Privacy Policy

This policy explains how Tap Tag LLC, doing business as Amiracle (“we”, “us”), handles personal information. It covers:

• Account users: church staff and volunteers who sign in to the dashboard or app.
• Visitors: people who tap a sign, scan a code or open a church's page.
• People who send a request: anyone who fills in a prayer request, connect card, volunteer sign-up or similar form on a church's page.
• People who check in: anyone who uses a church's attendance check-in.
• People who try the demo: anyone who asks for a sample dashboard on our website.

For visitors, requests and check-ins, the church that owns the page decides what to collect and how to use it; we store and process that information on the church's behalf, as its service provider. Questions about what a church does with your information should go to that church, and we'll help the church answer them.

From account users

• Name, email address, password (stored only as a secure hash), and mobile number if you give one.
• Your church's name, logo, pages, buttons, service times and settings.
• Billing details: your plan and payment history. Card numbers are handled by Stripe; we never see or store them.
• How you use the dashboard, such as when you last signed in, so we can support you and keep accounts secure.
• If you turn on notifications on a phone or computer, the push subscription for that device, so we can send them.

From visitors

• Basic visit information: time, page, whether it came from a tap, QR scan or link, device type, browser, approximate area from the network (city or region level), and the referring site.
• We don't use advertising cookies or track you across other sites. Visit counts use a one-way scrambled identifier that changes every day so a single visitor isn't counted twice; it can't be turned back into an IP address, and no IP address is stored.
• If a church adds Google Analytics to its page, Google's own policy applies to that data.

From people who send a request

• Whatever the form asks for, typically name, email, phone, and your message or prayer request, plus which page it came from.
• A prayer request or message can include sensitive things, such as your health or your faith. We use it for nothing except delivering it to the church and storing it for them.
• Requests you mark private are shown only to the church's owners, admins, the person it's assigned to, and staff the church specifically allows to see private requests. They're never sent to Planning Center or other connected services.

From people who check in

• Your mobile number, the first names (and optionally last names) of the people in your household, an email address if you give one, and each service you check in to.
• If the church asks us to confirm people are on site, your browser may ask for your location once. We only compare it with the church's address and keep the result (near or not); the coordinates themselves are never stored. A tap on a sign counts as being there, so no location is asked for.
• A cookie on your device remembers your household so you don't have to type your number every week (see Cookies below).
• Check-in is a self-reported record of who said they were there, kept so the church can see who's coming and who's missing. It isn't proof that a particular person was present or where they were, and it isn't a child-safety or supervision system.

From people who try the demo

• Your name, email address and, if you give it, your church, so we can send you the link to your sample dashboard and follow up about Amiracle.

We use only the cookies and browser storage needed to run Amiracle. None of them are used for advertising or to follow you around other websites, so we don't show a cookie banner.

• Sign-in: cookies that keep account users signed in to the dashboard and app.
• Preferences: small settings such as your time zone, the view you last chose, and whether you've dismissed a notice (cookies and browser storage; they hold no personal details).
• Check-in: a cookie per church that remembers your household on that device for up to 400 days. Tap Forget me on the church's page to clear it and remove your household from the church's people list.
• Bot protection: Cloudflare Turnstile may set a cookie when you create an account or send a form, to tell people from bots.
• Videos and analytics on church pages: a YouTube (privacy-enhanced mode) or Vimeo video sets that service's cookies when you play it, and Google Analytics sets its cookies only on pages where the church has added it.

You can clear or block cookies in your browser; signing in and check-in won't work without theirs. We don't track people across sites or sell or share personal information, so a browser's Do Not Track or Global Privacy Control signal doesn't change what we do; we treat Global Privacy Control as a request not to sell or share, which we honor for everyone.

If you give us your mobile number and choose to receive texts, we use it only to send the one-time codes you ask for: sign-up verification, sign-in, password reset and attendance check-in codes. We never send marketing texts.

We do not sell, rent or share mobile numbers or text-messaging opt-in information with third parties or affiliates for marketing or promotional purposes. Opt-in data and consent are not shared with anyone except the text-message provider that delivers our messages (Twilio), solely to deliver them.

Reply STOP to any message to stop receiving texts, or HELP for help. Message and data rates may apply. Details are in our Terms & Conditions and on our text messages page.

