Privacy Policy

The controller of your personal data is Cre8-it B.V., the operator of Tapinto (registered seat: Harderwijk; business address: Baron van Nagellstraat 136, 3771 LL Barneveld, the Netherlands; KvK number: 42147119; VAT number: NL869923651B01). You can reach us at [email protected].

We process the following categories of personal data:

• We do not run third-party advertising or ad-retargeting scripts on tapinto.dev. There is no ad pixel, no tag manager, and no third-party cookie. If you arrive from an ad, we do read the click identifier the ad network put in the URL — see Section 7.
• We do not sell, rent, or share your data with data brokers.
• We do not use anything that passes through your tunnel for any purpose of our own. It is not used to train machine-learning models, it is not shared, and it never reaches our analytics.
• We do not keep the headers of requests that pass through your tunnel, and we do not record the IP addresses of the people who call it. Both are forwarded to your machine and then discarded.

We do capture request and response bodies — that is what the live inspector shows you. Up to 8 KB of each is held for 24 hours so the inspector has something to display when you open it. There is no opt-out today, so if a tunnel would carry data you are not willing to have buffered for a day, do not route it through Tapinto. The Data Processing Agreement sets this out in full.

Everything we store is stored in the EU. The Service runs in Microsoft Azure’s West Europe region (Netherlands), and that is where account records, API key hashes, tunnel metadata, usage records and inspector events live. None of it is replicated outside the EU.

Data in transit is a different question and we would rather answer it precisely. Cloudflare sits in front of both tapinto.dev and tapinto.it, terminating TLS and forwarding to our origin. It serves each visitor from the point of presence nearest them, so a request that starts outside the EU is handled outside the EU before it reaches our infrastructure. Where that is a transfer of personal data out of the EEA, it is governed by the European Commission’s Standard Contractual Clauses in Cloudflare’s Data Processing Addendum.

GitHub (Section 6) is based in the United States and receives the OAuth handshake when you sign in. That transfer relies on the same Clauses in the GitHub Data Protection Agreement.

We rely on a small set of sub-processors. Each processes personal data under a data-processing agreement (DPA) — in every case the provider’s standard DPA, incorporated into the terms we accepted when engaging them, rather than an individually negotiated contract. The applicable agreement is named against each entry below.

We will update this list before adding a new sub-processor. If you have a contract with us that requires advance notice of sub-processor changes, we will honour that notice period.

Strictly necessary cookies are set for everyone. Analytics cookies are set only after you accept them in the cookie banner, and you can decline without losing any functionality.

Strictly necessary

• __Host-tapinto_session — a signed HTTP-only cookie that keeps you signed in. Expires when you sign out or after 30 days of inactivity.
• tapinto_oauth_state and tapinto_oauth_return — short-lived cookies that protect the GitHub sign-in flow against cross-site request forgery and remember which page to return you to. Deleted as soon as sign-in completes.
• tapinto_theme — remembers your light/dark theme choice. Local to your browser, contains no personal data.
• tapinto.cookie-consent — stores your cookie choice so we do not ask again. Held in your browser’s local storage.

Set when you arrive, before you have chosen

• tapinto_attr — records how you first arrived: campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content), advertising click identifiers (fbclid, gclid) when present in the URL you followed, the first page you landed on, and the referring site. It is a first-party cookie holding values that were already in the link you clicked, and writing it makes no third-party request. We set it on arrival so that someone who accepts analytics later still has their original source attached. If you decline, or later withdraw consent, we delete it.

Analytics (only with your consent)

• ph_* — set by PostHog to recognise a returning browser and group your visits into a session. PostHog is not loaded at all until you accept, so these do not exist before then. See the sub-processor table above.

You can change your mind at any time using the Cookie settings link in the footer of any page. Declining stops analytics capture immediately, clears the identifier PostHog uses to recognise your browser, and deletes the tapinto_attr cookie.

What the cookie banner does not control

The banner governs what runs in your browser. Separately, our servers send PostHog a small set of account lifecycle events — you signed up, you signed in, a subscription started, an invoice was paid or failed, a subscription was cancelled — identified by your Tapinto user ID. These are how we run and bill the Service rather than a browser tracking technology, so they rest on the contractual basis in Section 2 and are not affected by your cookie choice. No tunnel data, tunnel hostname or request path is included. If you want this processing restricted, Section 8 tells you how to object.

Under the GDPR (and equivalent rights under the UK GDPR and the Swiss FADP) you have the right to:

• access the personal data we hold about you;
• rectify it if it is inaccurate;
• erase it (“right to be forgotten”) — email us from your account address and we will delete your account and the data behind it within 30 days. There is no self-service delete button yet;
• restrict or object to processing based on our legitimate interests;
• port your data to another controller in a structured, machine-readable format;
• withdraw consent at any time where processing relies on consent — for analytics cookies, the Cookie settings link in the footer of any page (this does not affect prior lawful processing);
• lodge a complaint with your supervisory authority. If you are in the EU, that is the data-protection authority of the member state where you live or work.

To exercise any of these rights, email [email protected]. We respond within one month.

All traffic between you, the edge, and the control plane is encrypted in transit with TLS 1.2 or higher. Data at rest is encrypted by Azure with platform-managed keys. API keys are stored as one-way hashes; the plaintext is shown to you once and is unrecoverable thereafter. Access to the production environment is gated by managed identities, role-based access control, and audit-logged through Log Analytics.

If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours and notify you without undue delay.

Tapinto is a developer tool aimed at professional users. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, contact us and we will delete it.

We do not make decisions about you based solely on automated processing (including profiling) that produce legal or similarly significant effects.

We may update this Privacy Policy from time to time. If we make a material change, we will notify you by email (to the address on your account) and post a notice on the dashboard at least 14 days before the change takes effect. The current version is always available at tapinto.dev/privacy.

What changed on 16 August 2026

We audited this policy against the running code and found several places where it described what we intended rather than what the Service does. Those are now corrected: the inspector does retain request and response bodies and always has (Sections 2 and 3, with the real 24-hour window in Section 4); Cloudflare terminates TLS and therefore handles traffic in the clear, rather than seeing only DNS and SNI (Sections 5 and 6); the retention periods for logs, tunnel metadata and inspector data now match the infrastructure; server-side analytics events are disclosed (Section 7); the device fingerprint behind the anonymous free tier is disclosed (Section 2); and the account-deletion route is described as it actually works. We also added a Data Processing Agreement for traffic you route through a tunnel. None of this reflects a change in what the Service does — it is the description catching up with it.

Questions, complaints, or rights requests: [email protected].