlicher) under the GDPR. Contact for anything in this policy: info@fobtap.com. See also the Impressum.

What we process, and why

• Account data. Your email address and the handle you choose. You sign in with Google; we receive your Google account email, name and profile picture and store them as the starting point of your profile. Legal basis: performance of the contract with you (Art. 6(1)(b) GDPR). Kept until you delete your account.
• Profile content. The name, headline, bio, photo and links (including any email address or phone number you add as a link) that you put on your profile. This content is public by design: anyone who taps your fob, scans your QR code or opens your profile URL sees it, and can download it as a contact card. Legal basis: contract (Art. 6(1)(b)). Kept until you change or delete it.
• Link icons. For each web link you add, our server fetches that site's favicon and stores a copy with us, so visitors never load images from third-party sites. No visitor data is involved. Refreshed about weekly.
• Tap statistics. When a fob is tapped or a profile opened we record the time, a coarse country code (from the hosting provider's request headers) and a salted hash of the visitor's browser signature. The salt rotates daily, so the hash cannot identify a visitor or follow one across days. No IP addresses are stored. Legal basis: our legitimate interest in showing fob owners and organizations how their fobs are used (Art. 6(1)(f)). Kept for the life of the fob.
• Organization membership. If you claim a fob issued by an organization (for example a community or an event), you become a member of that organization on fobtap. Its admins can see your handle, your email address, which fob is yours and its tap counts, and can release your fob. Organizations may also register an email address for a fob before it is claimed, so that only that address can claim it; we hold such addresses on the organization's behalf until the fob is claimed or the assignment is removed. Legal basis: contract (Art. 6(1)(b)) for members; for pre-assigned addresses, the organization's legitimate interest in handing fobs to the right people (Art. 6(1)(f)).
• Contact form. If you ask about fobs for your organization, we keep the name, email, organization and message you send until the conversation concludes, then for up to 12 months. Legal basis: steps prior to a contract (Art. 6(1)(b)).
• Hosting logs. Our hosting provider (Vercel) keeps standard server access logs with the requesting IP address, time, requested URL and browser type for a short period to run and secure the platform. We do not build profiles from them. Legal basis: legitimate interest in operating the service securely (Art. 6(1)(f)).
• Security logs. Sign-in and claim attempts are rate-limited per email address and per IP address; the counters are short-lived (minutes to hours). Legal basis: legitimate interest in keeping the service secure (Art. 6(1)(f)).

Where the data comes from

Most data comes from you directly. Two exceptions: your name, email and picture at sign-up come from Google; and an email address registered for a pre-assigned fob comes from the organization issuing that fob. We do not buy or enrich data from anywhere else.

No automated decisions, no profiling

We make no automated decisions with legal or similarly significant effect, and we do not profile anyone. Rate limiting is a purely technical counter, not an assessment of you.

Minors

fobtap is for people aged 16 and over. We do not knowingly process data of younger children; if you believe we do, contact us and we will delete it.

Cookies

We set one cookie: the session cookie that keeps you signed in. It is strictly necessary, so no consent banner is shown. Signing in with Google involves Google's own cookies on Google's domains, governed by Google's privacy policy.

Processors and international transfers

We run on Vercel (hosting, serverless functions in Frankfurt, image storage), Neon (PostgreSQL database in Frankfurt), Resend (transactional email, currently not in use) and Google (sign-in). Each processes data on our behalf under a data-processing agreement. Vercel, Resend and Google are US companies; where data reaches the United States, the transfer is covered by the EU-US Data Privacy Framework and the EU standard contractual clauses.

Your rights

You can edit or delete your profile content and links at any time from the dashboard, and delete your whole account there too. You have the right to access, rectify and erase your data, to restrict or object to its processing, and to data portability (Art. 15–21 GDPR). To exercise any of these rights, email the address above; we respond within 30 days. You may also lodge a complaint with a supervisory authority, for example the Bavarian State Office for Data Protection Supervision (BayLDA).

Your right to object (Art. 21 GDPR)

Where we rely on legitimate interest (tap statistics, hosting and security logs, pre-assigned fob emails), you have the right to object at any time on grounds relating to your particular situation. Email the address above; we then stop the processing unless we can show compelling legitimate grounds that override your interests, rights and freedoms.

Changes

We update this policy when the service changes; the date at the top tells you when. Material changes will be announced on the dashboard.