Back to home

Privacy Policy

Last updated: November 7, 2026

Overview

Tapture is developed by Elie Chahine. This policy explains what data we collect, why, who we share it with, and your rights. We keep it plain, and this page names every company that can see your content.

What Tapture Does

Tapture lets you save anything you can share from another app: videos, links, photos, screenshots, places and text, plus voice notes and notes you make in Tapture. With your permission, AI analysis names each save and pulls out the details, so you can use it and find it later. Tapture is on iPhone, where you sign in with Apple, and on Android, where you sign in with Google.

Where Your Library Lives

Your library (what you save, your notes, images and voice recordings) is stored on your phone. Our servers do not keep a copy of it.

  • On iPhone, your library syncs between your own devices through your private iCloud database, under your Apple Account. You can turn this sync off in Tapture.
  • On Android, you can switch on a backup to your Google Drive. It is off until you turn it on, and it is stored in Tapture's hidden app folder in your Drive. Android's own device backup, run by Google, can also include your library as part of your phone's backup.
  • So you can search your saves from your phone, iPhone adds them to Spotlight and Android to its on-device search. Widgets read your library on your phone. Saves in the Vault or in Trash are left out of Spotlight. Trash empties itself after 30 days.

Your Consent to AI Analysis

Analyzing a save means sending its contents to OpenAI. Tapture asks for your permission in the app before that happens for the first time, and nothing is sent until you answer. You can change your mind any time in Profile, Preferences, AI analysis.

If you do not give permission, Tapture still works. Your saves are kept in your library, they are simply not analyzed.

Data We Collect

  • Your account. On iPhone, the name and email you choose to share through Sign in with Apple (which may be Apple's private relay address) and your Apple account identifier. On Android, the name, email and account identifier from your Google sign-in. We also keep a device identifier and your time zone.
  • What you send for analysis, only with your permission: images and screenshots, the link you saved and text read from that page, video covers and captions, text you share, the note you add to a save, and voice recordings (for transcription). The result of an analysis is kept on our server for up to 48 hours, so it can reach your phone, and is then deleted.
  • Usage logs. For each analysis we record the AI model used, its cost, whether it worked, your platform and the website a saved link came from, linked to your account. When a saved link cannot be analyzed, we also record that link's full address, with tracking codes removed, so we can find out what went wrong. We delete the address after 48 hours. We use this to apply usage limits and control costs. These logs are kept until you delete your account.
  • Usage data. Which features you use, when an analysis fails and when the app crashes, linked to your account and never what you save. It is collected by PostHog, which also receives your device model, system and app version and your IP address. It is on unless you turn it off in Profile, Preferences, Usage data.
  • Subscriptions. Whether you have a trial or a subscription, and your purchase history, as reported by the App Store or Google Play through RevenueCat. We never see your card or bank details.
  • Notifications. If you allow notifications, your device's push token, your preferred hour and when you last opened the app.
  • Feedback. When you report a problem or send feedback, your message, the save it is about (its link, title and summary), your device model, system and app version, and your account identifier. It is stored with us and emailed to us.

Location

Tapture uses your location only if you allow it, to show you on the map of places you saved, to work out distances and travel times, and to remind you when you are near a place you saved. Your location is never sent to our servers.

  • On iPhone, Tapture asks for your location only while you use the app. To estimate a travel time, your position and the place are sent to Apple Maps.
  • On Android, the map uses your location while you use the app. If you turn on reminders near a saved place, Android asks to use your location in the background, and Google Play services on your phone notices when you arrive.

Separately, to put a place you saved on the map, its name, address or coordinates are sent to Google Places. Those describe the place you saved, not your own position.

Notifications

Reminders you set, reminders near a saved place and suggestions that name one of your saves are scheduled on your phone. The only notifications we send through Apple and Google are messages from us about Tapture. You can turn notifications off in Tapture or in your phone's settings. We do not send you email, unless you join the beta.

Joining the Beta

When you join the beta on tapture.app, we keep the email address you give, whether you use an iPhone or Android, the country you are in and the date. Your country comes from your IP address, read by our website host; we do not keep the IP address. We use these only to invite you to the beta and to write to you about it.

Each sign-up is stored with Supabase and sent to us by email through Resend. To invite you, we give your email address to Apple (TestFlight) or Google (Google Play testing), who send you the invite. We keep the list while the beta runs and delete it when the beta ends. To be removed sooner, email privacy@tapture.app.

This Website

When you visit tapture.app, we count the visit with PostHog, in the European Union: the pages you open, how far you scroll, what you click or tap, the page you came from and any campaign tags in the link, your browser and device type, and your country, region and city. Your location comes from your IP address, read by our website host; we do not keep the IP address. We also make heatmaps of where people click, and we may record replays of how a page was used. Replays never show what you type: every field is hidden, and so is the beta form.

