Privacy policy

Privacy Policy

We collect what we need to run your account and the game, keep money safe and stop cheating. We don’t sell your data.

Who is responsible

Tap Am is operated by Ferrn Agency, which decides how your personal data is used for the game, in line with the Nigeria Data Protection Act 2023.

What we collect

• Account: nickname, email, password (stored only as a salted one-way hash), gender, country, when you confirmed your email, when you accepted the Terms, and — if you use money — when you confirmed you are 18+. Sponsors also give a company name, website and logo.
• Email codes: 6-digit sign-up and reset codes, stored only as hashes; they expire after 10 minutes.
• Game data: pools you join or create, taps, scores, boosters used, ranks, badges, top-tapper totals, and fair-play flags.
• Money: wallet and winnings balances and history, Paystack payment references and results (not your card details), and for withdrawals your bank, account number and account name.
• Settings: theme, background, tap sound, vibration and sound preferences.
• Ads: how many times ads are shown and tapped (not linked to you). If you choose to send your details to a sponsor from an ad, we store your name, email and/or phone and your consent, and share them with that sponsor.
• Login session: one cookie (nakam_session) that keeps you signed in for up to 30 days after you last open Tap Am. We store only a hash of it.
• Security: your IP address is used briefly to count sign-up, login and other attempts to stop spam and guessing; these counters reset automatically.
• On your device: a random visitor ID (to count visits and people online), your sound setting, best practice score and rank-up marker. When you install the app, some public pages are saved on your device; logging out clears saved pages.
• Messages you send through the Suggest pages.

Why we use it

• To run your account, games, leaderboards, ranks and badges (contract).
• To process payments, prizes and withdrawals and keep records (contract and legal obligation).
• To detect cheating, fraud and abuse and keep Tap Am secure (legitimate interests).
• To share your details with a sponsor only when you tick the consent box on that sponsor’s ad (consent — you can withdraw it by contacting the sponsor and us).
• To send codes and important account messages. We don’t send marketing emails unless you agree.

Automatic decisions: our server automatically drops taps above your tier’s speed and flags unusual play for a person to review. Small withdrawals may be paid automatically when there are no flags.

Who can see it

• Other players see your nickname, tier, rank character, badges and scores. Never your email, gender or country.
• Sponsors see total views, taps and players for their pools and ads, and the contact details of players who chose to send them.
• Service providers working for us: Cloudflare (hosting, database, live voice), Paystack (payments and payouts), our email provider (codes and alerts) and YouTube (when an ad is a YouTube video, YouTube receives your IP when the video loads).
• Authorities, when the law requires it.

Where it is stored

Tap Am runs on Cloudflare’s global network, so your data may be processed outside Nigeria.

How long we keep it

Account data stays while your account exists. Archived accounts can be restored for 30 days. Login sessions end after 30 days without use. Payment and withdrawal records are kept as long as the law requires. Ask us to delete your account and we delete or anonymise your data, except what we must keep for legal, fraud or fair-play reasons.

Your rights

You can ask to see, correct, delete or get a copy of your data, object to or restrict how we use it, and withdraw consent. Write to us through the Suggest page. You can also complain to the Nigeria Data Protection Commission (NDPC).

Children

Players under 18 can play free pools if a parent or guardian agrees. They can’t use money features.

Security

Passwords and codes are hashed, connections use HTTPS, the login cookie is HttpOnly and Secure, and money changes happen only on our server with records kept. No system is perfect — use a strong password you don’t use anywhere else.

Changes

If we change this policy we will update the date at the top and tell you in the app when the change is significant.