TapCare

Privacy Policy

Effective date: October 15, 2026

TapCare helps families keep their pets' care records together. This policy explains what information we collect, how we use and protect it, and the choices available to you. TapCare is operated by Chae Youngwoo, the controller of personal data processed for the service.

1. Information we collect

  • We collect only the information needed to provide and protect TapCare.
  • When you choose social sign-in, TapCare receives information needed to identify and authenticate your account from the Kakao, Naver, Google or Apple service you select. This may include the sign-in provider, its account identifier, and the email address, nickname or profile image it shares, depending on the provider and the permissions you grant. We use this information to authenticate sign-in, check for an existing account and provide your account.
  • Family and pet information may include family membership and pet profile details such as name, photo, birthday, sex, breed, and neuter status.
  • Care information may include logs, schedules, weight, health notes, allergies, medication, vaccinations, food, treats, supplements, nutrition goals, notes, and report data.
  • Device and notification information may include app and operating-system versions, platform, Firebase Cloud Messaging token, notification settings, and delivery or read status.
  • Support information includes your email address, message, attachments and correspondence. Necessary server diagnostics may include error types, limited stack information and technical app or device details.
  • For limited server-incident diagnosis, TapCare may store the environment, release, request identifier, safe route and HTTP status, error type, a redacted description, limited stack frames, and related account, email, client-IP reference, or pet identifiers. Authentication tokens and request bodies are not stored in this diagnostic record.
  • At sign-up, TapCare processes your country or region of residence, date of birth, personal time zone, and your acceptance of the required Terms of Service and Privacy Policy, including document versions and acceptance times. We use this information to assess age and country-specific eligibility and provide your account and personal settings. You select your country or region of residence yourself; this sign-up process does not use device location permissions to collect GPS or current coordinates. Separately, Cloudflare may infer and process an approximate country-level location from your IP address for web and API security, as described in Sections 4 and 6. We store dates of birth encrypted with a separate key and exclude them from general profile responses and usage analytics.
  • We create your account after you submit all required sign-up information and meet the eligibility conditions. Before that, we send credentials issued by your social sign-in provider to the TapCare server to authenticate you and check whether you already have an account. Sign-up details you are entering remain temporarily in app memory until you submit them. Copies of sign-up details and social credentials held in app memory while sign-up is pending are discarded when you cancel sign-up, close the entry screen or the pending authentication expires. Discarding these temporary app copies does not mean that information has not already been sent to our server or your sign-in provider. Section 4 explains retention and deletion after account creation.

2. How we use information

  • Create accounts, sign you in, identify your account, and protect the service.
  • Provide shared family care logs, schedules, notifications, and reports.
  • Send push notifications and apply your notification preferences.
  • Respond to support requests, investigate incidents, and prevent misuse.
  • The initial release does not collect GA4 usage analytics or Firebase Crashlytics crash reports. Firebase Cloud Messaging for push notifications and necessary server-incident diagnostics remain in use.

3. Platform age checks and approval changes

  • At sign-up, sign-in and when you return to the app, we may process age ranges, verification or approval statuses and observation times supplied by the operating system or app store to assess eligibility. Where needed, we send Apple’s signed app transaction proof or a Google Play installation identifier to our server for verification and to apply approval-revocation notifications to the relevant account.
  • Our server does not retain raw age ranges or signed transaction proofs. For revocation handling, we retain a purpose-specific hash of the platform identifier, its account link, the current access decision and reason, and observation, receipt, revocation and recovery times. These hashes can be linked to an account and are not treated as anonymous information. Recovery reviews retain the review time and hashes referencing the reviewer and approval evidence. We do not place raw identifiers, transaction proofs, approval evidence documents or age ranges in logs or usage analytics, and do not reuse this information for advertising or usage analytics.
  • To handle duplicate or delayed revocation notifications, we retain identifier and event hashes and event and receipt times without an account ID. A daily cleanup deletes these revocation receipts after 90 days, within a maximum of 91 days after receipt. Coordination records that are no longer referenced by an account binding or revocation receipt are cleaned up on the same schedule after their last use.
  • Access to protected features may be restricted when approval is revoked or eligibility cannot be confirmed. You can request another check or contact support, and can still log out or follow the account-deletion process. Recovery from revoked approval requires a new eligible platform observation and an operator’s review of reapproval evidence. Retrying or supplying an app transaction proof alone does not automatically remove a revocation.

