Legal

Privacy Policy

Effective 27 October 2026 · Version 1.0

1. Who we are

Tapminute is an independent developer project operated from China and available to users worldwide. In this policy, “Tapminute”, “we”, “us” and “our” refer to that project. For purposes of applicable data protection laws, we act as the controller (or equivalent personal information handler) of the personal data described in this policy.

Our privacy contact is dmca@tapminute.com. Email is the fastest way to reach us for privacy questions or requests.

This policy applies to www.tapminute.com and its subdomains, including play.tapminute.com, unless a separate policy is posted. It does not apply to third-party websites, apps or games that we link to or embed; those services have their own privacy policies.

By using the site, you acknowledge that you have read this policy. This policy is not a contract and does not create rights beyond those provided by applicable law.

2. Data we collect

We try to keep data collection minimal. We do not require you to create an account, and we do not collect payment information.

2.1 Information you give us

• Email correspondence. If you email us, we receive your email address, the content of your message, and any attachments or information you choose to include. Please do not send sensitive personal information by email.

2.2 Information collected automatically

• Hosting and security data. Cloudflare may process your IP address, user agent, requested URL, timestamps, and security signals to deliver the site, prevent abuse, and keep it available.
• Consent data. Cookiebot may process your IP address, user agent, consent choices, and the time and version of those choices so we can remember and demonstrate your preferences.
• Analytics data (only with consent). If you consent to statistics cookies, Google Analytics 4 may collect information such as pages viewed, approximate location derived from IP address, device and browser type, referring page, and interactions with the site. We configure analytics to measure aggregate usage, not to identify you.

2.3 Information stored on your device

• Local storage. Game progress, high scores, and similar preferences may be saved in your browser’s local storage so you can continue where you left off. This information stays on your device and is not sent to us. You can clear it through your browser settings.

We do not currently collect account credentials, payment card data, postal addresses, phone numbers, precise GPS location, biometric data, or advertising profiles. We do not use session replay, heatmaps, or cross-site advertising trackers.

3. Cookies and similar technologies

We use a consent management platform, Cookiebot (provided by Usercentrics A/S), to ask for your choices before setting non-essential cookies. The consent banner lets you accept or reject statistics cookies, and you can change your choice later through the Cookiebot consent widget on the site or by clearing cookies and reloading.

Necessary cookies are set without consent because the site cannot operate securely without them. Statistics cookies are blocked until you opt in. We do not currently use marketing or advertising cookies. If we introduce advertising, we will update this policy and, where required, use a Google-certified consent management platform and obtain consent before setting advertising cookies.

You can also control cookies through your browser settings. Blocking necessary cookies may affect site security or functionality. Withdrawing consent does not affect processing that occurred before withdrawal.

We do not track you across third-party websites for advertising. If your browser sends a Global Privacy Control (GPC) signal, we treat it as a request not to sell or share personal information; we do not sell or share personal information for cross-context behavioral advertising.

4. How we use data

• To operate, secure, and troubleshoot the site.
• To understand aggregate usage and improve games, pages, and performance, but only if you consent to statistics cookies.
• To respond to your emails and privacy requests.
• To comply with legal obligations and enforce our rights.
• To detect, prevent, and address fraud, abuse, or security incidents.

We do not use your data for automated decision-making that produces legal or similarly significant effects. We do not send marketing emails or newsletters, and we do not sell, rent, or trade personal information.

4.1 Legal bases

Where the GDPR or UK GDPR applies, we rely on:

• Consent for statistics cookies and any analytics that requires it. You can withdraw consent at any time.
• Legitimate interests for hosting, security, debugging, and responding to inquiries, balanced against your rights and freedoms.
• Legal obligation where we must retain or disclose information to comply with the law.

Where China’s Personal Information Protection Law (PIPL) applies, we rely on your consent or another permitted basis, and we handle sensitive personal information only with separate consent or another lawful basis. Where the CCPA/CPRA applies, we collect the categories described above for the business purposes described in this policy. We do not sell or share personal information, and we do not use or disclose sensitive personal information for purposes beyond those permitted by law.

5. How we share data

We share data only with service providers that help us run the site, or when required by law:

• Cloudflare, Inc. for hosting, content delivery, security, and email routing.
• Google LLC for Google Analytics 4, only after you consent to statistics cookies.
• Cookiebot / Usercentrics A/S for consent management.
• Our email provider to receive and respond to messages sent to our contact address.
• Professional advisers, authorities, or courts where required by law, to protect rights, or to investigate security incidents.

These providers act on our instructions or under their own legal obligations and are bound by their data processing terms. We do not sell or share personal information for cross-context behavioral advertising, and we do not knowingly sell or share personal information of consumers under 16.

