A screen by your front door is a privacy decision.
Most of the people who will use this are adults who do not mind their name being on a tablet for a second. Some of them are nine years old. Those are not the same question, so the product does not answer them the same way.
Who is responsible for what
Your place is the data controller
They are your people. You decided to keep their names, you decide what else you keep, you decide how long you keep it, and you answer to them and to the Information Commissioner for it. Nothing here changes that, and nothing here should read as legal advice about your own obligations.
Tap In Book is the processor
We hold that data and do what your place asks with it, and nothing else. We do not sell it, we do not use it to train anything, we do not send your people marketing of our own, and we never share one place’s list with another. The data processing terms put that in writing.
The four things that matter at the door
The name list can be switched off
The name picker shows the names filed under a letter to whoever is standing there. In most places that is unremarkable — it is a list of adults who all train together. If it is not right for yours, turn it off and use a four-digit PIN instead. Nothing on that screen names anybody until the PIN matches.
There are no photographs at all
A photograph on a tile would make the picker faster, and it would also put a person’s face on a screen in a public room. So the product collects none. There is nowhere to upload one, nothing on the tablet shows a face, and no photograph of anybody has ever been stored. The data processing terms say the same thing in the row where your data protection officer would look for it, and we are not going to promise you a date for something nobody has built.
One first name, three seconds
The confirmation shows a first name and then clears itself. The next person in the queue never sees who went before them, and the tablet’s back button cannot bring a name back — the screen replaces itself in the history rather than adding to it.
The tablet can reach nothing else
A paired tablet has no password and no account. It can open the sign-in screen and it is refused everywhere else in the system: not a report, not a person’s record, not a phone number. If one goes missing you revoke it from your settings and it goes back to asking for a pairing code.
Juniors
A junior’s contact details are the parent’s, and they sit on the child’s own record — because in almost every place the parent is not a person and has no record of their own to sit on.
One piece of code decides who a message is addressed to, and it is the only place in the product that decides it. If a person has a guardian, the message goes to the guardian. There is no second route, so there is no path by which a nudge about a nine-year-old’s attendance arrives in the nine-year-old’s inbox.
You do not have to keep a date of birth at all. If you do, it is because your place wants to know who is a junior — and the only thing the product does with it is decide who gets written to.
What a place usually keeps
- A first name and a surname
- An email address or a phone number, or neither
- The plan they are on and when it started
- Every sign-in: when, on which tablet, for which class
- For a junior, a parent’s name and how to reach them
- Anything else you choose to add as your own field
There is no health data, no medical history and no payment card anywhere in the product, because the product does not take payments from your people.
The rest of it, plainly
Where is our data held?
On Cloudflare, in their Western Europe region, with a nightly backup kept separately from the live copy. Every night we copy your whole account — people, memberships, timetable, tablets, every sign-in — and we keep the last 30 nights. Each copy is written twice, once alongside the live database and once into separate object storage, so a fault that takes out one cannot take out the other. Your tablets’ pairing credentials are never copied into it, because a copy that carried one could put a tablet you had revoked back on your wall — so after a restore every tablet asks for a fresh pairing code. Your people’s PINs are left out too unless you switch them on, which is your own choice in your place’s settings and is off to begin with: left out, a copy of the backup on its own can never be used to try PINs against; switched on, nobody needs a new PIN after a restore. The terms say what each of those means if we ever have to restore you. Each place’s data is separated from every other place’s, which is checked by an automated test on every change rather than taken on trust.
Can a person ask to be sent everything you hold about them?
Yes — that request comes to you, because you are the controller. A person’s own screen in the office shows their details, every sign-in they have made, and every message they have been sent, and you can export the lot.
Can a person opt out of being written to?
Yes, and their record carries the opt-out. The drifting nudge honours it without you having to remember. The digest is a different thing — it is a report to you about your own place and is never sent to anybody on your list.
What happens if we leave?
Export everything first: people, plans, classes, every sign-in and the record of what each person was sent, as files that open in a spreadsheet. Then close the account, and the data goes — every table, and every file that ever belonged to it.
Does this website track me?
No. This site sets no cookies, runs no scripts, loads no fonts or images from anyone else, and has no analytics on it at all. That is why there is no cookie banner: there is nothing to ask you about.
Where are the actual legal documents?
The terms, the privacy policy, the refunds and cancellation terms and the data processing terms are on the app’s own site, so that there is one copy of each rather than two that can drift apart.
One thing worth saying plainly: a screen that shows names in a room full of people is a decision about that room, and it is yours. Everything above is there so that you can make it on purpose — switch the name list off and run on a PIN, leave photographs out entirely, and tell the people who come which way you have chosen.
See how it actually behaves
Everybody in the demo is invented, and every phone number in it is in Ofcom’s range reserved for drama.