Last updated: April 26, 2026
Tappy ("we," "our," or "us") operates the tappy.sh website and the Tappy platform (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service. For personal data processed in connection with the Service, Tappy is the controller for account, billing, website, and product analytics data, and acts as a processor where customers use Tappy to process data from their own connected sources.
When you create an account, we collect your name, email address, and authentication credentials. We use Clerk for authentication and do not store passwords directly.
We automatically collect information about how you interact with the Service, including pages visited, features used, and actions taken. This helps us improve the product.
When you connect external data sources (databases, spreadsheets, SaaS tools, websites), we store the connection credentials securely. We query your data sources on your instructions. Some source data is processed transiently in memory or short-lived caches, while data you choose to upload, save, materialize as an API/Web Source, place into a document, or freeze as a snapshot is stored until you delete it or close your account.
We store the documents you create on our platform, including text, code blocks, data block configurations, rendered outputs, document images, uploaded files, chat history, and frozen snapshots. This is necessary to provide the Service.
We use the information we collect to:
We do not sell your personal information. We do not use your document content or connected data to train machine learning models.
Where UK GDPR or GDPR applies, our main lawful bases are: contract necessity to provide the Service you request; legitimate interests for security, abuse prevention, service improvement, and basic business operations; consent for optional product analytics and OAuth connections; and legal obligation for tax, accounting, compliance, and lawful requests.
We use the following third-party services ("sub-processors") to operate the platform. A current, authoritative list is also published at /trust.
A Data Processing Agreement (DPA) is available on request by contacting privacy@tappy.sh.
Tappy's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
We access Google Drive files only through the file picker (scope drive.file) — we do not request read access to your entire Drive. Google Sheets selected by you are accessed as Drive files and exported in a readable workbook format. We use Google user data only to show, query, analyze, refresh, and include the selected files or sheets in your Tappy documents, and to provide user-facing AI features that you request.
We do not sell Google user data, do not use it for advertising, and do not use it to train machine-learning models. We do not allow humans to read Google user data unless you ask us to troubleshoot a specific issue, it is necessary for security or abuse investigation, or we are required to do so by law. Transfers are limited to sub-processors needed to provide the Service, such as hosting, storage, and AI model providers acting on your instructions. You can revoke Google access in Tappy or from your Google Account permissions page, and account deletion removes stored Google OAuth tokens and saved Google file references from our systems.
The Service uses AI models to generate text, code, SQL, charts, and analysis. AI outputs may contain errors, omissions, or inaccuracies. You are responsible for reviewing AI outputs before relying on or acting on them. Do not use the Service to make consequential decisions (medical, legal, financial, safety-critical) without independent verification.
We implement industry-standard security measures to protect your information. All data connections use OAuth2 or encrypted credentials. Data is encrypted in transit (TLS 1.2+) and at rest. Code execution happens in isolated sandboxes that are destroyed after each run.
However, no method of electronic storage or transmission is 100% secure. While we strive to protect your information, we cannot guarantee absolute security.
We keep the minimum data needed to run the Service and no longer. When you delete your account, we delete the data below within 30 days, except where retention is required by law. Frozen document snapshots are retained until you explicitly delete them.
| Data category | Retention while account is active | After deletion |
|---|---|---|
| Profile (name, email, auth records) | Life of account | Deleted within 30 days |
| Documents, notes, workspace knowledge, chat history | Life of account | Deleted within 30 days |
| OAuth tokens + encrypted source credentials | Until you disconnect the source | Deleted within 30 days |
| Materialized API / web source rows | Until you delete the source | Deleted within 30 days |
| Uploaded files, document images, and code-output files | Until you delete the file, block, document, or account | Deleted within 30 days |
| Short-lived query, schema, and analysis caches | Usually minutes to 30 days depending on cache type | Expired automatically or cleared during account deletion where user-scoped |
| Credit balance + credit transaction log | Life of account | Deleted within 30 days |
| Billing records (invoices, payment history, held by Stripe) | 7 years (tax law) | Retained for up to 7 years |
| Security / abuse logs | 12 months (fraud prevention) | Up to 12 months |
| Encrypted database backups | Rolling 35 days | Overwritten within 35 days |
To delete your account and data, follow the instructions at /data-deletion or email privacy@tappy.sh.