4. Retention and deletion

  • Account and service data is generally kept while your account remains active.
  • When you place a pet in the in-app trash, that pet and related care data can be restored for 30 days.
  • After 30 days in the trash, the pet and related data are permanently deleted and stored avatar files are queued for removal.
  • If you are the only member of a family, deleting your account permanently deletes the account, family, pets, care logs, schedules, and notification data.
  • If other members remain, your account information is deleted while shared pet and care records remain for the family. Your author identifier is removed and may appear as “Former member.”
  • A token needed to disconnect Apple sign-in is stored separately and encrypted, then removed after successful disconnection or a final non-retryable failure.
  • Sensitive server-incident diagnostics are encrypted and retained for no longer than 30 days.
  • Sensitive diagnostic access audit records are retained for no longer than 90 days. They record the authorized administrator, Cloudflare Access subject, action, incident identifier, and time, but not the diagnostic payload.
  • If crash reports were sent by an earlier build, Firebase Crashlytics retains crash stacks and related installation identifiers for 90 days before starting removal from live and backup systems. Disabling collection in this release does not immediately delete previously transmitted reports.
  • We delete email addresses, messages, attachments and correspondence collected for support within one year after the inquiry is closed. We manually review retention each month to meet this deadline.
  • Information subject to a legal retention requirement is separated and kept only for the required period.
  • When you delete your account, we delete its information, including your date of birth, and its linked platform access, identifier-binding and recovery-review records. Revocation receipts without account IDs and unreferenced coordination records follow the separate retention period above. Shared content belonging to remaining family members and diagnostic information follow the relevant deletion and retention provisions elsewhere in this Privacy Policy.
  • Firebase installation identifiers are separate from push tokens. Google retains them until the installation-ID deletion API is called, then removes them from live and backup systems within 180 days. Removing a push token at sign-out or account deletion does not mean the installation identifier is immediately deleted.
  • Manual backups and recovery database copies created after this policy takes effect have a maximum retention period of seven days from creation. Automated daily and weekly backups follow separate expiry schedules; weekly backups may remain for up to 27 days. Before resuming service from a restored backup, we reapply account-deletion and data-deletion records.
  • Operational alerts are processed in our free Slack workspace, with data stored in the United States. Messages and files may become hidden after 90 days; this does not mean they have been deleted. Under Slack’s free-plan policy, data older than one year is deleted on a rolling basis. We review retention again if the plan or retention settings change.
  • Cloudflare processes information such as IP addresses, request paths, user agents, countries and security actions to protect our website and APIs. On our current Free plan, sampled Security Events dashboard data has up to 31 days of retention and a 30-day query window. This is not a blanket retention period for all internal Cloudflare network data. Security events may be processed even though R2 Data Access Logs are disabled.

5. Payment information

  • TapCare does not currently offer payment features.
  • We do not collect or store card numbers or refund transaction details. Apple app transaction proofs and identifier hashes used for age and approval checks are handled under the platform-check provisions above and are distinct from payment-method collection.
  • Before adding payments, we will update this policy to describe the actual processing and retention periods.

6. Service providers and disclosures

  • We do not sell personal information. We disclose it only with your direction, when required by law, or to providers that help us run the service.
  • Disclosure to family members (optional consent): only if you separately agree at sign-up or right before inviting to or joining a family, we provide your nickname, profile photo, family role and joining time, the care records and notes you write with your name as author, and the pet details and photos you add to members of the same family (members of families you join, including people who join those families later). We do this so family members can log care together, see who logged what, and share schedules and reminders, for as long as you remain a family member.
  • You can decline this consent. If you decline, you can't create a family invite code or join a family, but your own records, reports and reminders keep working. Leaving a family stops further disclosure; Section 4 explains how records already shared are handled when you leave a family or delete your account while other members remain.
  • Firebase Cloud Messaging processes device tokens to deliver push notifications.
  • Slack processes restricted operational incident alerts for authorized TapCare administrators. Those alerts use bounded diagnostic context, exclude authentication tokens and request bodies, and follow the workspace retention settings.
  • Kakao, Naver, Google, and Apple may process sign-in, account identification, and account disconnection data.
  • Cloudflare provides DNS, security, web delivery, email routing, and R2 image storage.
  • Railway provides backend, database, and Redis infrastructure.
  • Support messages are routed through Cloudflare Email Routing and handled in the operator’s Google Gmail account. Your email address, message, attachments and correspondence are processed to handle your request. Replies may be sent from the operator’s Gmail address.
  • We temporarily process provider identifiers and unlink events in encrypted Cloudflare queues to deliver Kakao account-disconnection notifications. The primary and failed-message queues each retain a message for up to 24 hours; a message passing through both may remain for up to 48 hours.
  • Our Railway production servers and database are configured in the Singapore region. Provider operations and support, and processing by other service providers, may take place in other countries, including the United States.

