Legal
Privacy Policy
Applies to: the mobile game Tapzine (iOS, Android) and its servers (the "Service")
1. Who we are
- Controller: JoCoding, Inc., a Delaware corporation
- Address: 1111B S Governors Ave, STE 80543, Dover, DE 19904, United States
- Email: mu07010@jocoding.net
- Phone: +1 (231) 450-5622
- Website: https://tapzine.jocoding.io
2. Summary
- There is no sign-up form. When you first open the app, our server creates a random account number for that install. We do not ask for your name, email, phone number or date of birth.
- Usage statistics are collected with an anonymous identifier (a random analytics number created per install, different from your account number). In the EU, EEA, UK and Switzerland they are collected only after you agree. Elsewhere they are on by default and you can turn them off in Settings under USAGE DATA.
- We do not collect advertising identifiers (IDFA, Google Advertising ID) and we do not show the iOS App Tracking Transparency prompt.
- Levels you upload (title, intro, tags, images, music, charts) become public to all users after moderation.
- You can delete your account inside the app.
3. What we process, why, on what legal basis, and for how long
Legal bases refer to the EU/UK GDPR: contract = Art. 6(1)(b), legitimate interests = Art. 6(1)(f), consent = Art. 6(1)(a), legal obligation = Art. 6(1)(c).
3.1 Account
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Random account number created by our server | Identify the account; link levels, credits and records | Contract | While the account exists. After deletion the number remains in a "deleted" state so financial and moderation records stay consistent |
Display name Player-XXXX (set by the server from the first 4 characters of the account number; no free text) | Show the creator in level lists, challenges and Together rooms | Contract | While the account exists; changed to "Deleted" on deletion |
| Account type (anonymous / signed in), upload suspension flag | Permissions, enforcement | Contract; legitimate interests (safety) | While the account exists |
| Sign-in session (hash of the token, created time, last-used day; the raw token is never stored on the server) | Keep you signed in | Contract | While the account exists; deleted on account deletion |
| When signing in with Apple or Google (planned for release): that provider's account identifier ("sub") | Use the same account on another device; permission to upload and report | Contract | While the account exists; deleted on account deletion. We do not store your email |
| Account token, number and display name stored on your device | Stay signed in when you reopen the app | Contract | Until you uninstall the app or delete the account |
3.2 Gameplay
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Likes (account, level, time) | Like counts and showing your likes | Contract | While the account exists; deleted on account deletion |
| Play records (account, level, UTC date, cleared or not) | Count at most one play per day | Contract | While the account exists; deleted on account deletion |
| Downloaded levels, your scores and settings stored on your device | Offline play, keeping settings | Contract | Until you uninstall (device only) |
| Pictures you pick from your photo library | Put a picture into your own level | Contract | Resized on the device and stored in the level; sent to our server only if you upload that level. Photo access happens only through the system picker at the moment you pick |
3.3 Levels you upload (user content) and reports
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Level bundle (music, images, chart), title, intro, tags, upload time, status | Publish and distribute | Contract | While public. If you take it down or delete your account it becomes private, but the files remain on our servers |
| Automated moderation results (image hash and verdict) | Avoid re-checking the same image | Legitimate interests (safe publishing) | - |
| Moderation action log (who: system / operator / account number; what; when; reason code) | Accountability, appeals | Legitimate interests; legal obligation where applicable | kept after account deletion |
| Reports (reporting account, level, reason, time, outcome) | Moderation, abuse prevention | Legitimate interests | kept after account deletion as an operational record |
| Upload de-duplication record (account, key, request hash, response) | Make sure an upload is applied only once | Contract | deleted on account deletion |
- Before publication, images and the title and intro are sent to an automated moderation service, and images go through a child-safety check against known child sexual abuse material hashes. Neither provider has been chosen yet. Until then, every level is checked by an operator before it becomes public.
- If suspected child sexual abuse material is found, we make the level private immediately, report it to the competent authority where the law requires (in the US, NCMEC) and preserve it for the period the law requires (one year under 18 U.S.C. §2258A).
3.4 Challenges and Together (multiplayer)
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Challenge (sender account number, display name at the time, 6-digit code, song and difficulty, score, judgement counts, max combo, cumulative score per second of the song, song length, created time) | Let the recipient of the code play the same song against your score | Contract | 30 days, then deleted automatically by the server. Deleted when the account is deleted |
| Together room state (per seat: account number, display name, player/spectator, ready/connected, chosen song, final result of the round) | Start together, share scores, show results | Contract | While the room is alive; wiped entirely 10 minutes after everyone has left |
| Live score and combo (every 0.5 s) | Show bars on other players' screens | Contract | Gone when the connection closes (not stored) |
- Anyone who knows a challenge code can view that challenge, including the sender's display name, without signing in.
