Security at Tapmy

1. How a payment moves

• The buyer pays in the store. Card details are entered in Stripe’s hosted fields. Tapmy does not receive or store the full card number.
• Stripe processes the payment.
• Buyer payments are paid into the creator’s own Stripe account through Stripe Connect. For a Tapmy plan, Stripe bills the creator’s subscription. Tapmy stores a Stripe customer ID and subscription status, not the card.
• Payout from that Stripe account to a bank follows Stripe’s schedule for the country. Tapmy does not publish Stripe’s payout timing on this page.

Checkout runs on one-step checkout. The payment itself runs on Stripe. Stripe’s handling of card data is described in the Stripe Privacy Policy.

2. Payouts

Payouts go through Stripe. To accept payments you connect your own Stripe account and agree to Stripe’s Connected Account Agreement. Buyer payments are paid into that account. If you disconnect Stripe, paid products stay unavailable until you connect a payment account again.

• When you connect Stripe to sell, we store your Stripe account ID and account status (whether charges and payouts are enabled, your business type, and the account email). Bank and identity details go to Stripe.
• The Tapmy app for iPhone and iPad does not use Apple in-app purchase for plans. Upgrading or connecting Stripe opens Safari, and Stripe processes the payment.

3. Buyer and creator data

What Tapmy stores includes account details, product files, and order records (name, email, and what was bought). What Tapmy does not store includes full card numbers and bank account details.

• For store page views we do not store the raw IP address. We record approximate location (country, region, and city), device, browser, operating system, page, and a one-way visitor identifier created on our servers.
• Audio from dictation in the iPhone and iPad app stays with Apple. Tapmy receives only the text you choose to send.
• We do not store your contacts, or a precise location from the app.
• AI Clone chats on a store are tied to a random identifier in the visitor’s browser, not to the visitor’s name.

Retention periods and processors are in the Privacy Policy. Buyer refunds are described in the Refund policy.

4. Account access

You can create an account with an email and a password, or sign in with Google or Apple. Passwords are stored only as a one-way hash. If you use Google, we receive your name, email, and basic profile, and use them to create and secure the account. If you use Apple, we receive the name and email you choose to share, which may be an Apple private relay address, plus an Apple user identifier.

A session cookie keeps you signed in across tapmy.store and app.tapmy.store for up to 7 days. Cloudflare Turnstile runs on sign-up, sign-in, and checkout to block bots. Published sign-in options are an email and a password, Google, or Apple.

You are responsible for keeping your login confidential and for activity under your account. If you think someone else has access, email [email protected] right away.

5. Infrastructure

We protect personal information with encrypted connections (HTTPS), hashed passwords, encrypted third-party access tokens, access controls, and bot protection. If you connect Google Calendar for bookings, we store your Google account email, the calendar you chose, booking event IDs, a short-lived access token, and a refresh token encrypted with AES-256-GCM. We use that access to read free and busy times and to add booking events. We do not sell Google user data, share it with advertising platforms or data brokers, or use it to train AI models. Disconnecting the calendar revokes access at Google and deletes the stored tokens.

The service runs on the providers named in the Privacy Policy: DigitalOcean for servers, database, and file storage; Cloudflare for network security and bot protection; Lovable for the tapmy.store website. A data-center region is not published on this page.

6. Compliance

This page does not show a SOC 2, PCI DSS, GDPR certification, or Stripe partner badge. Those marks are not published here. Card data is handled by Stripe. Privacy rights for people in the EEA, the UK, Switzerland, and certain US states are described in the Privacy Policy. They are not a certification badge.

7. Reporting a vulnerability

Found a security issue? Email [email protected] and put Security in the subject, or start from Contact. Describe the issue. Please do not post it publicly first. We do not publish an acknowledgment window, a PGP key, or a bug bounty.