Effective date: October 1, 2026
1. Who we are and how to reach us
Sigil™ is a service that lets people lend physical items to friends and track who is holding what. Lending is triggered by tapping an NFC sticker on an item with a phone. Sigil™ is the product brand; the company that operates it is Tap Sigil.
- Data controller / business: Tap Sigil
- Privacy Officer / general inquiries: [email protected]
2. Information we collect
We collect only what the app needs to operate the lending workflow, plus a limited amount of diagnostic and performance data — how the app launches, performs, and where it runs into errors — so we can keep it reliable and fix your problems quickly. We do not use advertising SDKs, and we set no non-essential cookies.
2.a Account and identity information
When you sign up, our authentication provider (Clerk) collects and we store:
- Name
- Phone number (in E.164 format), where provided
- Email address, where provided
- An account identifier linking your Sigil™ profile to your Clerk login
- Feature access, including B2B Workspace grants and when they were granted, to determine which account features are available
- Your preferred contact channel (WhatsApp, SMS, or email) if you choose to set one, so someone who finds your item can reach you
2.b Item information
For each item you add, we store the details you provide:
- Item name
- Category (e.g. Tools, Kitchen)
- Location — a free-text label you type (e.g. "Garage", "Kitchen pantry"). This is a label you choose, not a GPS coordinate.
- Notes — any free-text distinguishing details you add
- SKU — an optional business inventory identifier provided by your organization
When you pair a batch of items from the web with your phone, we also store an ordered pairing queue, item-name snapshots, completion/skipping status and times, and the item/sticker identifiers needed to recover progress. A temporary scanner identifier and lease expiry prevent two phones pairing the same queue at once. Signed sticker credentials are processed to verify a tap. The app temporarily stores a pending signed scan on your device to recover interrupted pairing or container intake; confirmed operations clear the pending request. Raw signed credentials are not stored in the server pairing queue or application logs.
2.c Lending and custody history (the custody ledger)
Every borrow, return, hand-off, and claim is recorded as an event in a custody ledger. These records include which of your contacts borrowed which item, when, and the expected return date. This is the core record that lets the app show who is holding what. Because these records also describe other people's lending history, they are retained even after you delete your account (see Section 6 and Section 7).
2.d Notification content
When the app sends you (or an item's owner) a notification, we store the information needed to render it. Depending on the notification type this can include:
- The names of the people involved and the item name (denormalized into the notification so it can be displayed)
- A free-text message you write when you use the "found / here's where it is" feature to tell an owner about their item
- Optional Precise geolocation (latitude/longitude) captured on your device when you use that same "found" feature — see Section 8 (Sensitive information)
2.e Device and push-notification information
If you enable push notifications, we store a push notification token and your device platform (iOS or Android) so we can deliver alerts.
2.f Notification preferences
Your notification settings: time zone, quiet hours, reminder cadence, and default loan length.
2.g Voice-assist activity
If you use the voice feature to add an item, speech-to-text runs on your device (by Apple or Google), and only the resulting text transcript is sent to our AI provider (Anthropic) to structure it into item fields, together with the category and location labels you have already used on your items so the AI can reuse your existing labels instead of inventing near-duplicates. No account identifier is attached to that request. We keep a minimal internal log of when you made a voice request and what type it was — used to enforce usage limits and audit costs. This log does not store the transcript or the content of your request.
2.h Information about non-users (people who tap a sticker)
If someone who is not signed in taps one of your stickers and opens the tap page, we process their IP address for security and rate-limiting. When a person other than the owner taps a sticker, the tap page shows the item name and, if the owner has chosen a contact channel, that channel so the finder can reach out. Owners who choose anonymous mode are not exposed to the person tapping at all; the finder instead reaches them through the in-app message relay described in Section 4.
3. How and why we use your information
| Purpose | Data used |
|---|---|
| Authenticate you and maintain your account | Name, phone, email, account identifier |
| Show you your items and their status | Item details, custody ledger |
| Synchronize batch sticker pairing between web and phone | Pairing queue, item/sticker references, temporary scanner lease |
| Let friends borrow and return items via NFC tap | Custody ledger, item + owner details |
| Let a finder or borrower reach an item's owner | Owner's preferred contact (phone or email) |
| Send reminders and status notifications | Notification content, device token, preferences |
| Tell an owner where a borrowed item is (opt-in) | Precise geolocation, free-text message |
| Structure a spoken item description into fields | On-device transcript + your existing item category/location labels → AI provider |
| Protect the service from abuse | IP address, rate-limit counters, request logs |
| Enforce usage/cost limits on the AI feature | Voice-activity log (timestamp + type only) |
| Process one-time sticker purchases | Purchase receipt (checkout email, items, amounts) |
We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising as those terms are defined under the CCPA/CPRA.