- Rooms have no chat. Only fixed message types, numbers and an emote sticker number are exchanged.
3.5 Credits and payments
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Credit ledger (account number, entry type: purchase, grant, hold, settle, refund to user, store refund; amount; store transaction ID; product ID; time) | Balance, matching purchases and refunds, disputes | Contract; legal obligation (accounting and tax records) | Kept after account deletion (financial record) |
| Payment processing | Confirm purchases | Contract | Payments are processed by the Apple App Store or Google Play. We never receive card numbers or other payment instruments |
| RevenueCat customer ID (= our account number), purchase history | Verify purchases and grant credits | Contract | Per RevenueCat's policy |
| Payment webhook log (RevenueCat event ID, type, outcome code, time; no account number) | Process each notification once | Contract | - |
3.6 Music and picture generation (planned for release; not connected on the production server yet)
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Generation job (account number, type, status, cost, the text you wrote, chosen mood, genre, tempo and drawing style, provider name and job ID, error code, result file list, times) | Run the job, let you re-download results, cost limits, moderation tracing | Contract | On account deletion, queued jobs are cancelled; the records and text remain |
| Generated audio and image files | Let you download them into your level | Contract | - |
- We send generation providers only your text, our fixed instructions and reference images. We do not send your account number or IP address. Candidate providers: ElevenLabs (music), OpenAI (images).
- Generation text and results also go through automated moderation.
- We ask for your explicit permission in the app before sending anything to an external AI service.
3.7 Security and abuse prevention
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| A hash of your IP address (first 32 characters of a salted SHA-256; the raw IP is not stored) or account number, event type, time | Rate limits on account creation, generation, challenges and room creation | Legitimate interests (preventing abuse and fraud) | - |
| Server request log (route name, status code, error code, duration; no bodies, titles or free text) | Operations and incident response | Legitimate interests | Per Cloudflare log settings |
| Connection data processed by our host Cloudflare (IP address etc.) | Delivering the Service, security | Legitimate interests | Per Cloudflare's policy |
3.8 Usage statistics (PostHog)
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Anonymous identifier (random per install, different from your account number, not linked to sign-in) | Group events from the same install | See section 5 | Per PostHog retention |
| Event names with numbers and fixed values only: app_open, calibration_done, calibration_skipped, song_start, song_finish, song_quit, album_unlocked, creator_open, creator_step, upload_start, upload_success, upload_rejected, level_download, level_like, level_report, shop_open, purchase_start, purchase_success, purchase_fail, gen_start, gen_success, gen_fail, together_start, update_prompt_shown, review_prompt_requested, settings_changed, subscription_open, subscribe_start, subscribe_success, subscribe_fail, restore_purchases, tutorial_start, tutorial_complete, tutorial_skip, cancel_reason_shown, cancel_offer_shown, cancel_offer_taken, subscription_manage_open, offer_code_open, offer_code_result, notification_permission, trial_reminder_scheduled, push_opened | Understand which features are used and where people get stuck; improve the game | Same | Same |
| Values attached to every event: app version, platform, OS version, device model, language/region setting, build type (dev/prod) | Find version- and device-specific problems | Same | Same |
| Approximate location (country, city) | Country statistics | Same | - |
- Never sent: level titles and intros, generation text, display names, email, precise location, advertising identifiers.
- PostHog receives your IP address when it receives events. Whether it is stored and whether location is derived from it depend on project settings.
- Purchase events: RevenueCat forwards purchase and refund events to PostHog. It uses the same anonymous identifier, but RevenueCat's purchase events also contain the RevenueCat customer ID (= our account number), the store transaction ID, the product and the amount. If usage statistics are off, RevenueCat may still send purchase events keyed by the customer ID instead.
3.9 Install and purchase attribution (Meta SDK; planned for release, not in the app today)
The app will include only the App Events part of Meta's (Facebook's) official SDK and send to Meta directly. We do not use any other install attribution company.
