Privacy Policy

Effective 22 October 2026

This policy explains what data the Tap Tap Tap game collects when you play on Android, on iPhone or in your browser at tap.ciraly.com, why we collect it, and the choices and rights you have. We keep data to the minimum the game needs to work.

1. Who we are

Tap Tap Tap is made by Ciraly, which is the data controller for the personal data described here. Contact: gamessupport@ciraly.com.

2. What we collect

Data	What it is
Player id	A random id the game creates on your device the first time you open it. It is not your phone’s hardware id, phone number or advertising id.
Device type	Whether you play on Android, iPhone or the web.
Player name	“Tappa” plus a number, or a name you choose.
Game data	Stars, wins, losses and draws, results of online matches (tap counts per round), leaderboard scores, and same-device match results.
Friends	Players you add, and friend requests you send or receive.
Quick-chat messages	Preset messages and emoji you send to other players (there is no typing, so no personal details can be shared), with your name and the time. They are kept so the conversation is there next time you meet.
Online status	Whether you are connected right now and whether you are in a match. This is held in memory only and never stored.
Technical data	Your IP address, needed to connect to our server and to limit abuse (for example, how many new players one address creates per minute). Our web server keeps standard access logs.
Session token	A login token for your device. It expires after 60 days.

On your device, the game stores your player id, session token, your last 5 games, your player names for same-device play and your round-length choice. The website stores only whether you dismissed the privacy notice. None of this is a cookie and none of it is used for tracking.

We do not collect your real name, email address, phone number, contacts, photos, location or payment details.

3. Advertising (mobile apps only)

The free Android and iPhone apps show a small banner ad from Google AdMob at the bottom of the menu screens. No ad is shown while you play a round. The website and the browser version of the game show no ads.

Because the game is for everyone, children included, every ad request is marked as child-directed and under the age of consent. This means Google shows only ads rated suitable for general audiences (G), shows no personalised or interest-based ads, and does not use your device’s advertising id for ads. The Android app does not have permission to read the advertising id, and the iPhone app never asks to track you. Google may still process limited technical data (such as IP address and device type) to deliver and count ads, under its policies for child-directed treatment and the Google Privacy Policy.

4. How and why we use data

Purpose	Legal basis (GDPR Art. 6)
Running the game: your player, matchmaking by stars, online matches, rankings, friends, invites and chat	Performance of a contract — providing the game you asked to play
Keeping play fair and safe: checking tap counts on the server, limiting abuse, fixing bugs, protecting the service	Legitimate interests — a fair and working game
Family-safe, non-personalised ads in the mobile apps	Legitimate interests — keeping the game free
Complying with the law and answering your requests	Legal obligation

We do not use your data for automated decisions with legal or similarly significant effects. Matchmaking simply pairs players with similar star counts.

5. Who can see or receive data

• Other players see your player name, stars, rank, online status and your results in matches with them. The leaderboard shows the top players’ names and scores. Your quick-chat messages are seen by the player you chat with.
• Service providers who host our server and database process data for us under contract and only on our instructions.
• Google receives the advertising data described in section 3 (mobile apps only).
• Authorities, if the law requires it.

We do not sell your personal data.

6. Where data is stored

Our game server is located in the United States. If you play from the EEA, UK or Switzerland, your data is transferred there. We rely on appropriate safeguards for these transfers, such as the European Commission’s Standard Contractual Clauses offered by our hosting providers.

7. How long we keep it

• Your player, game data, friends and chats are kept while you play, until you delete them.
• When you delete your data, your player, stars, friends, friend requests, chats and leaderboard scores are erased. Results of matches you played remain only in anonymous form (“Deleted player”), so your opponents’ history stays correct.
• Session tokens expire after 60 days.
• Abuse-limit records of IP addresses are held in memory for about a minute. Server access logs are kept for a short period for security and then deleted.

8. Your rights under the GDPR and UK GDPR

If you are in the European Economic Area, the United Kingdom or Switzerland, you have the right to:

• Access the personal data we hold about you and get a copy.
• Rectification: correct it. You can change your player name at any time by tapping it on the home screen.
• Erasure: have it deleted. Tap Delete my data at the bottom of the game’s home screen, or see how to delete your data.
• Restriction of processing in certain cases.
• Data portability: receive your data in a machine-readable format.
• Object to processing based on legitimate interests.
• Complain to your local data protection authority.

Because we don’t ask for your name or email, include your player name and device type (Android, iPhone or web) when you email gamessupport@ciraly.com, so we can find your player. We answer within one month.

9. US state privacy rights

Residents of California and other US states with privacy laws can ask to know, correct or delete their personal data using the same options above. We do not sell personal data for money. The mobile apps show no personalised or targeted ads. We will not treat you differently for using these rights.

10. Children

Tap Tap Tap is suitable for all ages, including children under 13. We designed it so children can play safely, in line with the US Children’s Online Privacy Protection Act (COPPA), the GDPR rules for children and the UK Age Appropriate Design Code:

• No sign-up, email, phone number, real name, photo, location or contacts are ever asked for.
• Player names are checked against a list of offensive words, and chat uses preset messages and emoji only, so players cannot type or share personal details.
• Ads are family-safe (G-rated), non-personalised and child-directed, with no ad tracking (see section 3).
• A parent or guardian can delete all of a child’s data at any time with “Delete my data” in the game, or by emailing us.

If you are a parent and have any question about your child’s data, email us and we will help.

11. Security

Connections to our server use HTTPS. Session tokens are stored on our server only in hashed form, and access to the database is restricted. No system is perfectly secure, but we work to protect your data and will inform you and the authorities of a breach where the law requires it.

12. Changes and contact

If we change this policy we will update the date at the top of this page, and for significant changes we will tell you in the game. Questions or requests: gamessupport@ciraly.com.