TagVault privacy notice
The short version
The TagVault app does not collect, store or send any personal data to Fish & Media or anyone else. Everything the app does happens on your iPhone. This website is different: it uses analytics and marketing cookies if you accept them (see This website).
Who we are
TagVault is published by Fish & Media Ltd, a company registered in England and Wales. For anything in this notice, contact support [at] fishandmedia [dot] com.
What the app processes, and where
- The secret and passphrase you enter are processed only in the app's memory on your device to encrypt or decrypt a record. They are not saved by the app and are never sent anywhere.
- The encrypted record is written to the NFC tag you choose. It is ciphertext, but anyone holding the tag can copy it. It is stored on the tag, not by us.
- Your acknowledgement of the safety notice is stored on your device only, as a fingerprint (SHA-256 hash) of the notice version you accepted. It identifies the notice, not you.
- Activity history is kept only while the app is open and is cleared when the app closes.
What the app does not do
- No account or sign-in.
- No servers: the app makes no network requests for its features.
- No analytics, advertising, tracking, profiling or third-party SDKs.
- No access to your contacts, photos or location.
Apple may collect information under its own policies, for example App Store downloads or crash reports you choose to share with developers. That is covered by Apple's privacy policy.
This website
The app and the website are separate. Everything above about the app stays true: the app collects nothing. This website does use analytics and marketing tools, as follows.
Without your consent
Google Tag Manager loads on every visit with all analytics and advertising storage switched off (Google Consent Mode). In that state no analytics or advertising cookies are set, but Google may receive limited, cookieless signals (such as the page viewed, time, browser type and an approximate location derived from your IP address) that it uses to model aggregate statistics. Our host, Cloudflare, also processes standard request data such as IP addresses to deliver pages and protect against abuse.
With your consent
- Analytics (Google Analytics 4): sets cookies to measure visits, pages viewed, scrolling, time on page, downloads and outbound clicks, so we can see how the site is used. Lawful basis: consent.
- Marketing (Meta Pixel and similar advertising tags): sets cookies and sends visit and event data to Meta and other advertising platforms so we can measure and target campaigns, including showing ads to people who visited this site. Lawful basis: consent.
Google and Meta may process this data in the United States and other countries under their own safeguards and privacy policies (Google, Meta). Analytics data is kept for up to 14 months.
You choose when you first visit. You can change your choice at any time with Cookie settings. Rejecting does not affect anything else on the site.
Cookies used after consent
| Name | Provider | Purpose | Expires |
|---|---|---|---|
_ga, _ga_* | Google Analytics | Distinguish visitors and sessions | 2 years |
_fbp | Meta | Advertising measurement | 3 months |
fm_consent_v1 (local storage) | This site | Remembers your choice | Until cleared |
If you email us
If you contact support, we use your email address and message only to reply, and we delete them when they are no longer needed for that. Never send us your secret, passphrase or the contents of a tag. We do not need them, and we cannot recover a lost passphrase.
Your rights
Because the app holds no personal data about you on our systems, there is normally nothing for us to access, correct or delete. If you have emailed us, you can ask for a copy or deletion of that correspondence. You can also complain to the UK Information Commissioner's Office (ico.org.uk).
Changes
If this notice changes, the new version and date will be published on this page.