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| The fact that the app was opened (Meta counts the first open as an install) | Measure which ads led to installs | See section 5 | Per Meta's policy |
| Four purchase funnel events: credit checkout started, credit purchase completed, subscription checkout started, subscription completed. The only values sent with them are the product or plan ID and its type (credits/subscription) | Measure which ads led to purchases | Same | Same |
| App and device information the SDK attaches to its requests (app version, device model, OS version, language setting, etc.), an anonymous install ID created by the SDK, and the IP address Meta's servers receive | Same | Same | Same |
- In-game actions such as playing songs, creating or browsing levels are not sent to Meta. We do not pass our account number or the usage statistics identifier to Meta.
- We do not collect advertising identifiers (IDFA, Google Advertising ID). We turn off the SDK's advertiser ID collection and automatic event logging, we do not ask for App Tracking Transparency permission on iOS, and we remove the advertising ID permission from the Android build.
- The same regional rule as usage statistics applies (section 5): in the EU, EEA, UK and Switzerland (and on devices whose region cannot be determined) the SDK starts only after you agree. Elsewhere it is on by default and stops when you turn off Settings > USAGE DATA.
3.10 Crash and error reports (planned for release; provider TBD)
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Error type name, fixed error code, app version, device model, OS version | Fix crashes | - | Per provider |
- No raw error messages, nothing you typed, no level titles or names. Candidate providers: Sentry or Firebase Crashlytics.
3.11 Contacting us
- CONTACT US in Settings opens an email draft to mu07010@jocoding.net. The draft automatically includes the app version, OS, device model, server account number and store customer ID, and no other personal data. You can see, edit or remove it before sending.
- If you send it, we receive your email address and the message. Purpose: answering you. Legal basis: contract or legitimate interests.
3.12 Trial ending reminder (iOS, only when you start a subscription with a free trial)
- Only right after you start a subscription with a free trial do we ask for notification permission. If you allow it, we schedule one reminder on your device for 1 to 2 days before the trial ends. Nothing is sent to our server or to any other company.
- The reminder contains only text written by us. If you turn off auto-renewal during the trial, we remove it. You can turn notifications off anytime in your device settings.
- Whether you opened the app from the reminder is counted in usage statistics (3.8) as
push_opened.
4. What we do not collect
Real name, email (except when you email us), phone number, date of birth, payment instruments, precise (GPS) location, advertising identifiers, hardware device IDs, contacts, raw IP addresses stored on our servers.
5. Regional default for usage statistics and how to opt out
Applies to usage statistics (3.8), attribution (3.9, at release) and crash reports (3.10, at release). Your region is taken from your device's region setting.
| Region | Default | How to change | Legal basis |
|---|---|---|---|
| EU, EEA, UK, Switzerland | Off. Turned on only if you agree on the consent screen at first launch | Turn off any time in Settings > USAGE DATA (withdraw consent) | Consent (GDPR Art. 6(1)(a)) |
| Region cannot be determined | Same as above: only after consent | Same | Consent |
| All other regions | On | Turn off in Settings > USAGE DATA | Legitimate interests (improving the game, measuring ad performance) |
- Turning it off discards unsent statistics on the device and deletes the anonymous identifier. Turning it back on creates a new one. Statistics already sent remain in PostHog under the old identifier (see section 9).
- Once you make a choice, it overrides the regional default.
6. Who receives data
We do not sell personal information. The companies below process data on our behalf (processors) or as part of their own service.
| Recipient | Role | Data | Status |
|---|---|---|---|
| Cloudflare, Inc. (Workers, D1, R2, Durable Objects) | Run the server, store data, deliver files | Server data in 3.1 to 3.7, connection data (IP etc.) | In use |
| Apple Inc., Google LLC | App distribution, payments, sign-in (at release) | Purchase data, sign-in tokens | In use (sign-in at release) |
| RevenueCat, Inc. | Store purchase verification | Account number, purchase history | At release |
| PostHog, Inc. | Usage statistics | 3.8 | At release |
| Meta Platforms, Inc. (Meta Platforms Ireland Ltd. for the EU/EEA) | Install and purchase attribution, ad measurement (sent directly by the Meta SDK in the app) | 3.9 | Planned for release |
| Generation providers (candidates: ElevenLabs, OpenAI) | Music and picture generation | Text and choices in 3.6 | - |
| Moderation service (TBD) | Pre-publication checks of images and text | Level images, title, intro, generation results | - |
| Child-safety hash matching tool (TBD) | Match against known child sexual abuse material | Images or their hashes | - |
| Crash reporting provider (candidates: Sentry, Firebase Crashlytics) | Crash reports | 3.10 | - |
| Email provider (TBD) | Receiving support email | 3.11 | - |
| Law enforcement and competent authorities | When required by law; child-safety reports | As required by law | When applicable |
If the company is merged or acquired, data may be transferred within the limits of this policy, and we will tell you beforehand.
