Privacy

Last updated 7 September 2026

Not yet complete. The legal identifiers below are placeholders — registered entity, address, contact route and the data controller question all need confirming before this page is relied on. Everything describing what the system records is accurate today.

The short version

Tapping one of these cards opens a web page. We record that the tap happened so the business can see how often their cards are used. We do not know who you are, we do not set tracking cookies, and nothing recorded can be traced back to you afterwards.

What is recorded on a tap

Which card was tapped, and where it sent you.
Your device type, operating system and browser family — for example “mobile, iOS, Safari”. The full browser identification string is discarded rather than stored.
The website you arrived from, if any, and the country of your connection.
A one-way fingerprint of your IP address, combined with a value that changes every day. It lets us ignore the same person tapping twice in a few seconds. Because the value changes daily, yesterday’s fingerprints cannot be reproduced or matched to today’s.

Your IP address itself is never written down. Neither is your name, email, phone number or location beyond country.

Cookies

One cookie is set, and only when you tap a physical card. It records that you were present at that business so the page can show their Wi-Fi details, and it expires after two hours. It is not used for advertising, profiling or tracking you between sites — which is why this service shows no cookie banner.

Buttons you press

If you press an action on a card page — leaving a review, opening a website, connecting to Wi-Fi — the fact that an action was pressed is counted. Where the button takes you is a separate service with its own privacy policy, and what happens there is between you and them.

Who holds this

Tap records belong to the business whose card you tapped and to the company that supplied their cards. [Controller and processor roles to be confirmed — see the note above.]

The service runs on Vercel (hosting) and Supabase (database), both in the United Kingdom region.

Your rights

Under UK data protection law you may ask what is held about you and ask for it to be deleted. In practice there is very little to find: nothing recorded here identifies you, so a request cannot usually be matched to a person. Contact [contact route to be confirmed].