• To run Amiracle: show pages, deliver requests and check-ins to the right church, send the notifications and emails you've chosen, and process payments.
• Follow-up emails. If you send a church a request, the church may send you a few follow-up emails through Amiracle, such as a thank-you or an invitation. They can only go to people who contacted that church, and every one has a link to stop them. Stopping them also stops any that were already scheduled.
• To show a church its orders from the Tap Tag store: the dashboard reads orders from our Shopify store that were placed with the email addresses of that account's admins, its backup contact, or addresses an admin has confirmed with a code. Order details stay in Shopify; the dashboard only displays them.
• To answer questions in the AI Assistant (a Pro feature account users choose to open). See “Who we share it with” for what it receives.
• To keep accounts secure: verification codes, bot protection, rate limits and spotting misuse.
• To support you when you contact us, and to send important account and billing notices.
• To understand how Amiracle is used in aggregate so we can improve it.

We don't sell personal information, and we don't share it for targeted advertising. We share it only with:

• The church whose page you visited, checked in to, or sent a request to.
• Service providers that help us run Amiracle, under contracts that limit their use to providing the service: Supabase (database and sign-in), Vercel (hosting), Stripe (payments and sales tax), Resend (email), Twilio (text messages), Cloudflare (bot protection), Google (address and business search when a church sets up its page), Shopify (the Tap Tag store, for order history) and Anthropic (the AI Assistant).
• Anthropic, in more detail. When an account user asks the AI Assistant something, Anthropic receives the question and, where it's needed to answer, the account information that user is allowed to see in the dashboard, which can include page settings, analytics, team members' emails and the contents of requests. Build with AI also sends the public website address the user gives us and what we read from that site. Anthropic uses this only to produce the answer and, under its API terms, doesn't train its models on it.
• Services a church connects, such as Planning Center or a webhook, which receive the requests the church chooses to send (never private ones).
• Authorities when required by law, or to protect people's safety or our rights.
• A buyer or successor if Tap Tag LLC is involved in a merger or sale, with this policy continuing to apply.

• Account and page data: while the account is open. After it's closed we keep only what we need for billing records, legal obligations or to restore the account if asked; email us to have the rest removed sooner.
• Requests and check-in records: until the church removes them or closes its account.
• Visit analytics: kept so the church can see its numbers over time. They hold no names and no IP addresses.
• Verification and check-in codes expire after 10 minutes and are cleared within 2 days. Email delivery logs are cleared after 90 days, follow-up email records after 180 days, AI Assistant conversations after 12 months, and copies of payment events after 120 days.
• Demo dashboards are wiped when they expire. We keep your demo request details until you ask us to remove them.

We use encryption in transit, access controls so each church only sees its own data, row-level database permissions, hashed passwords, signed links, and encrypted storage of service keys. No system is perfectly secure; if we learn of a breach affecting your information, we'll tell you and the church concerned as the law requires.

• Account users can see and change their details in the dashboard, turn notifications and texts on or off, export their church's requests and attendance, and ask us to export or remove their data.
• If you sent a request to a church, contact that church to see, change or remove it; we'll help the church do so. To stop follow-up emails, use the link at the bottom of any of them.
• If you check in at a church, tap Forget me on its page to remove your household from your device and from the church's people list, or ask the church.
• Depending on where you live (for example California or another US state with a privacy law, or the EU and UK), you may have rights to access, correct, remove or export your information, to object to some uses, and not to be treated differently for exercising them. We don't sell or “share” personal information for targeted advertising, and we use sensitive information only to provide the service.

To make a request, email hello@amiracle.app. We'll respond within 30 days (45 for California requests, extendable as the law allows) and may need to confirm who you are first. If the request is about information a church collected, we'll pass it to the church and help them respond.

Amiracle accounts are for adults. Church pages are public and may be visited by anyone, but we don't knowingly collect personal information directly from children under 13. If a child under 13 has sent us information, contact hello@amiracle.app and we'll remove it.

Attendance check-in is done by an adult, who may add the first names of the people in their household, including children. That information comes from the adult, is used only for the church's attendance records, and can be removed by the adult (Forget me) or by the church at any time.

Amiracle is run in the United States, and information is stored and processed there by us and our service providers. If you use Amiracle from outside the US, your information is transferred to the US.

We may update this policy. If a change is significant we'll tell account owners by email or in the dashboard before it takes effect. The date at the top shows when it last changed.

Tap Tag LLC dba Amiracle. Email hello@amiracle.app. Mail: 17 Tompkins Lane, Hopewell Junction, NY 12533.