If we embed a third-party game, the game provider may receive technical data such as your IP address, device information, and the page you came from, and may set its own cookies. Where required, we will load the game only after you consent. The provider’s privacy policy applies to its processing. We do not currently embed third-party games on the site.

If we sell, merge, or transfer the site, personal information may be transferred as part of that transaction, subject to this policy and applicable law. We will post a notice before a transfer that materially changes how your data is handled.

6. International transfers

Cloudflare, Google, Cookiebot, and our email provider are global services and may process data in countries other than yours, including the United States and the European Union. Where required, we rely on their contractual safeguards, such as standard contractual clauses, and on other lawful transfer mechanisms.

If you are in mainland China and cross-border transfer rules apply, we will obtain separate consent and use a permitted mechanism (such as a standard contract or security assessment) before transferring personal information. You can contact us for more information about the safeguards we use.

7. How long we keep data

• Cloudflare logs: retained according to Cloudflare’s settings and terms. We do not keep a separate copy of raw server logs.
• Google Analytics 4: event data is retained for 14 months from collection. Aggregate or de-identified reports may be kept longer.
• Cookiebot consent records: kept for as long as needed to demonstrate compliance, generally up to 12 months unless a longer period is required by law.
• Email correspondence: kept for up to 12 months after the matter is resolved, unless we need it longer for a legal claim or legal obligation.
• Local storage: kept on your device until you clear it or your browser removes it.

We may retain information longer where required by law, to resolve disputes, or to enforce our rights. When data is no longer needed, we delete it or de-identify it.

8. Security

We use HTTPS, Cloudflare’s security features, access controls, and data minimization to protect the site and the limited data we handle. No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If you believe your data has been compromised, contact us at dmca@tapminute.com.

9. Your privacy rights

Depending on where you live, you may have some or all of the following rights:

• Access the personal information we hold about you and request a copy.
• Correct inaccurate or incomplete information.
• Delete information, subject to legal exceptions.
• Restrict or object to certain processing.
• Request portability of information you provided.
• Withdraw consent at any time, without affecting processing that already occurred.
• Lodge a complaint with a supervisory authority.

9.1 Mainland China (PIPL)

If you are in mainland China, you may request access to or a copy of your personal information, correct or supplement it, delete it, withdraw consent, request an explanation of our processing rules, and complain to us or a regulator. If you are under 14, your guardian must consent to the processing of your personal information; we do not knowingly collect personal information from children under 14 without guardian consent.

9.2 EEA and UK (GDPR / UK GDPR)

If you are in the EEA or the UK, you have the rights described above and the right to complain to your local supervisory authority. We will respond within one month, unless the request is complex, in which case we may extend the period as permitted by law and will tell you.

9.3 California (CCPA/CPRA)

If you are a California resident, you have the right to know what personal information we collect, use, and disclose; to delete it; to correct it; to opt out of the sale or sharing of personal information; to limit the use of sensitive personal information; and not to be discriminated against for exercising these rights. We do not sell or share personal information, and we do not use sensitive personal information for purposes beyond those permitted by law. You may use an authorized agent to submit a request; we may ask for proof of authorization.

9.4 How to exercise your rights

Email dmca@tapminute.com with the subject “Privacy request” and tell us what you want. We may need to verify your identity before fulfilling a request. We aim to respond within 30 days; if we need more time, we will explain why. You will not be charged a fee unless a request is excessive or repetitive, and we will explain any fee before proceeding.

If we cannot fulfill a request, we will explain the legal reason. If you are unhappy with our response, you can complain to the relevant authority, including:

• In mainland China: the Cyberspace Administration of China or your local personal information protection authority.
• In the EEA or UK: your local data protection supervisory authority.
• In California: the California Attorney General.

10. Children

Tapminute is not directed to children under 13. We do not knowingly collect personal information from children under 13. In mainland China, personal information of children under 14 is treated as sensitive personal information and requires guardian consent; we do not knowingly collect it without that consent. In jurisdictions where the digital consent age is higher (up to 16), we do not knowingly collect personal information without the required guardian consent.

If you are a parent or guardian and believe a child has provided us with personal information, contact dmca@tapminute.com. We will take reasonable steps to delete it.

11. Changes to this policy

We may update this policy as the site changes or the law develops. The effective date at the top shows when the current version took effect. For material changes, we will post a notice on the site or in the consent banner and, where required, ask for your consent again. Continued use of the site after a change does not by itself consent to new processing that requires consent.

12. Contact us

For security reports, please include enough detail to reproduce the issue, but do not include sensitive personal information. We will not retaliate against good-faith security research.

This policy describes the current practices of Tapminute. If you have questions about your rights, you may also consult a qualified privacy professional in your jurisdiction.