A screen by your front door is a privacy decision.
Most of the people who will use this are adults who do not mind their name being on a tablet for a second. Some of them are nine years old. Those are not the same question, so the product does not answer them the same way.
Who is responsible for what
Your gym is the data controller
They are your members. You decided to keep their names, you decide what else you keep, you decide how long you keep it, and you answer to them and to the Information Commissioner for it. Nothing here changes that, and nothing here should read as legal advice about your own obligations.
Tap In Book is the processor
We hold that data and do what your gym asks with it, and nothing else. We do not sell it, we do not use it to train anything, we do not send your members marketing of our own, and we never share one gym’s list with another. The data processing terms put that in writing.
The four things that matter at the door
The name list can be switched off
The name picker shows the members filed under a letter to whoever is standing there. For most gyms that is unremarkable — it is a list of adults who all train together. If it is not right for yours, turn it off and use a four-digit PIN instead. Nothing on that screen names anybody until the PIN matches.
There are no photographs at all
A photograph on a tile would make the picker faster, and it would also put a member’s face on a screen in a public room. So the product collects none. There is nowhere to upload one, nothing on the tablet shows a face, and no photograph of anybody has ever been stored. The data processing terms say the same thing in the row where your data protection officer would look for it, and we are not going to promise you a date for something nobody has built.
One first name, three seconds
The confirmation shows a first name and then clears itself. The next person in the queue never sees who went before them, and the tablet’s back button cannot bring a name back — the screen replaces itself in the history rather than adding to it.
The tablet can reach nothing else
A paired tablet has no password and no account. It can open the sign-in screen and it is refused everywhere else in the system: not a report, not a member’s record, not a phone number. If one goes missing you revoke it from your settings and it goes back to asking for a pairing code.
Juniors
A junior’s contact details are the parent’s, and they sit on the child’s own record — because in almost every gym the parent is not a member and has no record of their own to sit on.
One piece of code decides who a message is addressed to, and it is the only place in the product that decides it. If a member has a guardian, the message goes to the guardian. There is no second route, so there is no path by which a nudge about a nine-year-old’s attendance arrives in the nine-year-old’s inbox.
You do not have to keep a date of birth at all. If you do, it is because your gym wants to know who is a junior — and the only thing the product does with it is decide who gets written to.
What a gym usually keeps
- A first name and a surname
- An email address or a phone number, or neither
- The plan they are on and when it started
- Every sign-in: when, on which tablet, for which class
- For a junior, a parent’s name and how to reach them
- Anything else you choose to add as your own field
There is no health data, no medical history and no payment card anywhere in the product, because the product does not take payments from your members.
The rest of it, plainly
Where is our data held?
On Cloudflare, in their Western Europe region, with a nightly backup kept separately from the live copy. Every night we copy your whole account — members, memberships, timetable, tablets, every sign-in — and we keep the last 30 nights. Each copy is written twice, once alongside the live database and once into separate object storage, so a fault that takes out one cannot take out the other. Two things are deliberately left out of it: your members’ PINs and your tablets’ pairing credentials, because a backup that carried them could put a tablet you had revoked back on your wall. The terms say what that means if we ever have to restore you. Each gym’s data is separated from every other gym’s, which is checked by an automated test on every change rather than taken on trust.
Can a member ask to be sent everything you hold about them?
Yes — that request comes to you, because you are the controller. A member’s own screen in the office shows their details, every sign-in they have made, and every message they have been sent, and you can export the lot.
Can a member opt out of being written to?
Yes, and their record carries the opt-out. The drifting nudge honours it without you having to remember. The digest is a different thing — it is a report to you about your own gym and is never sent to a member.
What happens if we leave?
Export everything first: members, plans, classes, every sign-in and the record of what each member was sent, as files that open in a spreadsheet. Then close the account, and the data goes — every table, and every file that ever belonged to it.
Does this website track me?
No. This site sets no cookies, runs no scripts, loads no fonts or images from anyone else, and has no analytics on it at all. That is why there is no cookie banner: there is nothing to ask you about.
Where are the actual legal documents?
The terms, the privacy policy, the refunds and cancellation terms and the data processing terms are on the app’s own site, so that there is one copy of each rather than two that can drift apart.
One thing this product deliberately is not: a check-in screen for a GP surgery or a dental practice. A waiting room is not a gym — patients’ names on a screen is a different question entirely, and a check-in that does not talk to the clinical system is worth nothing to a practice. So it has not been built and it is not sold as though it had.
See how it actually behaves
Everybody in the demo is invented, and every phone number in it is in Ofcom’s range reserved for drama.