4. How we share your information
We share personal information with the service providers ("sub-processors") that make the app work, only as needed for their function, and with other users as you direct through lending and personal category sharing.
| Sub-processor | What we send them | Why |
|---|---|---|
| Clerk | Name, phone, email, account identifier | User authentication and account management |
| Anthropic | Your voice-assist text transcript and the category/location labels you already use on your items (no account identifier attached) | Structure a spoken description into item fields |
| Expo (push service) → Apple Push Notification service / Google Firebase Cloud Messaging | Push token and the notification body, which for a "found item" alert includes the finder's message and a Google Maps link to the shared location | Deliver push notifications to your device |
| Cloudflare (R2 storage + DNS) | Sticker artwork images only — no personal user information | Host sticker artwork and route our domains |
| Fly.io (hosting) | All of our database and application logs | Run our servers and database (US region — see Section 5) |
| Apple / Google | App distribution; push transport (APNs/FCM); on-device speech recognition | App stores, notification delivery, voice-to-text |
| Stripe | An internal account identifier and an order summary when you start checkout — never your name, phone, or app email. Your email, payment card, and billing/shipping address are entered directly with Stripe on its hosted checkout page; Stripe then returns your checkout email and order details to us for the receipt | Payment processing for the sticker store (in beta — currently Stripe test/sandbox mode) |
We may also disclose information when required by law, to enforce our terms, or to protect the rights and safety of users.
People you share personal data with
When a user taps your Sigil, your configured contact information (separate from your profile details) is shown. This is to facilitate return of your Sigil back to you. You may configure which contact details are shown to other users.
For organization-owned assets, accepted organization members can see the organization's inventory and lending activity. Organization Admins manage memberships and configure the recovery contact and logo displayed to sticker scanners. Only the selected organization recovery channel is public; we do not substitute an individual member's contact details. Pairing status identifies the member currently reserving an asset for sticker assignment.
5. Cross-border transfer and US data residency
All personal data and logs are stored and processed in the United States (our hosting provider, Fly.io, runs our database and application in the US-East region, Ashburn, Virginia). Our other service providers are US-based providers that process data in the United States.
For users in Canada (including Québec): Using Sigil™ means your personal information is transferred to, stored in, and processed in the United States, where it may be accessible to US courts, law enforcement, and government authorities under US law. Québec Law 25 requires that we conduct and document a privacy impact assessment before transferring personal information outside Québec and confirm the information receives adequate protection.
6. How long we keep your information (retention)
Today, we retain most personal data indefinitely unless you delete it or your account. Two automated schedules apply: shared found-item location coordinates are deleted after 30 days (see Section 8), and completed or cancelled pairing queues are deleted after 30 days. Waiting, active and paused queues remain until cancelled or account deletion. Pairing cleanup does not delete your items, stickers or custody history.
| Data category | Retention |
|---|---|
| Account + profile | Until account deletion |
| B2B Workspace access grants | Until revoked or account deletion |
| Personal category sharing | Categories until category/account deletion; grants until category or participant account deletion; invitations until owner or accepted recipient account deletion |
| Item records | Until you delete the item or account |
| Pairing queues and item-name snapshots | 30 days after completion/cancellation; otherwise until account deletion |
| Custody ledger (your own items) | Until account deletion |
| Custody ledger (records naming you on others' items) | Retained, but your identity is removed |
| Notification content — messages, names | Indefinite by default |
| Notification content — shared location coordinates | 30 days |
| Server / application logs | Indefinite; host-side log storage has no enforced limit |
| Voice-activity log (timestamp + type only) | Indefinite by default |
7. Your privacy rights
7.a Everyone
- Delete your account and data. You can permanently delete your account from the app, or from a public web deletion page if you no longer have the app installed. This hard-deletes your profile, your personally owned items, your devices, your preferences, your voice-activity log, pairing queues, and notifications addressed to you, and deletes your login from our authentication provider (if that deletion cannot complete immediately, it is queued and retried automatically until it succeeds). Where your name appears in another user's lending history or notifications, we remove your identity from those records — your name is replaced with "Deleted user" and any message text or location you shared is removed — rather than delete the other person's history. Assets owned by an organization remain with the organization when their creator deletes their personal account; creator attribution and personal custody references are cleared.
