Privacy

Last updated: November 9, 2026

In short

Tapete works fully without this server. It only talks to it if you open “Friends” and agree, and you can leave at any time.
Players have no accounts or passwords: each app is identified by a public key it generates itself. The server never has your private key.
Messages between friends are end-to-end encrypted: the server stores bytes it cannot read and deletes them as soon as your friend receives them.

Your public key (ed25519) and your public encryption key (X25519), signed by the first one.
The nickname you choose, the platform (Windows, macOS, Linux, Android…) and the app version.
Your friend code (TAP-XXXX-XXXX), which you can change at any time; the old one stops working.
When you joined and when your app was last seen (to show your friends whether you are online).
Your friendships, requests and blocks (which keys, since when).
Encrypted messages not yet collected by their recipient, with who sent them, to whom and when. And, once collected, a delivery receipt for the sender.
Reports you make: about whom, the reason and the note you write. Never the content of a message, except what you paste into the note yourself.
Daily counters (how many messages, friendships and sign-ups), without knowing whose.

Your IP address. It is only used in memory to limit abuse and forgotten within minutes.
The plain content of messages: the server has nothing to decrypt them with.
Your decks, your games, your phone contacts or anything else from the app.
No analytics, ads or third-party services. This website uses no tracking cookies: only the language one and, in the admin panel, the session one.

A message is deleted as soon as your friend receives it; if nobody collects it, after 30 days.
An unanswered friend request is deleted after 30 days. Delivery receipts, after 30 days.
The per-request security checks (nonces) are deleted after 24 hours.
Everything else, for as long as you keep Friends enabled in the app.

From the app: in Settings, when you leave Friends, the app offers to delete your key from the server. Your profile, friendships, blocks and pending messages are deleted immediately.
If you no longer have the app, you can ask with your friend code through the contact details in the legal notice.
Reports you made, or that were made about you, are kept until reviewed, so that abuse can be acted upon.

Every request from the app is signed with its key, with a timestamp and a one-time number: nobody can pretend to be you without your private key.
The encryption has no forward secrecy: if someone steals a device's identity, they could read old messages they had stored.
The server knows who talks to whom and when, but not what is said. To check that nobody sits in the middle, compare the safety number with your friend in person or with their QR code.