Privacy policy

Last updated 11 November 2026

TAP BACK is a private, invite-only rhythm game run by one person, Philip Malan in Aarhus, Denmark. He is the data controller. This page says what the game keeps about you, why, and how to get it removed.

Short version: an account is your name, email and password. The game keeps your scores, the songs you add and the things you do with friends. Nothing is sold, there are no ads from us and no tracking cookies.

What we keep

Your account: name, email and password. The password is stored hashed by our database provider; nobody can read it.
Your profile: a photo if you add one, your level, stickers and the look you pick in the Record Shop.
Your play: every finished run (score, accuracy, combo, grade and a score-per-second line used as a "ghost" for friends), best scores, challenges, mixtapes, reactions, wishlist ideas and votes.
Songs you add: a YouTube link, or an audio file and cover you upload, plus the charts you map. Uploaded files are stored privately and only signed-in members can play them.
Notifications: if you turn them on, a push address from your phone so we can tell you when a friend beats your score.
Crash reports and bug reports: when something breaks, the error, the song you were playing, your screen size and browser version are saved so it can be fixed. Bug reports you send from Settings include the same.
Usage counts: to see how the game is used (for example how many visitors try a song, how many sign up, and how many songs get finished or quit), the app saves small events like "opened the app", "started a song" or "shared a challenge" with the time, the song and a random ID for your device. Visitors who aren't signed in are only counted by that random ID. No cookies, no third parties, no advertising.
On your phone only: settings like note speed and timing, and the sign-in session, live in your browser's storage. If you play once without an account, that run stays on your phone and is only saved to the game if you sign up within two days.

Why

To run the game you signed up for (this is the legal basis: providing the service you asked for), to show your scores to the friends in the game, and to find and fix bugs. Usage counts help decide what to improve. Nothing is used for advertising or profiling.

Who else handles it

Supabase stores the database, files and sign-in, in the EU (Stockholm).
Vercel hosts the website.
YouTube (Google): songs added from YouTube play in YouTube's own embedded player. When it loads, YouTube receives the usual information about your browser and may set its own cookies. That is covered by the Google Privacy Policy. TAP BACK uses the YouTube API Services; we don't sign you in to YouTube or read anything from your Google account.
Apple: when a cover is looked up, the song title and artist (not who you are) are sent to Apple's iTunes Search from our server.
Apple / Google push services deliver notifications if you turn them on.

Other members see your name, photo, scores, runs, stickers and the songs you add. Nobody outside the members list does, except that a challenge link you share shows your name, score and the song to the person you send it to.

How long

As long as you have an account. Crash reports are cleared regularly and kept at most 90 days, usage counts at most 13 months. If you delete your account, everything tied to it is deleted, except that songs you added may stay for other members if you agree.

Your rights

You can ask to see what is stored about you, have it corrected or deleted, or get a copy. Email philip@malan.nu. If you think your data is handled wrongly, you can complain to the Danish Data Protection Agency, Datatilsynet.

Age

You need to be at least 13 to use TAP BACK, and old enough to accept YouTube's Terms of Service where you live.

Changes

If this policy changes in a way that matters, members will be told in the game.