Privacy Policy

Effective date: August 5, 2026

This policy explains what personal data is processed across the Tagls ecosystem — the Tagls wallet application and the Tagl ID sign-in service (together, the "Service") — why, and what rights you have. The Service is operated by the developers of the Tagls project (the "Operator", as defined in the Terms of Service) and is in public beta. The Operator is the controller of the server-side data described below.

Third-party sites that offer "Sign in with Tagl ID" process the data they receive for their own purposes, under their own privacy policies — section 5 explains exactly what they receive.

1. The short version

Tagls is built so that your identity and keys stay with you, not with us.

Your cryptographic keys, your identity data, and your two-factor (TOTP) secrets live inside a PNG file — your tagl — stored on your own device. They are never uploaded to our servers. We cannot read them, we cannot reset them, and we cannot hand them to anyone else, because we never have them. Even your PIN is verified locally on your device and is never sent to us.

What remains on our side is the minimum needed to run a sign-in service: technical logs and OpenID Connect session data. This policy describes exactly that.

2. Data we do NOT have

To be explicit, the Operator does not store and cannot access:

• your private cryptographic keys;
• the contents of your tagl file;
• your TOTP (two-factor) secrets;
• your PIN;
• your 12 recovery words.

If you enable the optional cloud backup, we store an encrypted copy of your tagl — but it is encrypted on your device before upload, and the recovery words that decrypt it never reach us, so the "cannot access" above still holds.

Because we do not hold this data, we cannot disclose it — to you, to third parties, or in response to legal requests. The architecture does not mean we process no personal data at all; the categories we do process are listed next.

3. Data we process

We do not build advertising profiles, we do not use automated decision-making about you, and we do not sell data.

4. Purposes and legal bases (GDPR)

• Providing the Service — performance of our agreement with you (Art. 6(1)(b) GDPR): processing sign-in requests, issuing tokens, maintaining sessions. This data is necessary for a sign-in to work; without it the sign-in cannot be completed.
• Security and abuse prevention — our legitimate interest (Art. 6(1)(f)): keeping logs to detect fraud, attacks, and malfunctions. You may object to processing based on legitimate interests (see section 8); we will then stop unless compelling legitimate grounds require it to continue.
• Legal compliance — legal obligation (Art. 6(1)(c)), where applicable law requires it.

5. Sharing with third parties

• Sites you sign in to (relying parties). When you approve a sign-in, the site receives your public Tagl ID identifier and — only if the site requested the profile scope and you approved it on the authorization screen — the profile claims shown there (name, date of birth). Nothing beyond what the authorization screen displays is released.
• Infrastructure providers. We use hosting and network providers to run the Service; they process technical data on our behalf as processors. Network delivery currently runs through Cloudflare; the current provider list is available on request.
• Authorities. We may disclose server-side data from section 3 where required by applicable law or a binding request from a competent authority. We cannot disclose keys, tagl contents, or TOTP secrets — see section 2.

We do not sell or rent personal data. We do not share it with advertisers.

6. Retention

Technical logs are kept for 30 days and then deleted or anonymized. Sign-in records are kept for as long as needed to operate the Service and meet the security purposes above, then removed on the same basis.

Data inside your tagl is under your control: deleting your copies deletes it. We have nothing to delete on our side beyond the categories in section 3.

7. International transfers

Our infrastructure may be located in different countries. Where data protected by the GDPR is transferred outside the EEA, we rely on recognized safeguards such as standard contractual clauses. Details are available on request via [email protected].

8. Your rights

If the GDPR applies to you, you have the right to access, rectify, erase, restrict, or object to the processing of your personal data, the right to data portability, and the right to lodge a complaint with a supervisory authority in the country where you live, work, or where you believe an infringement occurred.

Note the practical limits of these rights here: most of your data is in your tagl, which we never possess and therefore cannot provide, correct, export, or delete. Requests apply to the server-side data in section 3. To exercise a right, write to [email protected]; we may need enough information to verify your identity and locate the relevant records.

9. Cookies

The Service uses only strictly necessary cookies (for example, to keep a sign-in session alive). We do not use advertising or cross-site tracking cookies, and there is no third-party analytics on sign-in pages.

10. Children

The Service is not directed at children under 16, and we do not knowingly process their data.

11. Changes

We may update this policy as the Service evolves. The effective date at the top identifies the current version; material changes will be announced on the Service before they take effect.

12. Contact

Privacy questions and requests: [email protected].