Privacy Policy

1. Who we are

Robots Drinking Tea LLC, trading as TapAWish, is the controller of the personal information described here. TapAWish serves the United States only. Our database and stored files are hosted in the United States (Virginia) by our infrastructure provider. Write to contact@tapawish.com about anything on this page.

2. What we collect

• Your account — email address, name, and a password held only as a hash by our sign-in provider. If you sign in with Google we receive your email address and name, never your Google password. The sign-in provider also records the IP address and browser of each sign-in, to keep your account secure.
• Your Wish — the words you write, the photographs, films and voice messages you add, the names you give your share links, and any artwork you upload for a custom wax stamp.
• Your address — when something is posted to you, Stripe's checkout collects your shipping address and we keep a copy to send it.
• Recipients — only for White-Glove orders, where we post the cards ourselves: the names and postal addresses you give us. For card kits you hand out yourself, we know nothing about who receives them.
• Orders — what you bought, the amount, tax, and the status of the payment. We never see or store your card number. Card details go directly to Stripe.
• Messages and the waitlist — the name and email address you give us and what you write to us, or just your email address if you joined the waitlist.
• Security records — an audit log of significant actions. Where we record an IP address — in that log, and on contact and waitlist entries — it is scrambled with a secret key before it is written, so the stored value cannot be turned back into an address by anyone who does not hold that key.

3. Photographs, films and voice messages

Photographs and videos often carry hidden details, including the GPS coordinates of where they were taken. The file you upload is kept as you sent it, in private storage that is never linked from anywhere and is read only by our own processing. Every copy of a photograph that anyone sees is one we made, with that hidden information removed.

Films and voice messages are sent to our video provider, Mux, which converts them so they play smoothly on a phone. They are not offered for download.

Photographs, films and voice messages can only be seen or played through a link we sign when the Wish is opened, and that link stops working after six hours. A link copied out of the page stops working too, and none is given out at all until a PIN-protected Wish has been unlocked, or once a Wish has been switched off.

When you record a voice message, your browser asks for the microphone only when you press Record. The recording stays on your device while you listen back, and nothing is uploaded until you choose to use it.

We never analyse faces or voices to recognise anyone. We do not create face or voice templates, transcribe recordings, or use anything you upload to train machine-learning models.

4. What recipients are and are not tracked for

A recipient taps a seal and opens a Wish without signing in, and we want to keep it that way. We record that a Wish was opened and by which route — the NFC tag, the QR code or a shared link — whether it was read to the end, and whether its film or voice message was played.

To avoid counting one person twice, the recipient's browser is given a random value in a cookie that lasts 180 days. It is stored with those records, but it is never linked to a name, an account, an email address or an IP address.

What the sender sees: totals — how many people opened the Wish, read it to the end, watched the film or heard the message — and, for each link or card, the date it was last opened. Where we posted cards for the sender, they can tell which card went to whom, so they can see whether, and when, your card was last opened. They never see who you are, where you were, or what device you used.

We do not set advertising cookies, build recipient profiles, or use third-party analytics or tracking pixels anywhere on a Wish. The companies that deliver the page, its photographs and its film necessarily see the IP address of whoever loads them, and keep it only in their short-lived operational logs.

If a Wish is PIN-protected, the PIN is stored only as a slow hash. We cannot recover it and neither can anyone who obtains the database. Entering it correctly leaves a cookie that keeps that one Wish unlocked on your device for 30 days.

5. If someone sent you a TapAWish

If we posted a card to you, we hold your name and address because the sender gave them to us so that we could. We do not add you to a mailing list, sell your address, or use it for anything but that delivery, and you can have it erased at any time. Without being asked, we erase it 90 days after the card is delivered or returned, or 120 days after it was posted if we never learn either.

You can ask us to erase it sooner by writing to contact@tapawish.com. You do not need an account. To make sure the request is really yours, we will ask for the link on your card (the address its QR code opens) or, if you do not have the card, your name and full postal address. We reply within 10 business days, and finish within 30 days.

• If your card has not been posted, we erase your details and do not post it. We tell the sender only that the card could not be sent to that recipient.
• If it is already in the post, it cannot be recalled, but we erase your details straight away and will not send it again if it comes back.
• We keep only that a card was sent, when, and the carrier's tracking number, with the sender's order record. The carrier and the label service we used keep their own shipping records.