  • In the European Union, the EEA, the United Kingdom and Switzerland, we ask first. Until you answer, and if you say no, we count your visit without a cookie and keep nothing in your browser: PostHog makes a daily code from your IP address and browser that cannot be traced back to you, and records no replay. If you say OK, we keep the cookies below and may record replays.
  • Everywhere else, we keep the cookies below from your first visit and may record replays. You can say no at any time.
  • Cookies. PostHog keeps two first-party cookies, ph_<key>_posthog and ph_<key>_posthog_cpm, for up to a year, and the same details in your browser's storage. They hold a random identifier and your current visit, so a second visit counts as the same person. If you say no, we remove them and keep only your answer, in your browser's storage, until you clear it.
  • Joining the beta. If you join the beta after saying OK, or outside the places where we ask first, we link your visits on this website to the email address you gave, so we can see how people found the beta. Without your OK, we do not.
  • Saying no. Tap Privacy choices at the bottom of any page and choose No thanks. PostHog keeps website visits for a year and replays for a month. To have yours deleted, email privacy@tapture.app.

Who We Share Data With

These are all the companies that can receive your content or information, and what each one gets. Companies that work for us only use your data to provide their service to us. Apple and Google also act under their own privacy policies for your accounts with them.

  • OpenAI (United States): what you send for analysis, as listed above, and voice recordings for transcription. To add public facts about something you saved, such as a restaurant's reviews, OpenAI may search the web for its name.
  • Supabase, hosted on Amazon Web Services (Singapore): your account, usage logs (with the address of a saved link that could not be analyzed, for up to 48 hours), analysis results for up to 48 hours, notification details, subscription status, feedback and beta sign-ups.
  • PostHog (European Union): usage data and crash reports from the app, and visits to this website (see This Website above).
  • RevenueCat (United States): your account identifier and your purchases, to manage subscriptions.
  • Apple: Sign in with Apple, iCloud sync, App Store purchases, notifications, and Apple Maps for places and travel times.
  • Google: Google sign-in, Google Drive backup if you turn it on, Android's device backup, Google Play purchases, notifications through Firebase Cloud Messaging, maps and location services on Android, and Google Places to find where places you saved are.
  • TMDB, Open Library and Apple's iTunes Search: the title of a film, show, book, podcast, album or app you saved, to fetch its details and artwork.
  • The websites you save from: to read a link, our server or your phone opens that page, or the video's public preview on TikTok, YouTube, Instagram, Facebook or X, much as your browser would. For a saved product, we note the addresses of the product's photos on that page, and our server may also read the shop's public list of them (for a product saved before we did, your phone reads them once instead, from the shop's page or that list, sometimes before you open the save). Your phone shows those photos straight from the shop.
  • Videos from TikTok, Instagram, Facebook, X, YouTube and other sites: on iPhone, a saved TikTok, Instagram, Facebook or X video, or a YouTube Short, plays on its note page straight from that service, and so does a video on another site that names its own video file. For TikTok and Instagram, your phone reads the post's public page on TikTok or Instagram to find the video (for an Instagram reel whose page leaves the video out, the post's details as Instagram's own website asks for them) and plays it in Apple's own player (or in their player when it can't read the post). For Facebook, your phone reads the video's public embed on Facebook, or the reel's public page when its owner turns the embed off (that page also lists other reels; only the saved one is taken), and for a post with photos, the post's public page, only when you open it. For X, your phone reads the post's public embed details from X. Both play in Apple's own player, and a post your phone can't read keeps its saved picture. A YouTube Short plays in YouTube's official player; any other YouTube video shows its saved picture and opens in the YouTube app (or your browser) when you tap it, and the note page loads nothing from YouTube for it. On Android, a saved TikTok, Instagram, Facebook or X post plays the same way: your phone reads the post's public page on TikTok or Instagram (for an Instagram reel whose page leaves the video out, the post's details as Instagram's own website asks for them), and for Facebook the same public embed, reel page or post page as on iPhone, and for X the same public embed details, and plays it in Android's own player (or, for TikTok and Instagram, in their player when it can't read the post, as on iPhone); a Facebook or X post it can't read keeps its saved picture, and there a video waits for your tap in Battery Saver or Data Saver. On Android too, a YouTube Short plays in YouTube's official player and any other YouTube video opens in the YouTube app or your browser. For a saved video on any other site, your phone reads that page (for Reddit, its public embed page) for the video file the page itself names, and plays it in the phone's own player (Apple's on iPhone, Android's on Android), straight from that site's servers; such a page is read only when you open the save and never in Low Data Mode (on Android, Data Saver), and your phone remembers for 14 days that a page has no video. A saved post with several photos or videos has its slides read the same way. It all streams from their servers to your phone, and they see the request as they would for any visit to that post. So a video starts the moment you open it, your phone may read that page before you tap: when a saved TikTok, Instagram, Facebook or X post's card has stayed on your screen for about half a second, and, when you open the app or come back to it, for the saves you are most likely to open next (about 40, such as your Second Look cards and your newest saves), and for the first few saves a page shows you to choose from (a Space, your search results, the Related row on a note page, the places on the map). Never in Low Power Mode or Low Data Mode (on Android, Battery Saver or Data Saver), nor on a hot phone. Only the page is read then, never the video or its photos, and a Facebook post with photos is never read ahead. The one exception is Flip through: there the videos of the 2 saves on either side of the one you are watching load their first seconds ahead, paused and silent, so each starts the moment you reach it; never in those modes, nor when video autoplay is off. The cookie TikTok sets for its video stays on your phone until the video's address expires, about two days; a player's cookies last only while its page is open. So a video you opened before starts at once, your phone keeps a copy of the videos you watched (except a video that streams in parts, such as Bluesky's or Reddit's), on that phone only: 300 MB at most, a video you haven't opened for 14 days is removed, and the copies go with their save, when you sign out and when you delete all data. They are never backed up or synced, and our servers are not involved. YouTube Shorts play through the YouTube API Services, so the YouTube Terms of Service and the Google Privacy Policy apply to them.
  • Resend: delivers your feedback, problem reports and beta sign-ups to our inbox.
  • Telegram: delivers internal alerts to us: cost alerts, which can include a shortened account identifier and usage costs but never your content, and beta sign-ups.
  • Vercel (United States): hosts tapture.app. Like any web host, it sees your IP address when you visit. On every visit it tells our website your country, region and city, which we pass to PostHog with the visit and, when you join the beta, keep with your sign-up.

