Privacy Policy

📡 NFC Usage

tap2nfc uses your iPhone's NFC hardware exclusively to communicate with NTAG213, NTAG215, and NTAG216 chips in the field. The app:

• Reads the chip's unique identifier (UID) to look up its registry record.
• Writes NDEF URL records and password credentials supplied by the registry server during programming.
• Authenticates against the chip's stored password during reset operations.
• Erases NDEF data and removes password protection during reset operations.

No NFC data is stored on-device beyond the duration of each individual NFC session. NFC access is never used for tracking or location purposes.

🔐 Authentication & Token Storage

When you sign in, the API server returns a JSON Web Token (JWT). This token is stored in the iOS Keychain using the following access controls:

• Keychain item class: kSecClassGenericPassword
• Accessible only when the device is unlocked (kSecAttrAccessibleWhenUnlocked)
• Deleted from the Keychain immediately when you sign out

Your password is never stored on-device. It is transmitted once to the API server over HTTPS during login and is not retained afterward.

💾 Local Storage

The only data stored locally on your device is:

• JWT session token — Keychain only, deleted on sign-out.
• API server URL — saved in UserDefaults so you don't have to re-enter it. This URL is configured by you and is never transmitted to any third party.

No tag data, NFC credentials, UIDs, or registry records are persisted on-device. All tag information is fetched live from the API server on demand.

🌐 Network Requests

The app communicates only with the API server URL you configure in Settings (defaulting to api.tap2nfc.dev). Requests include:

• Login: your email and password sent over HTTPS.
• Tag registry reads and writes: authenticated with your JWT Bearer token.

No requests are made to any third-party servers, analytics platforms, or advertising networks.

📊 Data Collection & Analytics

tap2nfc collects no analytics, crash reports, usage statistics, or personal data. There are no third-party SDKs in the app. No data is sold or shared with any party other than the API server you configure.

👤 Sensitive Data

Tag passwords and PACK values are retrieved from the API server and held in memory only for the duration of an NFC session. They are never written to disk, logged, or transmitted to any party other than the chip being programmed or reset.

Full tag UIDs are never logged at a publicly-readable log level. All NFC-related logging uses Apple's OSLog privacy controls.

🔄 Changes to This Policy

If this privacy policy changes, the updated version will be posted at this URL with a revised "Last updated" date. Continued use of the app after changes constitutes acceptance of the revised policy.