Privacy Policy — TwoTap
Last updated: June 21, 2026
TwoTap ("we", "us", "the app"), operated by RuneBlaze Apps, respects your privacy. This document explains what data the app collects, why, and your rights regarding it.
1. Data we collect
| Category | Source | Why we collect it |
|---|---|---|
| Email address | Supabase Auth, Google Sign-In | Create and secure your account, sign you in |
| Name, profile photo | Google Sign-In (only if you choose Google) | Display your account, sign you in |
| App interactions / events | PostHog, Firebase Analytics | Understand feature usage to improve the app |
| Device identifiers | PostHog, Firebase Analytics, Firebase Cloud Messaging | Analytics and push notification delivery |
| Approximate location (derived from IP) | PostHog | Coarse analytics (country/region level) |
| Crash logs, device & app info | Firebase Crashlytics | Diagnose crashes and stability issues |
Stays on your device. Your invoices, clients, billing addresses, bank details, and business profile are stored only on your device (local database). We do not transmit, sync, or store this information on our servers. When you share an invoice PDF, it is sent through the app you choose (email, messaging, etc.) — we never receive a copy.
2. How we use your data
- Authenticate you and manage your account.
- Deliver push notifications.
- Measure feature usage and improve the app (analytics).
- Detect, diagnose, and fix crashes.
3. Sharing
We do not sell your personal data. The third-party services below process data on our behalf:
- Supabase (Supabase, Inc.) — authentication — supabase.com/privacy
- Google Sign-In (Google LLC) — authentication — policies.google.com/privacy
- PostHog (PostHog, Inc.) — analytics — posthog.com/privacy
- Firebase Analytics, Crashlytics & Cloud Messaging (Google LLC) — analytics, crash diagnostics, push — firebase.google.com/support/privacy
4. Your rights
- Delete your account and all associated data in-app from Settings → Account → Delete account.
- Opt out of analytics in Settings → Privacy → Analytics.
- Request data export by emailing [email protected].
Data is fully purged within 30 days of a deletion request.
5. Security
Data is encrypted in transit using HTTPS/TLS. Any sensitive values stored locally are protected at rest using AES-GCM via the Android Keystore. No method of transmission or storage is 100% secure, but we apply industry-standard safeguards.
6. Children
TwoTap is not directed to children under 13, and we do not knowingly collect personal data from children under 13. If you believe a child has provided us data, contact us and we will delete it.
7. International transfers / GDPR
If you are in the European Economic Area (EEA) or United Kingdom, you have the right to access, correct, delete, restrict, or object to processing of your personal data, and to data portability. The lawful bases we rely on are your consent (analytics) and performance of a contract (account services). Some processors (PostHog, Google/Firebase) operate servers in the United States; where data is transferred internationally, it is done under appropriate safeguards such as Standard Contractual Clauses. To exercise your rights, email [email protected]. You may also lodge a complaint with your local data protection authority.
8. California residents / CCPA
If you are a California resident, you have the right to know what personal information we collect, to request deletion, and to opt out of the "sale" of personal information. We do not sell your personal information. To exercise these rights, email [email protected]. We will not discriminate against you for exercising them.
9. Changes to this policy
We will update this page when our practices change. The "Last updated" date at the top reflects the most recent change.
10. Contact
Privacy questions: [email protected]. RuneBlaze Apps, Pakistan.
← Back to TwoTap