Privacy policy

Last updated: 31 October 2026

1. Controller

Tobias Goral, Carrer Fastenrath 176, 08032 Barcelona, Spain. Email: info@tob-apps.com. This is also our contact for privacy questions.

2. What we process and why

• Account: name, email address and a hash of your password, never the password itself. We need these to run your account (Art. 6(1)(b) GDPR).
• Sessions: a login cookie, plus the IP address and browser of each signed-in session, to keep you signed in and protect your account (Art. 6(1)(b) and (f)).
• Workspace content: the objects, tags and locations you enter, including any contact details you add. We process these on your behalf to provide the service.
• Tag taps: the time of each tap, linked to the tag and the object. We don't store who tapped or their IP address with this record, and it's visible to the workspace that owns the tag (Art. 6(1)(b) and (f)).
• Contact form: your name, email address and message, to answer you (Art. 6(1)(f)).
• Server logs: shortened IP address, time, page and status, to keep the service secure and working (Art. 6(1)(f)).

3. Cookies and tracking

We only use the cookies needed to keep you signed in. We don't use analytics, advertising or tracking, and fonts are served from our own server.

4. Who receives your data

We run TagOS and send its emails on a server we operate ourselves. We don't sell your data. Public object pages show what the workspace owner chose to publish, to anyone who has the link.

5. How long we keep it

• Account and workspace content: until you delete them or ask us to.
• Server logs: 14 days.
• Database backups: 14 days, so deleted data disappears from backups within that time.
• Contact messages: as long as needed to deal with your request.

6. Your rights

You can ask us for access, correction, deletion, restriction or a copy of your data, and object to processing based on legitimate interests. Email us to do so. You can also complain to a data protection authority, such as the Spanish AEPD.