Privacy policy
Last updated: 12 May 2026. Short version: we collect as little as possible, store it in Europe, and never sell anything.
1. Who we are
Tappium is an app by Novylium, Dutch Chamber of Commerce no. 96646675.
Data controller within the meaning of the GDPR.
Contact: privacy@novylium.nl
2. What data we collect
- Account data: email address, name (if provided), encrypted password.
- Product usage: trips (date, time, route, kilometres), hours (date, time, duration), clients, tags, tag configuration.
- Location data: GPS coordinates during an active trip, based on an explicit tap-trigger by the user. No passive background tracking. Location data is never recorded for hour tracking.
- Technical data: device type, OS version, app version, anonymous crash logs.
- Payment data: handled by Apple (App Store) or Google (Play Store). Tappium never receives credit card details.
3. How we use that data
- To make the app work (log trips, track hours, sync across devices).
- To validate Pro subscriptions via server-side receipt validation.
- To debug (anonymous crash logs).
- Not for advertising. Not for profiling.
4. Where we store it
- Free tier: locally on your device. We have no access.
- Pro tier: encrypted in transit (TLS 1.3), stored at Hetzner Online GmbH in the EU (Germany/Finland).
- Encryption at rest: AES-256.
5. How long we keep it
- Product data: as long as you have an active account. On account deletion: fully deleted within 30 days.
- Crash logs: 90 days.
- Billing data: 7 years (legal retention period).
7. Your rights (GDPR)
- Right of access
- Right to rectification
- Right to erasure ("right to be forgotten")
- Right to data portability (export as CSV/JSON)
- Right to object
- Right to lodge a complaint with the Dutch Data Protection Authority
9. Changes to this policy
We notify active users by email about material changes.