7. International transfers
We are a US company and the recipients above process data in the United States and other countries. Your data will be transferred outside your country.
- For users in Korea: you can refuse by turning off usage statistics (section 5) or deleting your account; server storage itself is necessary to provide the Service.
8. Retention and deletion
- We delete data when the period in section 3 ends or the purpose is fulfilled. Automatic cleanup is currently implemented for challenges (30 days) and Together rooms (10 minutes after everyone leaves). Other periods will be fixed and automated before release.
- Records the law requires us to keep (payments and accounting, child-safety reports) are kept with restricted access for that period and then deleted.
- Electronic files are deleted so they cannot be restored.
9. Your rights
Depending on where you live, you may ask to access or get a copy of your data, correct it, delete it, restrict or object to processing (including processing based on legitimate interests), port it, and withdraw consent. Residents of some US states have rights to opt out of sale or sharing and to limit the use of sensitive data.
- In the app: delete your account (section 10), take down your levels (Browse > MINE > TAKE DOWN), turn off usage statistics (Settings > USAGE DATA).
- Otherwise: email mu07010@jocoding.net. Using CONTACT US in the app includes your account number, which speeds up verification. We may ask for your account number or store customer ID to confirm it is you. We answer within the period required by law (for example one month under the GDPR).
- Usage statistics are stored only under the anonymous identifier, which is not shown in the app, so we may be unable to find a specific person's statistics.
- Users in the EU and UK can complain to their local data protection authority. Users in Korea can contact the Personal Information Dispute Mediation Committee or the Personal Information Infringement Report Center.
- We will not treat you differently for exercising your rights.
10. Deleting your account
Go to Browse > Account > DELETE MY ACCOUNT. When you delete:
- Deleted immediately: sign-in links (Apple/Google identifiers), sign-in sessions, likes, play records, challenges you sent, upload de-duplication records. Queued generation jobs are cancelled and held credits are returned.
- Changed: your display name becomes "Deleted" and all your uploaded levels are taken down (removed from public lists and downloads).
- Kept: the credit ledger (financial record), report and moderation records (operational records), generation job records, files of taken-down levels, and IP-hash security records. Together room data disappears within 10 minutes at most.
- Remaining credits are lost and are not refundable (see the Terms).
- The anonymous analytics identifier on the device is reset.
11. Children
The Service is not directed to children. If we learn that we processed data of a user below the minimum age, we will delete it. Parents or guardians can contact mu07010@jocoding.net.
- Korea: processing data of children under 14 requires consent of the legal representative.
- EU: the age of digital consent is 13 to 16 depending on the country.
- US: the Service is not directed to children under 13 (COPPA).
12. What is public
- Uploaded levels (title, intro, tags, images, music, chart), the creator's display name, like counts and play counts are visible to all users.
- A challenge is visible to anyone with its code; display names and scores in a Together room are visible to people in that room.
- Other users can download public levels to their devices. If a level is taken down, play is blocked on those devices at the next check, but we cannot delete the file from their devices.
13. Security
Encryption in transit (HTTPS), sign-in tokens stored only as hashes, IP addresses stored only as salted hashes, separate authentication for the operator console, no bodies or free text in request logs, payment secret keys kept only on the server. No method of security is perfect.
14. Additional notice for users in Korea
- Automatic collection: we do not use web cookies. The app stores an account token, settings and the anonymous identifier on the device. Usage statistics can be turned off in Settings > USAGE DATA.
- Processors and international transfers: sections 6 and 7.
15. Additional notice for users in the EU and UK
- Controller: JoCoding, Inc. (section 1)
- Automated decisions: automated moderation can reject a level or send it to human review before publication. If you object to the result, a person will review it again.
16. Additional notice for US state residents
- We do not sell personal information for money.
- Turning off Settings > USAGE DATA stops the app's Meta SDK from sending install and purchase events to Meta.
17. Changes
We will announce changes in the app or at https://tapzine.jocoding.io with the effective date. If purposes or recipients change materially and consent is required, we will ask again.
18. Contact
JoCoding, Inc., 1111B S Governors Ave, STE 80543, Dover, DE 19904, United States
Email mu07010@jocoding.net, phone +1 (231) 450-5622