Privacy Policy
Last updated 22 September 2026 · Effective immediately
This privacy policy explains how Taptober — the mobile app, web app and website at taptober.com — processes personal data. It is written for users of the service and fulfils our information duties under the EU General Data Protection Regulation (GDPR) Articles 13 and 14.
- Who the data controller is
- What data we process
- Purposes and legal bases
- Who we share data with
- Transfers outside the EEA
- How long we keep data
- Your rights
- Age limit and children
- Alcohol content and geo-blocking
- Automated decisions
- Cookies and on-device storage
- Security
- Changes
- Contact and complaints
1. Who the data controller is
The controller for the personal data described here is:
Bygg Bevaring AS
Organisation number: 837 666 082
Lilletuneveien 2
1711 Sarpsborg
Norway
Privacy contact: [email protected]
We have not appointed a Data Protection Officer. For privacy questions, contact the address above.
2. What data we process
Data you give us
| Data | When | Required? |
|---|---|---|
| Email address | Registration or Google sign-in | Yes |
| Password (stored only as a bcrypt hash, never in clear text) | Registration | Yes, unless you use Google sign-in |
| Username | Registration / profile | Yes — shown publicly on leaderboards |
| Display name, avatar, bio, home city | Profile | No |
| Date of birth | Onboarding | Yes — see section 8. Cannot be changed once set |
| Home country | Onboarding / profile | Yes — determines what content you see, see section 9 |
| Consent to sponsor marketing | Onboarding / profile | No — optional; you can withdraw it any time in the app |
| Full name, email and postal address | Only when you claim a prize | Yes, to ship the prize |
If you sign in with Google
You may create an account or sign in with Google. In that case Google sends us an ID token. From it we receive only your Google account email address, a stable Google user ID, and (if provided) your display name. We never receive your Google password, contacts, Drive files, calendar, or any other Google data. We verify the token with Google before creating or linking your Taptober account.
Data created by using the service
- In-app activity: quiz answers and points, weekly activity check-ins (“streaks”), leaderboard positions, collectable badges, clan missions, challenges and tournaments, event check-ins, and friend-feed events.
- Push token if you enable notifications.
- IP address in server access logs, and when submitting quiz answers (anti-cheat / security).
- A Stripe customer ID if you buy Premium. We never receive or store your card number — payment is handled by Stripe.
We do not write a device fingerprint at login. Optional device metadata on the login request is ignored for storage.
If you use the form on the website
If you request access with your email on taptober.com, the address is forwarded to our inbox via our email provider (Resend). It is not stored in our application database. We use it only to reply to you. The legal basis is legitimate interests (Art. 6(1)(f)) — you contacted us.
Visitor statistics on the website
On taptober.com we use Cloudflare Web Analytics (and related Cloudflare performance tooling). It counts page views and helps us see whether the site works. It sets no cookies, builds no advertising profile of you, does not follow you across other sites, and shares nothing with ad networks. Cloudflare already serves our website as CDN and therefore sees your IP address regardless. The basis is legitimate interests (Art. 6(1)(f)).
There is no analytics SDK in the Taptober app — no Google Analytics, Firebase Analytics, Amplitude, Mixpanel or similar.
What we don’t do
- We use no advertising ID (IDFA/AAID) and share nothing with ad networks.
- We do not collect precise location. The app does not ask for continuous location access.
- Camera is used only for QR scanning; photo access only for your avatar.
- We do not sell personal data.
About “beer badges” and streaks: Taptober does not record what or how much you drink. Collectable badges are unlocked by quizzes and activity. A “streak” is a tap on an activity button — not a drinking log.
3. Purposes and legal bases
| Purpose | Data | Legal basis (GDPR Art. 6) |
|---|---|---|
| Create and run your account, deliver the game | Account, profile, activity | Contract, Art. 6(1)(b) |
| Google sign-in | Email, Google user ID, name | Contract, Art. 6(1)(b) |
| Leaderboards and social features | Username, points, city/country | Contract, Art. 6(1)(b) |
| Sending and delivering prizes | Name, email, postal address | Contract, Art. 6(1)(b) |
| Age-gating alcohol-related content | Date of birth | Legal obligation, Art. 6(1)(c) |
| Geo-blocking alcohol advertising | Home country | Legal obligation, Art. 6(1)(c) |
| Push notifications | Push token | Consent, Art. 6(1)(a) — revocable any time |
| Sponsor marketing | Email, consent flag | Consent, Art. 6(1)(a) — withdrawable in the app |
| Security, debugging and anti-cheat review | IP, quiz submission metadata, error logs | Legitimate interests, Art. 6(1)(f) |
| Premium payment | Stripe customer ID | Contract, Art. 6(1)(b) |
| Website operation and visitor statistics | IP (via Cloudflare), page views | Legitimate interests, Art. 6(1)(f) |
4. Who we share data with
We share only what is necessary. Processors are bound by data-processing agreements (Art. 28) where required.
