Privacy Policy

Last updated: 2026-10-03

TaoSkip is operated by TaoApex Limited ("we", "us", "our"), a company registered in the United Kingdom. This Privacy Policy explains what data TaoSkip collects, how we use it, and the rights you have under the UK GDPR / EU GDPR / California CCPA.

This policy applies only to the TaoSkip mobile application and related backend services (the "Service"). For other TaoApex products such as TTprompt, TaoImagine, TaoTalk AI, or MyOpenClaw, please refer to the TaoApex Privacy Policy.

---

1. Data We Collect

### 1.1 Account data (only if you sign in)
- Email address (when you use Apple ID, Google, or email sign-in)
- Display name (only if your identity provider supplies one)
- Authentication tokens (managed by Supabase; we never see your Apple ID or Google password)

### 1.2 TaoSkip usage data
- Skip records: item name, optional amount, optional note, currency, status (skipped / purchased), category
- Service statistics: totals and category summaries for your skip records
- Notification preferences: opt-in flag for weekly reminders

### 1.3 Device & technical data
- Device model, OS version, app version, locale — used for crash triage and compatibility
- Push notification token (APNs) — only if you opt in
- Approximate country (derived from IP for fraud prevention; not stored long-term)

### 1.4 We do NOT collect
- Contacts, photos, microphone, camera, location, health, or advertising ID
- Tracking across other apps (no IDFA, no cross-app fingerprinting)
- Your authentication passwords (handled by Apple / Google / Supabase)

---

2. How We Use Your Data

| Purpose | Legal basis | Retention |
| --- | --- | --- |
| Provide the core skip-tracking service | Contract (you have an account) | Until you delete your account |
| Sync records through the TaoSkip service when signed in | Contract | Until account deletion or as otherwise required by law |
| Send weekly summary push (if opted in) | Consent | Until you opt out |
| Protect the service and enforce usage limits | Legitimate interest | As needed for security and service operation |
| Respond to support requests | Contract | As long as needed to resolve and document the request |

We never sell your data, and we do not share it with advertisers or data brokers.

---

3. Third-Party Processors

| Processor | Purpose | Data shared |
| --- | --- | --- |
| Supabase | Account authentication | Email and authentication/session data |
| Cloudflare Workers and D1 | TaoSkip API processing and service record storage | Skip records, account identifier, and request metadata |
| RevenueCat | In-app purchase and entitlement processing | App user identifier and purchase/entitlement information |
| Apple Push Notification service (APNs) | Push notifications, if enabled | Device push token |
| Apple and Google | Sign-in identity providers | Sign-in data and tokens |

The service uses Supabase for authentication and Cloudflare Workers/D1 for its API and records. We do not promise that data is pinned to a user-selected region; provider processing locations and safeguards depend on the services used and their current terms.

---

4. Your Rights

Under UK GDPR / EU GDPR you have the right to:
- Access your data (Settings → Export)
- Rectify incorrect data (Settings → Edit)
- Erase your account and all records (Settings → Delete Account)
- Restrict or object to processing
- Port your data (Settings → Export as JSON)
- Withdraw consent for push or analytics at any time
- Lodge a complaint with the ICO (UK) or your local data-protection authority

California residents additionally have the right to opt out of "sale" (we do not sell), and to receive equal service regardless of privacy choices.

---

5. Security

  • The app communicates with its service API over HTTPS.
  • The service API checks the authenticated user identity when accessing account records.

No system is 100 % secure. If a personal-data incident creates a legal notification duty, we will notify affected people and authorities as required by applicable law.

---

6. Children

TaoSkip is not directed to children under 16 (or the local equivalent minimum age). We do not knowingly collect data from children. If you believe a child has signed up, contact us and we will delete the account.

---

7. International Transfers

TaoSkip is operated from the UK and uses service providers whose infrastructure may process data in different jurisdictions. We do not claim that data is stored only in the UK/EU or pinned to a specific region. For current provider information, see the providers' own privacy notices and terms.

---

8. Changes to This Policy

We will update this page when we make material changes and, where required by law, ask for your renewed consent.

---

9. Contact