Privacy Policy

This Privacy Policy explains how LidTap (“the App”) and the website at lidtap.app (“the Site”) handle information. LidTap is an iPhone app that lets you stick an NFC tag on a supplement bottle and log a dose by tapping the bottle with your iPhone.

By using the App or the Site, you acknowledge this Policy. If you do not agree, do not use LidTap. This Policy should be read with the Terms of Use.

1. Summary

LidTap does not create a user account. Your supplement names, NFC tag links, dose history, reminder settings, and widget data are stored on your iPhone. They are not uploaded to a LidTap server and are not synced with iCloud or Apple Health.

Some information may leave the device when:

• you buy or restore LidTap Premium (Apple and RevenueCat);
• the App sends product-analytics events (Mobiqo);
• you send a message with Contact developer;
• iOS opens a Universal Link written on an NFC tag (this Site does not log the dose).

2. Information stored on your iPhone

Depending on how you use the App, the following may be stored locally:

• supplement names, colours, and creation dates;
• NFC tag identifiers (hardware UID when available, and the UUID written into the tag);
• dose timestamps;
• optional reminder hour, minute, and weekdays per supplement;
• onboarding and settings flags, including notification permission state;
• a copy of today’s checklist in an App Group so the Today widget can display it;
• an anonymous identifier used if you contact the developer;
• RevenueCat’s anonymous app user ID, as stored by that SDK on the device.

This local data is processed to provide the App you asked for (logging doses, reminders, statistics, and the widget). Legal basis: performance of a contract (Article 6(1)(b) GDPR) and, where needed, legitimate interests in operating the App (Article 6(1)(f) GDPR).

You can export a CSV of your log (a Premium feature) via the iOS share sheet — you choose where that file goes. You can erase all LidTap data in Settings. Uninstalling the App also removes on-device data, except anything you already exported or wrote onto a physical NFC tag.

We do not operate a remote copy of your log. If you lose the device, restore from a backup that does not include the App, or erase the App, that history may be gone. We cannot recover it.

3. NFC tags and Universal Links

When you link a tag, LidTap writes a URL of the form https://lidtap.app/t/{identifier}. iOS uses that address so a background or lock-screen tap can open LidTap and log a dose on the phone.

The Site is a static host. It does not create an account, does not store dose history, and does not record that a particular identifier was visited. Opening the URL in a browser does not log a dose. The identifier is useful only together with the copy of LidTap on your iPhone.

Anyone who can physically read the tag can see that URL. Do not treat a bottle tag as a secret. You are responsible for which tags you stick on which bottles.

4. Information that may leave the device

4.1 Apple — App Store purchases

LidTap Premium is sold as an auto-renewable subscription through Apple. Payment, Apple ID, and StoreKit receipts are processed by Apple, not by us. We do not receive your full payment-card details. See Apple’s Privacy Policy.

Legal basis: performance of a contract (Article 6(1)(b) GDPR).

4.2 RevenueCat

The App uses RevenueCat to check subscription status (the “premium” entitlement) and to present the yearly offering. RevenueCat may process an anonymous app user ID, product identifiers (including com.gsy.lidtap.yearly), purchase and restore events, and entitlement status. Details: RevenueCat Privacy Policy.

Legal basis: performance of a contract (Article 6(1)(b) GDPR).

4.3 Mobiqo — product analytics

The App uses Mobiqo to understand how LidTap is used so it can be improved. After launch, the SDK is initialised and synced with the RevenueCat app user ID. Events may include:

• onboarding steps and skips;
• onboarding completed;
• supplement added (the name you typed);
• tag added (the supplement name);
• tag tapped (the supplement name and whether the tap came from a scan or a Universal Link);
• paywall shown or dismissed;
• purchase started, succeeded, cancelled, or failed (product ID and, if failed, an error string);
• restore started, succeeded, failed, or nothing to restore.

Do not put information in a supplement name that you do not want included in analytics (for example a medical condition). Mobiqo’s own policy: Mobiqo Privacy Policy.