If a Wish contains your photograph, film or voice and you did not agree to it, tell us. We will ask the sender to remove it, and if it breaks our Acceptable Use policy we will switch the Wish off.

Inside TapAWish, addresses are held apart from everything else, only staff with a specific permission may open the list, and every time one is opened it is recorded — who, which order, and when.

6. Cookies

• Signing in — keeps you signed in. Only set when you have an account.
• tw_session — the random value described in section 4. Set only when a Wish is opened; lasts 180 days.
• Unlocked Wish — remembers a correct PIN for one Wish for 30 days.

That is all of them. None is used for advertising.

7. Who else processes it

Only to run the service, and none of them may use it for their own purposes:

• Supabase — database, sign-in and file storage (United States).
• Vercel — hosting.
• Mux — converting and streaming films and voice messages (United States).
• Upstash — rate limiting and caching.
• Resend — the emails we send you.
• Our email provider — receives the messages you send to contact@tapawish.com.
• Pirate Ship and the postal carriers — the name and address on a parcel.
• TaxJar — filing the sales tax we collect.
• The maker of a custom wax stamp — your stamp artwork, and nothing else.

Stripe handles payments and tax calculation. It is responsible, under its own privacy policy, for your card details and for the fraud checks it runs on its checkout page. Google is involved only if you choose to sign in with Google.

8. How long we keep it

• Your account, Wishes, photographs, films and voice messages — while your account is open. When you ask us to delete it we first suspend and hide it, then erase it; see Data Deletion. Removing a film or voice message from a Wish deletes it from Mux as well.
• Names and addresses for delivery — erased automatically 90 days after the parcel is delivered or returned, 120 days after it was posted if we never learn either, or 30 days after an order is refunded or cancelled. Sooner if you, or the person they belong to, ask. When an account is erased, the addresses on its orders are erased with it.
• Order and tax records — at least seven years after the year of the order, because tax law requires it. They are not deleted on request, and they contain no photographs, films or recordings.
• Messages to us — the copy our website keeps is deleted 30 days after it reaches our inbox or after we have dealt with it, and after 12 months at the latest. The email itself is deleted on request.
• Waitlist — used only to tell you when we open; ask us and we delete it.
• Open and play counts — while the Wish exists.
• Security audit log — kept, because it is the record that requests like yours were carried out. Its IP hashes cannot be reversed by anyone without a secret key held only on our servers.
• Backups — our hosting provider keeps daily backups for about a week, and each is replaced as a new one is made.

9. Your rights

You can ask for a copy of what we hold about you (we send it in a common, readable format), ask us to correct it, or ask us to delete it. Write to contact@tapawish.com from the address on your account. If you have no account, we will ask for enough to be sure the request is yours, and no more. We reply within 30 days. Someone you authorise in writing may ask on your behalf. If we refuse any part of a request we will say why, and you can reply to ask us to look again.

Depending on where you live, state law may give you further rights, including not to be treated differently for using them — and we will not. We do not sell personal information and we do not share it for advertising, so there is nothing to opt out of. Browser "Do Not Track" and Global Privacy Control signals change nothing here for the same reason: we do not track you across other websites, and we do not allow anyone else to track you across ours.

10. Children

You must be 18 to have an account or to buy. We do not knowingly collect personal information from children under 13. A child who opens a Wish is counted exactly as described in section 4, and nothing more.

Wishes often contain photographs, films and voices of children, put there by the adults who make them. We protect them like everything else here: private originals, never used for advertising or machine learning, erased on request. If you are the parent or guardian of a child who appears in a Wish you did not make, write to us and we will act on it.

11. Security, and if something goes wrong

Staff access is limited by role and requires a second sign-in factor, sensitive reads are recorded, and data is encrypted in transit and at rest by our providers. If a breach puts your personal information at risk, we will tell you and the authorities the law requires us to tell, as quickly as the law requires and sooner where we can.

12. Changes, and how to reach us

If we change this materially we will say so on this page and update the date at the top. Write to contact@tapawish.com with any question, including a request for a copy of your data.