Tap Privacy Policy
Effective 16 October 2026
This policy explains what data the Tap Tap Tap game collects when you play on Android, on iPhone or in your browser at tap.ciraly.com, why we collect it, and the choices and rights you have. We keep data to the minimum the game needs to work.
In short: there are no sign-ups, emails or passwords. The game gives your device a random player id. We store your player name, game results, friends and chats so online play works. The mobile apps show Google AdMob banner ads. The website and browser game have no ads, no analytics and no cookies. You can delete everything yourself from the game’s home screen.
1. Who we are
Tap Tap Tap is made by Ciraly, which is the data controller for the personal data described here. Contact: gamessupport@ciraly.com.
2. What we collect
| Data | What it is |
|---|---|
| Player id | A random id the game creates on your device the first time you open it. It is not your phone’s hardware id, phone number or advertising id. |
| Device type | Whether you play on Android, iPhone or the web. |
| Player name | “Tappa” plus a number, or a name you choose. |
| Game data | Stars, wins, losses and draws, results of online matches (tap counts per round), leaderboard scores, and same-device match results. |
| Friends | Players you add, and friend requests you send or receive. |
| Chat messages | Messages you send to other players, with your name and the time. They are kept so the conversation is there next time you meet. |
| Online status | Whether you are connected right now and whether you are in a match. This is held in memory only and never stored. |
| Technical data | Your IP address, needed to connect to our server and to limit abuse (for example, how many new players one address creates per minute). Our web server keeps standard access logs. |
| Session token | A login token for your device. It expires after 60 days. |
On your device, the game stores your player id, session token, your last 5 games, your player names for same-device play and your round-length choice. The website stores only whether you dismissed the privacy notice. None of this is a cookie and none of it is used for tracking.
We do not collect your real name, email address, phone number, contacts, photos, location or payment details.
3. Advertising (mobile apps only)
The free Android and iPhone apps show a small banner ad from Google AdMob at the bottom of the menu screens. No ad is shown while you play a round. The website and the browser version of the game show no ads.
To show and measure ads, Google may collect your device’s advertising id, IP address, device and app information, and how you interact with ads. Google acts as an independent controller for this data. See how Google uses data from apps that use its services and the Google Privacy Policy.
- EEA, UK and Switzerland: before personalised ads are shown, Google’s consent form asks for your choice. Without consent, only non-personalised or limited ads are shown.
- iPhone: the app asks for permission to track (App Tracking Transparency). If you choose “Ask App Not to Track”, your advertising id is not shared.
- Android: you can delete or reset your advertising id in Settings → Privacy → Ads, which stops personalised ads.
4. How and why we use data
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Running the game: your player, matchmaking by stars, online matches, rankings, friends, invites and chat | Performance of a contract — providing the game you asked to play |
| Keeping play fair and safe: checking tap counts on the server, limiting abuse, fixing bugs, protecting the service | Legitimate interests — a fair and working game |
| Personalised ads in the mobile apps | Consent, where the law requires it |
| Non-personalised ads in the mobile apps | Legitimate interests — keeping the game free |
| Complying with the law and answering your requests | Legal obligation |
We do not use your data for automated decisions with legal or similarly significant effects. Matchmaking simply pairs players with similar star counts.
5. Who can see or receive data
- Other players see your player name, stars, rank, online status and your results in matches with them. The leaderboard shows the top players’ names and scores. Your chat messages are seen by the player you chat with.
- Service providers who host our server and database process data for us under contract and only on our instructions.
- Google receives the advertising data described in section 3 (mobile apps only).
- Authorities, if the law requires it.
We do not sell your personal data.
6. Where data is stored
Our game server is located in the United States. If you play from the EEA, UK or Switzerland, your data is transferred there. We rely on appropriate safeguards for these transfers, such as the European Commission’s Standard Contractual Clauses offered by our hosting providers.
7. How long we keep it
- Your player, game data, friends and chats are kept while you play, until you delete them.
- When you delete your data, your player, stars, friends, friend requests, chats and leaderboard scores are erased. Results of matches you played remain only in anonymous form (“Deleted player”), so your opponents’ history stays correct.
- Session tokens expire after 60 days.
- Abuse-limit records of IP addresses are held in memory for about a minute. Server access logs are kept for a short period for security and then deleted.
8. Your rights under the GDPR and UK GDPR
If you are in the European Economic Area, the United Kingdom or Switzerland, you have the right to:
- Access the personal data we hold about you and get a copy.
- Rectification: correct it. You can change your player name at any time by tapping it on the home screen.
- Erasure: have it deleted. Tap Delete my data at the bottom of the game’s home screen, or see how to delete your data.
- Restriction of processing in certain cases.
- Data portability: receive your data in a machine-readable format.
- Object to processing based on legitimate interests.
- Withdraw consent for personalised ads at any time (see section 3). This does not affect processing before you withdrew.
- Complain to your local data protection authority.
Because we don’t ask for your name or email, include your player name and device type (Android, iPhone or web) when you email gamessupport@ciraly.com, so we can find your player. We answer within one month.
9. US state privacy rights
Residents of California and other US states with privacy laws can ask to know, correct or delete their personal data using the same options above. We do not sell personal data for money. Personalised ads in the mobile apps may count as “sharing” or “targeted advertising” under some state laws. To opt out, turn off ad tracking on your device (iPhone: don’t allow tracking; Android: delete your advertising id). We will not treat you differently for using these rights.
10. Children
Tap Tap Tap is a general-audience game and is not directed at children under 13 (or under the age of digital consent in your country). We do not knowingly collect personal data from children. If you believe a child has given us personal data, email us and we will delete it.
11. Security
Connections to our server use HTTPS. Session tokens are stored on our server only in hashed form, and access to the database is restricted. No system is perfectly secure, but we work to protect your data and will inform you and the authorities of a breach where the law requires it.
12. Changes and contact
If we change this policy we will update the date at the top of this page, and for significant changes we will tell you in the game. Questions or requests: gamessupport@ciraly.com.