Privacy Policy

1. Information We Collect

Account Information: We collect your email address, username, and encrypted credentials.

Google OAuth Data: If you sign in using Google, we receive limited profile details (email, display name, profile picture) to create your ZapTap profile. We do not access or store other Google account data (contacts, calendar, files). You can disconnect your Google login at any time through your Google account settings.

Geolocation Coordinates: Because ZapTap is a location-based app, we collect your device's GPS coordinates to verify proximity checks (≤200m range limits) for check-in events on our resolution 9 H3 spatial grid.

Waypoint Photo Uploads: If you verify checkpoints via photos, we store these snapshots securely in our Supabase `checkins` storage bucket. Folder-level owner checks ensure privacy.

Affiliate & Transaction Ledger: We record referral connections and your transaction history (commission credits earned, credit packages bought, payouts disbursed).

Payment & Payout Logs: Financial transactions are processed securely via Stripe. We do not store card details. Stripe processes payment details and Stripe Connect bank details subject to their own privacy guidelines.

2. How We Use Your Information

App Operations: To create your account, manage your ZC balance, track your streaks, and show your explorer profile.

GPS Verification & Security: To verify that your coordinates are within 200m of the venue pin. We verify this via secure backend Row-Level Security checks.

Process Stripe Payments & Commissions: To authorize Stripe credit packages, distribute 2-tier affiliate commissions (25% direct, 10% Tier 2), and disburse creator bank transfers via Stripe Connect.

Fraud Prevention: To detect GPS spoofing, coordinate warping, self-referral abuse, or card fraud.

3. Information Sharing & Disclosure

We do not sell your personal data. We transfer data only as required to operate the App:

• Google OAuth: To authenticate your identity when logging in.
• Supabase: Hosts our database and storage buckets. Photos are protected under RLS owner check parameters.
• Stripe: Processes credit packages, subscription payments, and disburses payouts to bank accounts via Stripe Connect.
• Referral Partners: Your referrer may see your username and the commissions generated by your activity. No email or billing details are shared.

4. Data Security

Passwords are hashed and salted. Storage files are secured via Supabase Row-Level Security policies. Transactions and payout data are managed using secure webhooks from Stripe. Although we maintain strict protocols, no digital system is 100% secure.

5. Your Rights & Choices

You can request to export or delete your account. Note that upon account deletion, all active Zap Credits, Streaks, custom trails, and pending affiliate commissions are permanently forfeited.

6. Children's Privacy

ZapTap is a location-based social gamification app intended for users 18 years or older. We do not knowingly collect coordinates or photo uploads from minors.

7. Changes to This Policy

We may update this policy to reflect changes in our database, storage buckets, or Stripe payment workflows. We will notify you of major updates.

8. Contact

For questions or requests, contact us at support@zaptap.link.