- Export your data. You can download a complete copy of the data we hold about you at any time (see Section 7.b).
- Delete individual items at any time. A retained pairing queue keeps its original item-name snapshot and pairing/skipping history until its queue expires or you delete your account. A deleted queued item cannot subsequently be paired.
7.b Access / export your data (DSAR)
You have the right to request a copy of the personal information we hold about you — and you can exercise it self-serve, at any time: the app (and the signed-in API) lets you download a complete, machine-readable JSON export of your data, covering your profile, items, stickers, photos, personal categories, sharing invitations/access records (without invitation credentials), lending history, notifications, preferences, devices, voice-assist activity log, and any purchase or membership records, B2B Workspace access grants, and retained pairing history. Scanner identifiers and signed sticker credentials are excluded from exports. Requests made outside the app (for example, by email) are handled manually.
7.c California residents (CCPA/CPRA)
Subject to verification, you have the right to: know/access the categories and specific pieces of personal information we collect; delete your personal information; correct inaccurate information; opt out of sale or sharing (we do not sell or share — see Section 4); and limit the use of sensitive personal information. We will not discriminate against you for exercising these rights. Precise geolocation is treated as sensitive personal information — see Section 8.
7.d Canada (PIPEDA and Québec Law 25)
You have the right to access the personal information we hold about you and to request correction; to withdraw consent (including for the location feature); and, under Québec Law 25, additional rights including de-indexing and data portability for computerized personal information.
To exercise any right, contact us using Section 12.
8. Sensitive information: precise geolocation
The only sensitive category we handle is precise geolocation (latitude/longitude), and only in one place: the optional "found item" feature, where a person currently holding an item can share the item's current location with its owner. When shared, the location is stored in the notification record and included in the notification we send the owner (as a Google Maps link).
Location sharing is opt-in and off by default. The "share location" toggle starts off on every report; we ask for your device's location permission and only capture a coordinate if you explicitly turn sharing on for that report. Your consent decision is recorded with the report, and shared coordinates are automatically deleted after 30 days.
We do not track your location in the background and do not build a location history; a coordinate is only captured at the moment you send a "found" report.
9. Children's privacy
Children 12 years of age and older may provide personal information to Sigil only with parental consent and only for applications and services that allow use by children. If we learn that personal information has been collected from a child without such consent or from a child under 12 years of age, we will take steps to delete that information.
10. How we protect your information
- Authentication is handled by a dedicated identity provider (Clerk); we do not store your login password.
- Sticker links are cryptographically signed so random or forged sticker IDs are rejected.
- The service applies rate limiting to abusive request patterns.
- Data is hosted on managed infrastructure in the United States.
11. Changes to this policy
We may update this policy as the app evolves. When we make material changes, we will update the date above.
12. How to contact us / exercise your rights
- Privacy Officer (Canada) / Privacy contact: [email protected]
If you are in Canada and are not satisfied with our response, you may contact the Office of the Privacy Commissioner of Canada or, in Québec, the Commission d'accès à l'information. California residents may contact the California Privacy Protection Agency or the California Attorney General.
Personal category sharing
Personal libraries remain private until you share a category. Sharing lets the recipient browse item names, categories, your sharing identity, and whether an item is Available or Lent out. It does not reveal borrower identity, loan history, private notes or location, and does not grant permission to edit, delete, borrow or return an item. Item photos are not included in this release.
The initial invitation links are unnamed: the first signed-in person to accept receives access. Links expire after seven days and can be accepted only once. You can revoke an unused invitation separately from access already accepted. Sharing opens your device share sheet; you choose where to send or copy the link. Cancelling the sheet leaves the invitation pending. A recipient can decline by dismissing the invitation without receiving access; this does not revoke the link. Changing category membership changes which items recipients can browse; renaming a category preserves access. Revocation ends future authorized browsing but cannot remove information a recipient already saw or copied. Existing loans remain independent of browsing access. No contacts are imported for this feature.
We store category names and ownership, invitation state and token hashes, and recipient grants to provide this feature. Your account export includes your categories and relevant invitation/access records without invitation credentials. Deleting your account removes your categories, invitations you created or accepted, and grants involving you. Revoked grants remain stored until category or participant account deletion; expired or revoked invitations remain until owner or accepted recipient account deletion. Deleting a category removes its grants and revokes unused invitations that included it.