Privacy Policy

1. Who we are

Tagbo is a mobile app for Android and iOS. The data controller, the party that decides how and why your personal data is processed, is:

• Name: Alberto Rivas Ramos, an individual developer based in Spain
• Contact email: support@tagbo.app

This policy applies to the Tagbo app and to this website. If you have any question about it, write to us at the address above.

2. Data we process

We only process the data that Tagbo needs to work. Depending on how you use the app, that is:

• Identity and account. When you first open the app we create an anonymous account for you, with no name, email or password. If you choose to link your account with Google (Android) or Apple (iOS), we receive the email address and the sign-in provider from that account. If Apple hides your email behind a private relay address, we do not show it. Your sign-in credentials stay with Google or Apple.
• Display name. The first time other people can see you (when you join a shared space or invite someone) we ask for a name. It is 1 to 50 characters, is the same in all your spaces and is stored on our servers.
• Your inventory. The spaces you create (name and colour), the sections inside them (name and free-text location), and the items inside each section (name and quantity). This content is yours and can include anything you decide to write.
• NFC tags. When you scan an NFC sticker, Tagbo reads its factory identifier (UID) to link it to a section. The app never writes anything to the tag. The UID is stored with the section it is linked to.
• Sharing. Space memberships, the role of each member (owner, editor or viewer), invitation codes and the time you last opened each space.
• Subscription. If you subscribe, the purchase is handled by Apple or Google and processed through our subscription provider. We receive your subscription status and plan, not your payment details.
• Usage analytics. Anonymous events about how the app is used, as described in the section on analytics below.
• On your device only. Your theme preference, your recent search history and a local copy of your inventory so the app works offline. These are not sent to us, except the local copy, which is a cache of data that is already on our servers.

Tagbo does not use your device's GPS location. The “location” of a section is a free-text note you write yourself, such as “storage room, top shelf”. We do not run ads and we do not use advertising identifiers.

3. How we use your data and why

Each use of your data has a legal basis under the GDPR:

• To provide the app (account, inventory, syncing across your devices, sharing spaces, subscriptions). Legal basis: performance of the contract, Article 6(1)(b).
• To measure and improve the app with anonymous usage statistics. Legal basis: our legitimate interest in understanding which features are useful, Article 6(1)(f). You can object at any time (see Your rights).
• To keep the service secure and prevent abuse, for example by limiting repeated attempts to enter invitation codes. Legal basis: legitimate interest, Article 6(1)(f).
• To comply with the law when we are required to, Article 6(1)(c).

We do not sell your data, we do not use it for advertising and we do not use it to make automated decisions about you.

4. Analytics

We use Mixpanel to understand how the app is used, for example how many people create their first section or how scans end. The analytics are designed to measure usage, not people:

• Events are tied to a random identifier generated by Mixpanel on your installation. It is not linked to your account and it is renewed when you sign out, delete your account or sign in to an existing account.
• We never send your email, your display name, your account ID or any content you create (names of spaces, sections or items, locations, search text, tag UIDs or invitation codes).
• Each event carries general context only: whether your account is anonymous or linked, whether your device has NFC, your system region and language, and whether you were online.
• IP-based location is turned off. Data is hosted in the EU region of Mixpanel and kept for at most 25 months.
• Analytics data is used only to measure the use of the app. It is not used for advertising, to send you messages or to decide what you see, and it is not passed on to anyone else.
• Debug builds of the app do not send analytics.

There is not yet a switch in the app to turn analytics off. Until there is, you can object by contacting us (see Contact) and we will honour your request.

5. Who we share data with

We share data only with the providers that help us run Tagbo, and only what each of them needs. They act as processors on our behalf under a data processing agreement:

• Supabase: authentication, database and real-time sync. Your data is hosted in the European Union (Ireland).
• Mixpanel: anonymous usage analytics, hosted in the EU.
• RevenueCat: management of subscriptions and entitlements. The payment itself is made through Apple App Store or Google Play, which are independent controllers of your payment data.
• Google and Apple: sign-in when you link your account, and distribution of the app through Google Play and the App Store.

Other people can see part of your data when you share a space. Members of a space see its content and the display name and initials of the other members. Only the owner of a space can also see the email address of its members. Your own spaces are visible only to you and to the people you invite.

We may disclose data if the law requires it, for example to answer a valid request from a court or authority.

6. Security

We protect your data with measures that are standard for this kind of service:

• Access to every table is restricted on the server so that you can only reach your own data and the spaces you belong to, and the permissions of each role are enforced on the server, not just in the app.
• Data travels over encrypted connections.
• Reading an NFC tag never grants access to anything: knowing a tag's identifier does not give access to its content.

No system is perfectly secure. If a breach affects your personal data we will notify you and the authorities as the law requires.

7. How long we keep data

• Your account and inventory are kept while your account exists. If you stop paying, nothing you created is deleted: spaces beyond the free plan become read-only.
• Deleted content is removed from our servers when you delete it or your account. Copies in backups are overwritten as part of the regular backup cycle of our hosting provider.
• Anonymous accounts that never completed setup and have been inactive for a long time are removed in periodic clean-ups.
• Invitation codes expire 24 hours after they are created and each works only once.
• Analytics are kept for at most 25 months.
• Billing records are kept by Apple, Google and RevenueCat as the law requires. We only keep your subscription status (plan and expiry date) so the app knows what you have access to; we never see your payment details.

8. Deleting your account and data

If your account is linked, you can delete it from the app: open Profile, choose Delete my account and type DELETE to confirm. Deleting your account:

• deletes every space you own, with its sections and items, for all of its members. Anyone you shared a space with loses access to it, and the app tells you how many people are affected before you confirm;
• removes you from the spaces of other people, without touching their content;
• frees the NFC tags of your spaces so they can be used again;
• clears the app data stored on your device. This cannot be undone.

If you no longer have the app, write to support@tagbo.app from the email address of your account with the subject “Delete my account” and we will delete it for you.

If you use Tagbo with an anonymous account, uninstalling the app removes your data from your device and you lose access to it. What remains on our servers is not accessible to anyone and is removed in the clean-ups described above. You can also ask us to delete it.

Deleting your account does not cancel a subscription. Cancel it in your App Store or Google Play subscription settings.

9. Your rights

Under the GDPR and similar laws you have the right to:

• access the personal data we hold about you and get a copy;
• correct data that is wrong, for example by changing your display name in Profile;
• delete your data (see above);
• restrict or object to certain processing, including analytics based on our legitimate interest;
• receive your data in a portable format. The app does not have an export feature yet, so ask us and we will send it to you;
• withdraw any consent you gave, without affecting the processing done before.

To exercise any of these rights, contact us. We will answer within one month. You also have the right to complain to your data protection authority. In Spain that is the Agencia Española de Protección de Datos (aepd.es).

10. International transfers

Some of our providers may process data outside the European Economic Area, for example in the United States. When that happens we rely on the safeguards the GDPR allows, such as the European Commission's adequacy decisions or Standard Contractual Clauses. Your inventory (Supabase) and analytics (Mixpanel) are hosted in the EU. RevenueCat, which manages subscriptions, is based in the United States.

11. Children

Tagbo is not directed to children and we do not knowingly collect personal data from anyone under 14. If you believe a child has given us personal data, contact us and we will delete it. Parents and guardians who want to review or delete a child's data can write to us at any time.

12. Changes to this policy

We may update this policy when the app or the law changes. The date at the top of the page shows the latest version. If a change is significant we will tell you in the app or by another suitable means before it applies.

13. Contact

For any question about this policy or to exercise your rights, write to support@tagbo.app. You can also write to the postal address in the first section.