| Recipient | What they get | Why | Where |
|---|---|---|---|
| Hetzner Online GmbH | All stored application and database data | Hosting | Helsinki, Finland — EEA |
| Cloudflare, Inc. | Website traffic (IP), cookieless visitor statistics, encrypted backups (R2) | CDN, website, backup storage | EU edge / Western Europe (WEUR) for R2 |
| Functional Software, Inc. (Sentry) | Error reports. Configured not to send personal data by default | Error monitoring | EU (Frankfurt — ingest.de.sentry.io) |
| 650 Industries, Inc. (Expo) | Push token and notification content | Push notifications | USA |
| Stripe, Inc. | Payment details you enter with them | Premium payment | USA |
| Google LLC | Sign-in token verification (only if you use Google sign-in) | Login | USA |
| Resend | Email address and content of emails we send you | Transactional / lead email | Japan (adequacy decision) |
| The organiser of a festival you join | Username, points and activity within their festival | Running the festival | Typically EEA |
Festival organisers process activity within their own festival to operate that event. We provide the platform. For questions about how a specific organiser uses your data inside their festival, contact that organiser as well.
5. Transfers outside the EEA
The primary database and application run in Finland (Hetzner), inside the EEA. Error monitoring (Sentry) is in the EU. Encrypted database backups are stored in Cloudflare R2 with Western European location (WEUR).
Some processors are US-based (Expo, Stripe, Google). Transfers there rely on the European Commission’s Standard Contractual Clauses and/or the EU–US Data Privacy Framework, as applicable.
Email is sent through Resend, which processes it in Japan. Japan is covered by the European Commission’s adequacy decision, so no separate transfer mechanism is required.
6. How long we keep data
| Data | Retention |
|---|---|
| Account and profile | As long as the account exists. Deleted when you delete the account |
| Activity and points | Deleted with the account |
| Prize claims (name, address) | Up to 5 years after a prize is shipped (Norwegian bookkeeping rules); otherwise deleted with the account if never shipped |
| Server logs containing IP | Up to 90 days, then deleted |
| Encrypted backups | 30 days, then deleted automatically |
| Sign-in tokens | 15 minutes (access) / 30 days (refresh) |
| Website lead emails | Only in our inbox until we have replied and no longer need them |
A deleted account may remain in encrypted backups for up to 30 days before those backups rotate out.
7. Your rights
You have the right to:
- access the data we hold about you (Art. 15),
- correct data that is wrong (Art. 16),
- delete your account and your data (Art. 17),
- receive your data in a machine-readable format (Art. 20),
- object to processing based on legitimate interests (Art. 21),
- withdraw consent to marketing or notifications at any time, without affecting the lawfulness of processing before withdrawal.
You can exercise export and account deletion in the app under Profile → Privacy and data. Password accounts confirm with password and typing DELETE; Google-only accounts confirm with a fresh Google sign-in. You can also email [email protected]. We respond within 30 days.
8. Age limit and children
The minimum age to use Taptober is 18. Taptober is not intended for children, and we do not knowingly collect data about anyone under 18.
We ask for your date of birth during onboarding. A date of birth that makes you younger than 18 is rejected and is not stored. Your date of birth cannot be changed once set.
Alcohol-related content, such as the beer catalogue and age-restricted prizes, is additionally blocked for users who do not meet the age limit in their country (18, or 21 in the USA).
If you are a parent and believe your child has created an account, contact [email protected] and we will delete it.
9. Alcohol content and geo-blocking
Under the Norwegian Alcohol Act § 9-2, alcohol advertising is prohibited in Norway. Brewery-type sponsor content is therefore not shown to users whose home country is Norway, Sweden, Finland, Iceland, South Africa or Russia. Users in France see product information only, per the Loi Évin.
The block is driven by the home country you declare in your profile. You are responsible for declaring it correctly.
10. Automated decisions
The following are decided automatically:
- Ranking and prizes. Points and rank are computed on the server from answers and speed. Prize eligibility is decided from rank, age and country.
- Age-gating and geo-blocking as described above.
If we investigate suspected cheating, a human reviews the case before an account is permanently disabled. You can always contact us to have a decision reviewed by a human.
11. Cookies and on-device storage
Our websites set no cookies for tracking or advertising. That is why there is no cookie consent banner.
In the app, your sign-in keys are stored in the device’s secure storage. In the organiser portal they are stored in the browser’s localStorage. This is necessary to keep you signed in, and is cleared when you sign out.
On taptober.com we store your language choice (taptober-lang) in the browser’s localStorage so the page remembers Norwegian, English or German. It never leaves your browser.
Fonts on our websites are served from our own servers, not from Google Fonts.
12. Security
- All traffic runs over HTTPS.
- Passwords are stored as bcrypt hashes.
- The database runs inside the EEA and is not exposed directly to the public internet.
- Backups are encrypted with AES-256 before leaving the server.
- Data access is scoped per festival (tenant) and per role.
13. Changes
For significant changes we will notify you in the app or by email before they take effect. The date at the top shows when this policy was last changed.
14. Contact and complaints
Privacy questions: [email protected]
Controller: Bygg Bevaring AS, org.nr. 837 666 082, Lilletuneveien 2, 1711 Sarpsborg, Norway.
If you believe we process your data unlawfully, you may complain to the Norwegian Data Protection Authority, Datatilsynet, Postboks 458 Sentrum, 0105 Oslo — datatilsynet.no. We would appreciate the chance to fix it first.
Back to taptober.com · Terms of Use · © 2026 Bygg Bevaring AS / Taptober