Privacy

Tappnest is run by [TODO: registered legal name], at [TODO: registered address]. For anything on this page, write to support@trao.ai.

• Your name and email, from the signup form or from your Google account if you sign in that way.
• A hash of your password, if you set one. We never store the password itself and cannot read it. This is why a forgotten password is reset rather than looked up.
• Your page content - the link, display name, bio, every block, your theme, and any image or file you upload.
• Sign-in sessions - the session itself, plus the IP address and browser user agent it was created from, so you can tell your own sessions apart from someone else’s.
• Your plan - which plan, its status, when the period ends, and the customer and subscription identifiers our payment provider gives us.
• When you hit a plan limit - which limit, and how far over it you were. We use this to decide what to build and where to set the limits.

When someone opens your page or taps one of your links, we store the view or the click with three things about it, and nothing else:

• The hostname they came from - instagram.com, not the full URL of the post.
• The country, as reported by the network in front of our servers.
• Whether they were on a phone, tablet or desktop.

There is no cookie on your public page, no advertising or cross-site identifier, and no visitor profile. We do not store visitor IP addresses: an IP is held in memory for about a minute to stop one person flooding your page or your form, and is never written to the database.

If your page has a form, what people send through it - name, email, phone, message, and any extra fields you added - is stored for you and shown in your inbox. You decide what to ask for and what to do with the answers. We use it only to deliver it to you: an email notification if you have those on, and a POST to your webhook if you set one.

Two consequences worth being clear about. Ask for the least you need, because you are the one answerable for holding it. And if the law where your visitors live requires you to tell them how you will use their details, that notice is yours to write, not ours.

Everything on a published page is meant to be read by anyone, and so is everything you upload to it. Uploaded images and files are served from a public address that needs no sign-in, and that address stays reachable while the file exists even if you later hide the block pointing at it. Do not upload anything you would not hand to a stranger.

We keep this list short on purpose. Today it is:

• Neon - our database and file storage, hosted in the United States.
• Resend - sends the transactional email: password resets, and lead notifications to you.
• Dodo Payments - takes the payment as merchant of record. Card details go to them, never to us; we never see or store a card number.
• Google - only if you choose to sign in with Google, and only your name, email and profile picture.

We do not sell your data, and we do not share it for advertising. If you set a lead webhook, note that you are the one choosing to send your submissions to whatever service is on the other end of it.

One cookie, set when you sign in, which is what keeps you signed in for thirty days. It is not optional, because without it there is no sign-in. There are no analytics or advertising cookies anywhere on this site, which is why you have not been asked to accept any.

Your account and page content stay until you delete them or ask us to close the account. Form submissions stay until you delete them. Sessions expire after thirty days.

Being straight about analytics: we currently keep view and click records indefinitely. Your plan limits how far back the dashboard will look - thirty days on Starter, twelve months on Pro - but that is a view, not a deletion. If you want your analytics wiped, ask and we will wipe them.

Most of it you can change yourself: your profile and page content in the editor, your plan under settings, and leads in your inbox.

There is no self-serve button for closing an account yet. Email support@trao.ai and we will delete your account, your pages, your uploads and your leads within [TODO: number] days, and confirm when it is done. The same address works for a copy of everything we hold about you. We will ask you to send the request from the address on the account, so that nobody else can delete your page.

Tappnest is not for children. You need to be at least 16 to have an account, as set out in the terms. If you believe a page belongs to someone younger, tell us and we will take it down.

If we change what we collect or who processes it, we will update this page and its date, and email you before the change takes effect if it is a material one.

This page and our handling of your data are governed by [TODO: governing law]. If we have not resolved something to your satisfaction, you may be entitled to complain to the data protection authority where you live.