Exactly what TAPCO collects, why, who sees it, and how to delete it

1) What we collect, and why

• Your Telegram id. It is your account with us. Without it we cannot tell that the progress is yours or put your points anywhere.
• Your Telegram name. Your first and last name as Telegram holds them. If your account has neither, we use your Telegram @username instead, and if there is no username either you appear under a generic name. It is shown to other players on the leaderboard and to anyone you invite.
• Your Telegram language. Used to open the game in the language you already read, and stored so it stays chosen.
• Your progress. Points, level, energy, missions, achievements, referrals. This is the part that means your game is where you left it.
• A fingerprint of your IP address. We take a SHA-256 hash of the address and keep only that. Your real address is never stored and cannot be recovered from the hash. It is used to detect multiple accounts and automated tapping.
• A device identifier. A random value generated once and kept in your browser's storage. It identifies this installation and nothing about your device. Where the browser has no storage to keep it in, we fall back to a value built from your browser name, screen size and language, and the server is told not to treat that one as an identity.
• Your TON wallet address. Stored only after you connect a wallet yourself, and used only to send what you withdraw.
• Your withdrawal and deposit history. Amounts, dates and transaction references — because a financial record that cannot be checked is worth nothing, and because we are required to keep it.
• On this website only: your language choice, your cookie choice, and a referral code if you arrived through an invitation link. Nothing here identifies you, and all of it stays in your own browser.

2) What we do not collect

• Not your real name or your address.
• Not your email or your phone number.
• Not your location.
• Not your contacts, your photos, or anything else from your device.
• And never your private key or recovery phrase. We will not ask, ever — and neither will anyone who is genuinely from TAPCO. If you are asked, the person asking is not us; the Support page tells you how to reach the real one.

3) Who sees what

• Only you. Your balances, your wallet, your transaction log, your account details.
• Other players. Your name and your score on the leaderboard. Anyone you invite sees your name, and you see the names of those you invited and how far they are from qualifying.
• Everyone, permanently. Any withdrawal or deposit on the TON network is written into a public blockchain. Anyone can read it, it stays there for as long as the network exists, and neither we nor anyone else can erase it. This is how every blockchain works and it is the one part of your data we cannot delete for you.

4) Who else touches your data

These are every company and network that sees any part of it, what each one gets, and where their own policy is. Nobody outside this list receives anything, we do not sell your data, and we do not pass it to data brokers.

• Telegram — the game runs inside Telegram and authenticates your account through it. What Telegram itself sees is governed by Telegram's privacy policy, not ours.
• The TON network — to carry out withdrawals and deposits and to ask the chain about a transfer, through tonapi.io and toncenter.com. They see wallet addresses and transaction data, which are public on the chain in any case.
• AdsGram — the advertising network behind the optional rewarded ads in the game. Nothing plays unless you press the button yourself, and when you do the network receives your Telegram id so it can tell our server the ad was watched and your reward is paid. It is given nothing else about you. AdsGram's privacy policy. What we will and will not do with advertising is set out on the Ad Policy page.
• Monetag — a second advertising network, asked only when the first one cannot show an advertisement, which happens on some mobile networks. It is given exactly what the first is given: your Telegram id, and nothing else. Monetag's privacy policy.
• Google Analytics — on this website only, and only after you press "Accept All" in the cookie notice. If you choose "Essential Only" it is never loaded and Google is never contacted for it. It measures which pages are read; it is not present inside the game at all. Google's privacy policy.
• Google Fonts — this website loads one typeface from Google's servers, so Google receives the address of every visitor as part of that request. This one is not covered by the cookie choice, because the page cannot be drawn without its type. Same policy as above.
• Cloudflare — serves this website and therefore handles every request to it, including your IP address in transit. Cloudflare's privacy policy.
• Render — runs our server, so everything the game sends us passes through their infrastructure. Render's privacy policy.
• MongoDB — the database your account is stored in. MongoDB's privacy policy.

5) Cookies and what stays on your device

We set no cookies of our own, on the website or in the game. What we use is your browser's own storage, which never reaches us and which clearing your browser data erases.

• In the game: your language, sound and vibration settings, a copy of your progress so the page opens quickly, and the device identifier described above.
• On this website: your language choice, your answer to the cookie notice, a referral code if you arrived through an invitation link, and the name of the bot your link pointed at.
• Cookies that are not ours: if you press "Accept All", Google Analytics sets its own cookies under Google's policy. That is the only case, and "Essential Only" prevents it.

6) How long we keep it, and how to have it deleted

Your account and its data stay for as long as the account exists. There is no automatic deletion after a period of inactivity: an account left alone for a year is still there when you come back to it.

To have it deleted, write to us through the Contact page and include your player id — it is in Settings and on the Support & Help screen inside the game, with a copy button beside it. We carry it out within thirty days. Thirty days is the maximum the law allows us, not the time we aim to take.

What deletion actually does: your name, your account identifier and the fingerprints tied to you are erased, and your withdrawal records are kept without any identity attached to them. We keep those because they are financial records we are required to hold, because the anti-fraud system needs them to keep working for everyone else, and because the transfers themselves are already written permanently into the public TON blockchain, where nobody can delete them.

Backups. Our database is held on MongoDB Atlas, which takes one automatic snapshot of it every 24 hours and keeps each snapshot for 8 days before deleting it. So when a deletion request is carried out, your data is erased from the live database immediately, and a copy of it may remain inside those automatic backups for at most 8 more days, after which it is deleted automatically and cannot be recovered. Nothing is ever read out of a backup except to bring the service back after a failure.

7) Your rights

You can ask for a copy of your data, ask us to correct it, or ask us to delete your account entirely. Write through the Contact page with your player id and say which of the three you want. We answer as fast as we can.

The one thing we cannot do is remove a transaction from the TON blockchain. It is on the chain, and neither we nor anyone else can erase it — that is what a public ledger means, and it is worth knowing before you make your first withdrawal. The Terms of Use set out the rest of what you and we each owe.

8) Age

TAPCO is for players aged eighteen and over, on the website and in the game. The game pays a token out to wallets you control on a public blockchain, and that is not something we are willing to put in front of a child. If we learn that an account belongs to someone younger, the account is closed and its data deleted.

9) Who we are, and how to reach us

TAPCO GAME is operated by FADI ALHAMID — individual operator, Turkey. Compliance email support@tapcogame.io, telephone +90 549 889 88 98. The full operator record is published on the Legal Disclosure page, and the two say the same thing on purpose.

For anything in this policy, write through the Contact page or to support@tapcogame.io. If this policy changes in a way that matters, we will say so inside the game before it takes effect, and we will not take away a right we have given you without telling you.