Privacy Policy
Effective 16 July 2026 · Applies to the TapMax iOS app and gettapmax.com
TapMax recommends which of your cards to pay with. It was designed so that the most sensitive things — your card numbers and your location — are never in our hands at all. This page explains, in plain language, exactly what we do and don't collect.
The short version: we never see or store full card numbers. Your location never leaves your phone. We don't sell data, show ads, or use trackers. We store the minimum needed to sign you in and remember which cards you told us you own.
What we store
- Your email address — used to sign you in (via a one-time code, Apple, or Google) and, if you contact us, to reply.
- Your card list — which card products you added (e.g. "a Skywards card"), an optional nickname, and optionally the last 4 digits so you can tell cards apart. Each account can only read its own rows, enforced by database row-level security.
What we deliberately never store
- Full card numbers, expiry dates, or CVVs. When you scan a card, the number is read on your phone and immediately discarded. Only the last 4 digits are kept. The first digits (which identify the issuing bank, not your account) are used once to detect your bank; if we can't identify the bank ourselves, that bank-identifier prefix may be checked against a lookup service over an encrypted connection, and unrecognised prefixes are logged anonymously so our own coverage improves.
- Your location. The optional "smart nudges" feature works entirely on your device: your phone detects an arrival, looks up the venue, runs the recommendation locally, and shows a local notification. No location data is transmitted to us or anyone else.
- Your transactions. TapMax doesn't connect to your bank accounts and can't see what you spend.
Services we rely on
- Supabase — hosts our database and sign-in system (data encrypted in transit and at rest).
- Apple / Google sign-in — if you choose them, we receive your email address (or Apple's private relay address) and nothing else. Apple's "Hide My Email" is fully supported.
- Resend — delivers our sign-in code emails.
- GitHub Pages — hosts this website.
The website
gettapmax.com uses no cookies, no analytics, and no trackers. To show you a region-appropriate demo, your browser asks a geolocation service (ipwho.is) for your country code; that request goes directly from your browser and we never receive or store it.
Card offers & rules data
The reward rules and promotions shown in the app describe card products, collected from banks' public websites. This dataset contains no personal information.
Deleting your data
Everything is self-serve in the app: Settings → Delete all my cards removes your cards, and Settings → Delete my account permanently erases your account and everything associated with it, immediately. You can also email vinshu.gupta@gettapmax.com from your sign-up address and we'll do it for you.
What we don't do
- No selling or sharing of personal data.
- No advertising, no cross-app tracking (we don't use the iOS tracking framework at all).
- No profiling of children — TapMax is not directed at anyone under 16.
Changes & contact
If this policy changes materially, we'll update this page and the effective date above. Questions: vinshu.gupta@gettapmax.com.