Privacy Policy

Last Updated: September 16, 2026

1. Introduction

This Privacy Policy explains how Digital Tap ("we", "our", "us") collects, uses, stores, and protects your personal information when you use our prototype demonstration service. By using the Service, you consent to the data practices described in this policy.

2. Data We Collect

2.1 Information You Provide

We collect information that you voluntarily provide when using our Service:

• Contact Form: Name, email address, subject, and message content
• Voting/Feedback: Your votes, comments, and optional images you upload
• User Journey Data: Station selections, tap-in/tap-out times, and simulated journey details

2.2 Automatically Collected Data

A small amount of data is generated automatically when you use the Service:

• Anonymous client identifier: A random ID stored in your browser's local storage, used to associate your votes, comments, and usage events so the prototype works across visits. It is not linked to your identity.
• Single-use action tokens: When you vote or comment, our server issues a one-time token so the backend can verify the action came from a real visitor. Tokens are deleted once consumed.
• Hashed IP address: Your IP is hashed (one-way, not stored in raw form) and used only for rate limiting the contact form and token issuance, never for tracking.
• Usage events: Anonymous interaction events (such as page views and feature interactions, tagged with your anonymous client ID) so we can see which parts of the prototype get used.
• Admin session cookie: If you are the site administrator, a signed session cookie (admin_session) keeps you logged in for up to 12 hours. It is HttpOnly and is never set for ordinary visitors.

We do NOT collect:

• Tracking cookies or pixels
• Device fingerprints
• Third-party advertising or cross-site tracking data

Note: Our hosting provider (Cloudflare Pages) may collect basic server logs for operational and security purposes, which are governed by their privacy policy.

3. Cookies and Local Storage

The Service uses a minimal set of cookies and browser storage, all of which are strictly necessary for the site to function. Because we set no analytics, advertising, or other non-essential cookies, UK law (PECR) does not require a consent banner, but we disclose everything we store anyway:

• admin_session (cookie): Administrator login session. HttpOnly, SameSite, expires after 12 hours. Not set for regular visitors.
• ldt_voter_token (local storage): Holds your current single-use action token so a vote survives a page reload. Deleted once the token is consumed.
• ldt_user_id (local storage): Your anonymous client identifier, described above.

You can clear all of these at any time via your browser settings. Clearing them only resets your anonymous identity. No functionality is lost beyond your existing vote.

4. How We Use Your Data

We use the information we collect for the following purposes:

• Communication: To respond to your contact form submissions and inquiries
• Demonstration: To display voting results and feedback within the prototype
• Improvement: To gather feedback and improve the prototype concept
• Testing: To test user flows and interface functionality
• Abuse prevention: Hashed-IP rate limits and single-use tokens to protect against spam and vote stuffing

5. Data Storage and Security

5.1 Where We Store Data

Your data is stored using:

• Convex: Database for user submissions, votes, and journey data
• Convex Storage: Cloud storage for uploaded images
• Resend: Email service for contact form deliveries

5.2 Data Retention

Important: As this is a prototype:

• All data may be deleted at any time during development cycles
• Data should not be considered permanent
• We make no guarantees about data retention or backup
• You should not submit data you need to keep

5.3 Security Measures

We implement reasonable security measures including:

• HTTPS encryption for data transmission
• Secure authentication for database access
• Regular security updates and patches
• Limited access to data (development team only)

However, no system is 100% secure. Please do not submit highly sensitive or confidential information.

6. Data Sharing and Disclosure

We do NOT:

• Sell your personal information to third parties
• Share your data with advertisers
• Use your data for marketing purposes
• Provide your information to data brokers

We MAY share data:

• With service providers (Cloudflare, Convex, Resend) necessary to operate the Service
• If required by law or legal process
• To protect rights, property, or safety of users or others
• Aggregated, anonymised data for research or demonstration purposes

7. Your Rights

Under GDPR and UK data protection laws, you have the right to:

• Access: Request a copy of the personal data we hold about you
• Rectification: Request correction of inaccurate data
• Erasure: Request deletion of your personal data ("right to be forgotten")
• Restriction: Request limitation of processing your data
• Portability: Request transfer of your data to another service
• Objection: Object to processing of your data
• Withdrawal: Withdraw consent at any time

To exercise these rights, please contact us via the contact form. Erasure requests are actioned against your anonymous client ID, so include the ldt_user_id value from your browser's local storage if you want your votes, comments, images, and usage events removed.

8. Children's Privacy

The Service is not intended for children under 13. We do not knowingly collect personal information from children. If you believe we have collected data from a child, please contact us immediately.

9. Third-Party Services

The Service uses the following third-party services, each with their own privacy policies:

• Convex: Privacy Policy
• Resend: Privacy Policy
• Cloudflare: Privacy Policy

10. International Data Transfers

Your data may be transferred to and stored on servers located outside the UK/EEA, including the United States. We ensure appropriate safeguards are in place, such as standard contractual clauses, when transferring data internationally.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated "Last Updated" date. Your continued use of the Service after changes constitutes acceptance of the updated policy.

12. Contact Us

For questions, concerns, or requests regarding your personal data or this Privacy Policy, please contact us via our contact form.