In one paragraph
We store the minimum needed to run a rewards platform and pay you: your email, username, the country derived from your IP address, a hashed device fingerprint, IP addresses, your payout wallet address, and the proof images you upload (kept 90 days). We use this to credit your earnings, send you codes and payout confirmations, and keep one account per person. We do not sell personal data and we do not show ads based on it.
What we store and why
| Data | Why | Kept |
|---|---|---|
| Email address | Login, verification codes, password reset, withdrawal confirmation links, notices about your claims and payouts | Until you delete your account |
| Username | Your public name on the leaderboard (partly masked) and in referral lists | Until deletion |
| Password | Stored only as a salted hash; we cannot read it | Until deletion |
| Country (from your IP, via Cloudflare) | Showing the tasks partners pay for in your country. Never a gate on your account | Updated on each visit |
| Hashed device fingerprint | A SHA-256 hash of browser and screen characteristics, used to enforce one account per device and flag duplicates. The raw values are never sent to us | Until deletion |
| IP addresses (sign-up and recent) | Rate limiting, fraud signals, security investigations | Sign-up IP until deletion; recent IPs rotate |
| Payout wallet address | Sending your USDT; shown on withdrawals so you can verify where funds went | Until deletion |
| Proof images and text | Checking app tasks. Images are stored privately and only you and an admin can view them | 90 days, then deleted automatically |
| Ledger, claims, withdrawals | Your balance history and payout records | Financial records may be kept after deletion where the law requires it |
| Support emails | Answering you | Up to 2 years |
What we do not do
- We do not sell, rent or trade personal data.
- We do not run third-party advertising or tracking pixels on the site.
- We do not read your contacts, SMS or location. The web app and the planned Android app ask only for internet access and, when you upload proof, access to the photo you pick.
- We do not store your private keys. We only ever hold the public address you give us.
Who else sees data
App partners and survey companies receive an anonymous click id for each task you claim, and they tell us whether the install or survey was valid. They do not receive your email or name from us. Cloudflare hosts the platform, serves the Turnstile security check on sensitive forms and provides the country lookup. Email delivery runs through Cloudflare's email service. Each of these processes data under their own agreements with us and only to provide the service.
Cookies and local storage
We set one session cookie to keep you logged in and a readable flag that tells the page whether you are logged in, plus Turnstile's own cookie on forms that use it. Local storage holds your app-mode preference and the random part of the device fingerprint. There are no analytics or advertising cookies.
Your rights
You can see most of your data in the app (Settings, Wallet, My claims). You can correct your payout address yourself and change your password. You can delete your account at any time from Settings or the delete account page; this removes your personal data, with the exception of payout records we must keep for accounting, and forfeits unwithdrawn Tapkoins. For a copy of your data or any other request, email support@tapkoin.com from the address on your account.
Children
Tapkoin is for adults (18+ or the age of majority where you live). We delete accounts we find to belong to minors.
Security
Passwords are hashed, sessions are HttpOnly cookies, proof images are served only to their owner and to admins, and withdrawals require a confirmation link sent to your email plus a check by a person. Report any issue to the support address with “Security” in the subject.
Changes
We update this page when our practices change and note the effective date at the top. Material changes are also announced in the site notice inside the app.