We will update this list before adding any new company. If we ever add one that changes how your content is handled, we will ask for your permission again.

Data We Do Not Collect

We do not collect:

  • Your contacts
  • Health or fitness data
  • Payment card or bank details
  • Advertising identifiers or cross-app tracking data
  • Your photo library: Tapture only sees the photos you pick or share

Tapture uses the camera and microphone only when you take a photo or record a voice note in the app.

Data Storage and Security

Our server data is stored with Supabase on Amazon Web Services in Singapore, and our server functions run in the region closest to you. Usage data is stored by PostHog in the European Union. All data is encrypted in transit using HTTPS/TLS. We take reasonable measures to protect your data, but no system is 100% secure.

Depending on where you live, your data may be transferred to and processed in other countries, including Singapore, the United States and the European Union.

Your Rights and Choices

  • AI analysis: turn it off any time in Profile, Preferences, AI analysis. Saves you make after that are kept without being analyzed.
  • Usage data: turn it off any time in Profile, Preferences, Usage data.
  • This website: tap Privacy choices at the bottom of any page.
  • Notifications, location, iCloud sync and Google Drive backup: each can be turned off in Tapture or in your phone's settings.
  • Delete your account: in Tapture, open Profile, tap your account, then Delete account. This deletes your library on your phone, along with its iCloud copy or Google Drive backup. On our side it deletes your account, usage logs, analysis results, notification details, subscription records and feedback. It also asks PostHog and RevenueCat to delete your records and, on iPhone, revokes Sign in with Apple. If you signed in with Google, you can also remove Tapture from your Google Account's connections.
  • What remains after deletion: purchase records kept by Apple or Google, a copy in Android's own device backup until Google next updates it, short-lived server logs, reports already emailed to us, and an internal record of administrative actions.
  • Access, copy or deletion requests: depending on where you live (for example under the GDPR or the CCPA), you can ask for a copy of your data, ask us to correct or delete it, or object to how we use it. Email privacy@tapture.app. If you cannot open the app, email us from the address on your account and we will delete it for you.

No Selling, No Ads

We do not sell your data to anyone. We do not show ads or use your data for advertising. We do not track you across other companies' apps or websites. Your data is used only to provide and improve Tapture.

Children's Privacy

Tapture is not intended for children under 13. We do not knowingly collect data from children. If you believe a child has provided us with personal information, please contact us and we will delete it.

Changes to This Policy

We may update this policy from time to time. If we make significant changes, we will notify you through the app. The "Last updated" date at the top reflects the most recent revision.

Contact

Privacy questions or requests: privacy@tapture.app. Anything else: support@tapture.app, or see Support.