Legal basis: legitimate interests in understanding and improving the App (Article 6(1)(f) GDPR). You may object by emailing pro@alexandre-grisey.fr. Uninstalling the App stops further events from that installation.

4.4 Contact developer

If you use Contact developer, you choose to send a message. The App posts to a Google Cloud Function (region us-central1) with: the app identifier (“lidtap”), a local device identifier, your email, your message, iOS name and version, app version, RevenueCat app user ID, and device model. That is so the message can be answered and related to a purchase if needed.

Legal basis: consent / taking steps at your request (Articles 6(1)(a) and 6(1)(b) GDPR). Do not send information you do not want us to receive. We keep contact messages as long as needed to handle them, then delete or archive them in the ordinary course of email.

4.5 Notifications

Reminders are scheduled on the device with UserNotifications. LidTap does not send marketing push notifications from a server. iOS asks for permission; you can change it in iOS Settings.

5. This website

The Site introduces LidTap, hosts this Policy and the Terms of Use, and serves Apple’s associated-domain file so bottle tags can open the App. It is static. We do not set an account cookie or store your supplement history on the Site.

Pages load fonts from Bunny Fonts (fonts.bunny.net). Your browser will request those files. Hosting, HTTPS, and DNS providers necessarily see standard connection data (such as IP address and requested URL) in server logs, which they retain according to their own policies and legal duties.

The Site uses self-hosted Plausible Analytics (script loaded from plausible.alex0x47.website) to count visits and see which pages are used. It does not set cookies and does not collect names or email addresses. It may record the page URL, referrer, browser, device type, and country. Legal basis: legitimate interests in operating and improving the Site (Article 6(1)(f) GDPR). You may object by emailing pro@alexandre-grisey.fr or by blocking the script in your browser.

6. Recipients and transfers outside the EEA

Depending on the feature, information may be processed by:

• Apple (App Store / StoreKit);
• RevenueCat, Inc. (subscriptions);
• Mobiqo / related infrastructure (app analytics);
• Self-hosted Plausible (website analytics);
• Google Cloud (Contact developer function in the United States).

Some of these organisations are in the United States or otherwise outside the European Economic Area. Where GDPR requires a transfer tool, we rely on the mechanisms those providers offer (including Standard Contractual Clauses and, where applicable, adequacy decisions). Apple, RevenueCat, Google, and Mobiqo apply their own privacy terms to the processing they perform.

7. Retention

• On-device LidTap data: until you erase it, uninstall, or the device is reset.
• NFC tag URL: remains on the physical tag until overwritten or discarded.
• Purchases: retained by Apple and RevenueCat for as long as they need to provide the store and subscription.
• App analytics events: retained by Mobiqo according to its policy and our configuration.
• Website analytics: retained on our self-hosted Plausible instance according to its configuration.
• Contact messages: as needed to reply, then ordinary email retention.

8. Your rights (GDPR)

If you are in the EEA, the United Kingdom, or another region with similar rights, you may request access, rectification, erasure, restriction, objection, or portability of personal data we hold, and you may withdraw consent where processing is based on consent, without affecting prior processing.

For data that exists only on your iPhone, use the App (edit or delete supplements, erase all data) or iOS settings. We cannot see or download your local log from here.

Write to pro@alexandre-grisey.fr. You may also lodge a complaint with the Commission Nationale de l’Informatique et des Libertés (CNIL, France) or your local supervisory authority.

9. Children

LidTap is not directed at children. Do not use the App if you are under 15 (the French age of digital consent) or under the minimum age in your country. We do not knowingly collect personal data from children. If you believe we have, contact us and we will delete what we hold.

10. Security

On-device data uses Apple’s storage for apps and the App Group. The Site is served over HTTPS. No method of transmission or storage is perfectly secure. You are responsible for the physical security of your iPhone and of any NFC tags.

11. Changes

We may update this Policy. The “Last updated” date will change. The current version is published at /privacy. Continued use after a change means you accept the updated Policy, except where the law requires something more.

12. Contact

You can also use Contact developer inside LidTap Settings.