Depending on your jurisdiction (including under GDPR and the UK GDPR), you may have the right to:
To exercise any of these rights, contact privacy@tappy.sh. We respond within 30 days.
If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the CPRA, grants you additional rights:
To exercise any California Privacy right, email privacy@tappy.sh. We may need to verify your identity before actioning the request.
In the unlikely event of a personal-data breach that poses a risk to your rights and freedoms, we will notify affected users and the relevant supervisory authority (ICO in the UK, or the lead EU DPA) without undue delay and, where feasible, within 72 hoursof becoming aware of the breach. Notices will describe the nature of the breach, the categories and approximate number of data subjects affected, likely consequences, and the measures we've taken or propose to take. We maintain a written incident-response runbook to support this commitment.
Tappy is operated from the United Kingdom and uses sub-processors located in the United States, the European Union, and the United Kingdom. Where personal data is transferred outside the UK/EEA, we rely on Standard Contractual Clauses (SCCs) or equivalent adequacy mechanisms offered by the relevant sub-processor.
We use privacy-friendly product analytics (PostHog, hosted in the EU) to understand how the product is used. You control analytics with the cookie banner and in-app Settings:
We never sell or share analytics data, never use cross-site advertising, and never record sessions or keystrokes. You can change your consent choices any time from the in-app Settings (optional categories can be withdrawn independently, per GDPR Art. 7(3)).
Non-exhaustive list — all values listed are metadata. We do not send prompts, chat messages, document text, source row data, URLs, filenames, SQL, schemas, hostnames, API keys, OAuth tokens, cookies, or request headers to PostHog.
$pageview — URL path (no query strings)document_created / document_opened — creation source and count bucketschat_message_sent — model tier, whether attachments used. No message text.chat_model_switched — previous and new model idsource_connected / source_removed / source_tested / source_refreshed — provider type, success flag, and count buckets onlyweb_source_extracted / api_source_discovered — success, auth kind, and row/table/column buckets onlysuggestion_decided — accept/reject action, suggestion-count bucket, block type, and suggestion type only. No suggested content.share_link_created / share_link_updated — access mode and allowed-recipient count bucket onlyexport_started / export_completed — kind (csv/pdf/pptx), duration bucket, and document-size bucketplan_viewed, checkout_started, plan_upgraded / plan_downgradedcredits_exhausted, rate_limited — to help us understand usage patternsWe use the absolute minimum of cookies required to run the Service. No cross-site tracking, no advertising cookies, no third-party analytics cookies.
| Cookie | Set by | Purpose | Category |
|---|---|---|---|
| __session / __clerk_* | Clerk | Keeps you signed in. Required. | Essential |
| __stripe_mid, __stripe_sid | Stripe | Fraud prevention during checkout. Set only on billing pages. | Essential |
That's it. We deliberately do not set a cookie for analytics — our product-analytics provider (PostHog) is configured to use browser localStorage only, and it only runs after you grant analytics consent in the cookie banner.
You can revoke analytics consent at any time in the in-app Settings privacy preferences, or by clearing localStorage for tappy.sh in your browser's developer tools. Account deletion instructions are at /data-deletion.
The Service is not intended for users under the age of 16. We do not knowingly collect information from children under 16.
We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the new policy on this page and updating the "Last updated" date. Continued use of the Service after changes take effect constitutes acceptance of the updated policy.
If you believe you've found a security issue in Tappy, please report it privately to security@tappy.sh. We appreciate responsible disclosure and will respond within 5 business days. Please give us a reasonable opportunity to investigate and remediate before public disclosure.
The data controller is TAPPY LTD, a company registered in England and Wales. Company number: 17188908. Registered office: 167-169 Great Portland Street, London, England, W1W 5PF.
If you have any questions about this Privacy Policy, contact us at privacy@tappy.sh.