What we do to protect creators, visitors and buyers, and how to tell us if something looks wrong. This page describes the protections that are in place today. It isn’t a contract; the legal terms are in our Terms and Privacy Policy.
Our analytics don’t use cookies, so visitors to a creator’s page don’t see a cookie banner because of our analytics. We don’t store visitors’ IP addresses. To count unique visitors we store a one-way hash that uses a salt we replace every day, so it can’t be matched to the same person on another day. Creators see totals, never an individual visitor’s record.
Creator pages do set one first-party referral cookie (tl_ref, 90 days). It records which creator’s page a visitor saw first, plus a random visitor ID, and is used only to credit that creator if the visitor later signs up for taplee.link. It is not used for analytics, advertising or tracking across other sites.
The detail is in the Privacy Policy.
You sign in with a six-digit code we email you. There’s no password to reuse, leak or guess. The code expires after 10 minutes, a wrong guess uses up one of five attempts, and we limit how many codes can be requested. We store only a hash of each code. Login requests are also checked by Cloudflare Turnstile to block bots.
When you’re signed in, two cookies are set. They are the only cookies we use in the app. The session cookie can’t be read by scripts on the page, and we keep only a hash of the session token, so a copy of our database wouldn’t let anyone sign in as you. A second cookie protects you against forged requests from other sites. You can see and end your active sessions.
Card details are entered on Stripe’s pages and go straight to Stripe. We never see or store card numbers. Creators connect a Stripe account, buyers pay through Stripe Checkout, and Stripe pays creators directly. We verify the signature on every message Stripe sends us, and calculate fees on our servers, never in the browser.
Product files are kept in a private storage bucket that isn’t publicly readable. A buyer gets an access link by email, and each download redirects to a signed link that stops working after five minutes. The access link itself is valid for 30 days, allows up to 5 downloads for file products, and is cancelled if the creator refunds the order. We store only a hash of the access token. Unlockable content, such as a private link or message, is shown only to someone with a valid access link.
Creators can’t add raw HTML or scripts to their pages. Text is displayed as text, and link addresses are checked on our servers so that only safe kinds of address are accepted. When a page is published, its links are checked against Google Safe Browsing and flagged links block publishing. Every public page has a “Report this page” link, and our Acceptable Use Policy says what we act on.
Forms use Cloudflare Turnstile, a hidden honeypot field, a minimum fill time and rate limits per visitor and per page. Creators own their form data: they can export or delete it, and it’s only shown to them.
Images you upload are re-encoded on our servers before anyone can see them. That removes hidden metadata such as the camera details and GPS location many phones add to photos, and resizes very large images.
You can download everything we hold about your account from Settings → Your data, and delete your account there too. Deleting it removes your page, products, form submissions, QR codes and analytics.
Traffic to taplee.link and our API goes over HTTPS through Cloudflare, which also provides DDoS protection and rate limiting at the edge. Browsers are told to use HTTPS only (HSTS), and the signed-in app sends a strict Content Security Policy that only allows scripts and connections from us and the few services listed here. Our application servers and database run on DigitalOcean, and files are stored on Cloudflare R2. See the Privacy Policy for the full list of providers.
If you think you’ve found a security problem in taplee.link, email security@taplee.link. Please include what you found, how to reproduce it and the page or endpoint involved.
To report abusive content or a scam page, use the “Report this page” link or email abuse@taplee.link.
See also: Terms of Service, Privacy Policy, Acceptable Use Policy and Security.