7. International processing and your choices

  • TapCare uses overseas processing and storage providers for account and record storage, image delivery, notifications and customer support. Transfers occur over the network when the relevant registration, save, read, notification, incident or inquiry is processed. Contact support@tapcare.kr for privacy rights and transfer-related requests.
  • For overseas outsourcing and storage needed to provide account and care-record storage and the photos, notifications or support you request, we provide this disclosure under Article 28-8(1)(3)(a) of Korea’s Personal Information Protection Act. This basis applies only to processing needed for the relevant service and does not automatically cover other processing or processing requiring separate consent.
  • Railway Corporation (privacy@railway.com) processes account data, encrypted birth dates, countries, time zones, acceptance records, family/pet/care content, platform eligibility and diagnostics in our Singapore production servers and database. Service operations and support may involve US processing. Account, diagnostic and backup retention follows section 4.
  • Cloudflare, Inc. (legal@cloudflare.com) uses its global network for web/API security, image storage and delivery, support-email routing and encrypted Kakao unlink-event delivery. It processes the request/IP references, uploaded photos, support email and unlink-event information needed for those purposes. Image deletion and queue retention follow sections 4 and 6.
  • Our Cloudflare R2 photo bucket uses the Asia-Pacific (APAC) region setting. This does not guarantee storage in a specific country. Photos are removed through the service-deletion procedures in section 4; the seven-day rule for aborting incomplete uploads is not the retention period for stored photos.
  • Firebase Cloud Messaging is provided by Google LLC. Installation identifiers, push tokens and delivery information are processed in global Google facilities, including the US, using encrypted connections at app registration, token refresh and notification delivery. Installation identifiers remain until the deletion API is called and are removed within 180 days after that call.
  • Slack Technologies Limited, with processing by Slack Technologies, LLC (privacy@slack.com), handles restricted operational alerts. Our current Free workspace stores data in the US. Alerts are delivered by HTTPS webhook when incidents occur. Hiding after 90 days and rolling deletion after one year are explained in section 4.
  • Google LLC Gmail processes the email address, message, attachments and correspondence you choose to send for support in global Google facilities, including the US. Messages reach the operator through Cloudflare Email Routing and are deleted within one year after the inquiry closes. We do not promise that every email hop is always encrypted.
  • If you refuse processing needed for essential overseas account and record storage, we may be unable to provide those services. Photo uploads and support requests are optional, and notification settings can be changed in the app or operating system. Contact support to request deletion or restriction of processing that is no longer needed.

8. Push notifications and signed-out privacy

  • When you sign out, the app attempts to unregister the device token, delete the Firebase token, and cancel scheduled notifications. Failed cleanup is queued and retried when the app starts or resumes.
  • To prevent account mix-ups, detailed in-app notifications are shown only when the signed-in user matches the intended recipient.
  • Lock-screen and notification-center messages may include contextual information such as pet names, record authors, or care details. Notifications already delivered to or displayed by the operating system may remain after you sign out or switch accounts. When you open their content in the app, we check the current account’s access permissions.
  • You can turn push notifications off in TapCare or your operating-system settings.

9. Your choices and account deletion

  • You may request access, correction, deletion, restriction, or withdrawal of consent where applicable.
  • You can delete your account in the app. Shared-family data is handled as described in section 4.
  • For questions about diagnostics or previously transmitted crash reports, contact support@tapcare.kr.
  • See the account deletion page for step-by-step instructions.
  • You can change your personal time zone in Settings. Contact support to correct your date of birth or country or region, request deletion of children’s information collected in error, or ask about platform-approval recovery. After confirming account ownership, we use the minimum information necessary to review the request under the current eligibility policy.

10. Security

  • We use reasonable safeguards such as access controls, HTTPS, authentication-token controls, and restricted server access.
  • Sensitive diagnostic access requires Cloudflare Access authentication and a separate administrator allowlist. Every successful and denied access attempt is audited.
  • Signed-out cleanup is retried at limited intervals, and push identifiers are separated by account.
  • No internet or mobile service can eliminate every risk, so please also keep access to your account secure.

11. Children and sensitive information

  • TapCare is not directed primarily to children.
  • Pet care records are information you enter about an animal. TapCare is not intended to collect human medical information.
  • The baseline minimum age is 13. Where the law of your country or region of residence sets a higher age, that age applies. We do not offer an in-app parental-consent exception to the baseline eligibility requirements. A self-reported date of birth or platform age range is not equivalent to identity-document verification.

12. Changes and contact

  • If this policy changes, we will post the updated policy and effective date before the change takes effect.
  • For privacy or service questions, contact support@tapcare.kr.
  • We will review your request and respond as reasonably needed.
  • Person responsible for personal data: Chae Youngwoo. For inquiries and privacy requests, contact support@tapcare.kr. Please do not send passwords or verification codes.
  • Operator contact address: 101-ho, 24 Namhyeon 2-gil, Gwanak-gu, Seoul 08805, Republic of Korea. Phone: +82 10-5801-8542. Contact details updated: October 12, 2026.

Initial release availability

  • Availability by country or region follows the actual distribution settings in each store. Store distribution restrictions do not determine your nationality or current location and do not mean that the server applies a blanket residence-country block. The initial Android release additionally excludes the countries and territories grouped by Google Play as “Rest of the world.”