Privacy
Privacy policy
Last updated 17 October 2026
In short: we collect what we need to sign you in, issue your tickets and check them at the gate. We do not sell your data, show ads or use tracking cookies. Door staff see your first name and last initial, and your photo only when an event or office asks for one. You can ask us to see, correct or delete your data at hello@tap-in.world.
Who we are
Tap In runs this website and the Tap In app (“Tap In”, “we”, “us”). We are responsible for the personal data described here. Contact us about anything in this policy at hello@tap-in.world.
Tap In is in development. Some features run in demo mode: sign-in codes are shown on screen instead of being sent by text or email, and ticket checkout does not take real payments.
What we collect
When you sign in
- Your phone number or email address, and the name you give us.
- A one-time sign-in code. We store it only in scrambled form; it stops working after 10 minutes and is deleted within a day.
- A cookie that keeps you signed in for up to 30 days. It is needed for the service to work, so we do not ask before setting it.
When you hold a ticket or pass
- Which events or offices you hold passes for, the ticket type or group, and when you added it.
- Each time your pass is scanned: the time, the entrance or area, whether you were let in, and the reason if not.
Your photo, if you add one
- Some events and offices ask for a photo so door staff can check that the person matches the pass. We only take a photo when you choose to add one. See Photos below.
When you run an event or office
- The events and offices you create, their ticket types, invite codes (stored scrambled) and settings.
- The phone numbers or emails of guests, staff or visitors you add. You must have a good reason to share them with us, such as the person asking for a ticket or working at your office.
Technical data
- Your IP address, used for up to a day to limit repeated sign-in attempts and stop abuse.
- Settings stored on your own device (light or dark theme, whether you have seen the intro, your pass card design). These stay in your browser and are not sent to us.
How we use it
- To sign you in and keep your account secure.
- To issue tickets and passes, and to let door staff check them.
- To stop fake, copied or reused tickets and other misuse.
- To show organisers and offices who entered and who was turned away.
We use your data to provide the service you asked for (our contract with you), to keep the service secure (our legitimate interest), and for photos, with your consent. We do not sell personal data, use it for advertising, or build profiles of you.
Who can see your data
| Who | What they see |
|---|---|
| Door staff | Your first name and last initial, ticket type or group, and the result of the scan. Your photo only if that event or office requires one. Never your phone number or email. |
| The organiser or office | Your name and the phone number or email you used, your ticket type or group, and your scans at their event or office. Your photo only if they require one. |
| Cloudflare | Hosts our website and database. Data may be processed in Cloudflare data centres outside Nigeria, under their data protection terms. |
| Google Firebase | Only if we switch on sign-in by email link: Firebase sends the email to the address you enter. |
We may also share data if the law requires it, or to protect people’s safety.
Photos
A photo of your face, used to identify you, is sensitive personal data. So:
- We only collect it when you add one, after telling you what it is for. Adding it is your consent; you can withdraw it at any time.
- It is shown only to you, and to door staff and the organiser at events and offices that require a photo, when your pass is scanned.
- It is never used for automatic face recognition or shared with anyone else.
- It is stored as a small, compressed image with camera metadata removed.
- You can delete it any time in the app, under Me. If you do not, it is deleted automatically 30 days after you last set it, unless you still hold an active pass for an office or an upcoming event.
How long we keep it
- Sign-in codes: up to a day. Sign-in sessions: up to 30 days.
- IP-based abuse limits: up to a day.
- Photos: as described under Photos.
- Your account, passes and scan records: while your account exists or while the organiser or office keeps the event. Ask us and we will delete your account.
Your rights
Under the Nigeria Data Protection Act 2023 you can ask us to:
- tell you what personal data we hold about you and give you a copy;
- correct data that is wrong;
- delete your data, or stop or limit how we use it;
- withdraw your consent for your photo.
Email hello@tap-in.world from the phone number’s owner or the email address on your account. If you are not happy with our answer, you can complain to the Nigeria Data Protection Commission.
Security
Sign-in codes, ticket codes, invite codes and gate keys are stored only in scrambled form, so even someone who read our database could not use them. The site only works over an encrypted connection, and door staff see as little about you as possible.
Children
Tap In is not meant for children under 13. If you are under 18, ask a parent or guardian before you sign up.
Changes
We will update this page when what we collect or how we use it changes, and change the date at the top. If a change is significant, we will tell you in the app.