Privacy Policy

1. Information we collect

Account information. We collect information you provide when registering or managing an account, which may include your email address, organization name, account settings, and preferences, and a record of when you agreed to these terms. Authentication is handled through Supabase. Navtaps does not store readable passwords.

Content and configuration information. We process the URLs, tag and QR code link names, names, descriptions, landing-page content, logos, button configurations, schedules, redirect settings, and other information you enter into the service.

Uploaded files. Files you upload, including supported PDF, JPG, and PNG files, are stored using Cloudflare R2. The files may be delivered to people who access the associated published link, page, tag, or QR code. Links inside uploaded PDFs may be checked for threats.

Account activity. We keep records of account changes, such as changes to destinations, uploads, schedules, and settings, including which login made each change, as well as records of support or administrative access and other events needed to operate and secure the service.

Visitor and technical information. When a person visits the website or accesses a tag, QR code, redirect, or hosted file, our providers may process technical information such as IP address, browser or device information, request time, network information, and server or security logs. We do not require a visitor to create an account to scan a tag or follow a public link.

2. How we use information

We use information to create and administer accounts; provide redirects, hosted pages, and file delivery; store user settings and content; provide support; send account, security, and service notices; check URLs for potential threats; detect misuse; troubleshoot and maintain the service; protect users and infrastructure; comply with legal obligations; and enforce our Terms of Service.

3. Information about people who tap or scan

When someone taps a tag, scans a QR code, or taps a button on a Navtaps page, Navtaps records which card or button was used and the time, so organizations can see how often their tags are used. Navtaps does not store the visitor's name, IP address, device, or location with that record, and does not try to identify the person.

Our hosting, network, and security providers (see Section 5) may process technical information, including IP addresses and request logs, as part of delivering and protecting the service, under their own policies.

4. Public content and sensitive information

Content published through Navtaps may be accessible to anyone who has or obtains the relevant link, scans the QR code, taps the NFC tag, or reaches the published page. Tags and QR codes can be copied, photographed, forwarded, or shared. Navtaps is not a confidential document-storage or private file-sharing service.

Do not upload or publish passwords, access codes, private Wi-Fi credentials, customer or membership lists, children's identifying details, health or counseling information, financial account information, or other information that should not be public. Organizations are responsible for deciding what content to publish and for obtaining any permissions or consents required by law.

5. Service providers and sharing

We use third-party providers to operate Navtaps. These providers may process information on our behalf or independently as described in their own privacy terms and configurations.

• Cloudflare hosts the website and provides Cloudflare R2 storage for uploaded files. Cloudflare may process website requests, file requests, IP addresses, and technical logs. If the "are you human" check (Cloudflare Turnstile) is turned on, it runs on login and sign-up pages. Cloudflare privacy policy.
• Supabase provides login and database services. Account, authentication, and service data is stored with Supabase. Supabase privacy policy.
• Google Web Risk checks links for known scams, phishing, and malware. The links being checked are sent to Google. Google privacy policy.
• Google Fonts supplies the fonts our pages use, so your browser requests them from Google, which receives your IP address. Google privacy policy.
• Resend sends account emails, such as alerts when a tap card changes. Your email address and the message content are sent to Resend. Resend privacy policy.
• Have I Been Pwned checks whether a new password has appeared in known data breaches. Only the first five characters of a scrambled code made from the password are sent; the password itself never leaves your browser.
• Payment buttons on booth pages link straight to a vendor's own Cash App, Venmo, PayPal or Square account. Navtaps doesn't process or see those payments; the payment service's own privacy policy applies. Payment processor. Navtaps does not take payments during the beta. If paid plans are offered later, payments will be handled by a third-party payment processor, which we will name in or alongside the payment flow. Navtaps does not intend to store full payment card numbers or card security codes.

We may also disclose information when reasonably necessary to comply with law or legal process, protect the rights or safety of users or others, investigate suspected fraud or misuse, enforce our agreements, or protect the service. We do not sell personal information, and we do not use advertising or tracking cookies.

6. Support and administrative access

Authorized Navtaps support personnel may access account information when reasonably necessary to respond to a support request, troubleshoot a problem, investigate misuse, maintain security, or operate the service. Each time support opens an account, it is logged and shown on that account's Settings page. Support personnel do not change a user's tags, links, or files, except to turn off a card or account when necessary to address security, abuse, or legal concerns; the account owner is notified when that happens.

7. Email and service communications

We may email account owners about registration, account changes, security events, destination or file changes, service operations, policy updates, and support matters. These operational messages are part of providing the service. Keep your account email address current and secure.

8. Data retention and deletion

We retain information for as long as reasonably necessary to provide and secure Navtaps, maintain account functionality, comply with legal obligations, resolve disputes, and enforce agreements. For example, change history and replaced files are kept for at least 90 days so changes can be undone, and tap counts are kept while the account exists. Retention periods may vary by information type and provider.

To request account closure or deletion of eligible information, email [email protected]. When an account is closed, related tags, QR codes, redirects, hosted pages, and files may be disabled or deleted. Some information may remain temporarily in backups, logs, or records retained for security, legal, or legitimate operational purposes. Download files you wish to keep before closing an account.

9. Security

We use reasonable administrative and technical safeguards intended to protect information, including database rules that keep each organization's data separate, optional two-factor login, required two-factor login for Navtaps staff, and security features provided by our hosting, storage, and authentication providers. No website, application, storage system, or internet transmission can be guaranteed completely secure. We cannot promise that unauthorized access, data loss, or security incidents will never occur. Protect your credentials and notify us promptly if you suspect account compromise.

10. Children's privacy

Navtaps accounts are intended for adults aged 18 or older. The service is not designed to collect personal information directly from children under 13. Organizations are responsible for ensuring that content they publish, including photographs or identifying information about children, is handled with appropriate authority and consent and in compliance with applicable law.

11. Your choices and privacy requests

You may contact us to request assistance updating account information, correcting information, closing an account, or deleting eligible personal information. We will review and respond to requests in accordance with applicable law. We may need to verify your identity or authority before acting on a request. Email: [email protected].

12. U.S. state privacy rights

Depending on where you live and whether applicable legal thresholds are met, you may have rights concerning personal information, such as the right to request access, correction, or deletion, or to appeal certain decisions. To submit a request, email [email protected]. We will respond as required by applicable law. This section does not create rights beyond those provided by law.

13. Changes to this Privacy Policy

We may update this policy as Navtaps changes or as legal requirements evolve. We will revise the effective date when changes are made and provide notice of material changes through the website, by email, or through the service where appropriate. The updated policy will apply from its stated effective date, subject to applicable law.

14. Contact

For questions, privacy requests, or concerns about this policy, contact Navtaps Support at [email protected]. Current operator: James M. Franklin Jr., an individual.