TapHush# TapHush Privacy Policy
**Last updated: October 30, 2026**
TapHush is a screen touch-protection utility developed by TapHush Studio.
## Overview
TapHush 2.0 can be used without creating an account. Version 2.0 does not use Google Sign-In, does not operate a user-profile system, and does not require users to provide a name or email address.
The app uses Google Play Billing for an optional six-month ad-free purchase and Google Mobile Ads for advertising in the free version. Google’s User Messaging Platform is used where consent or privacy choices are required.
## Legacy account data from earlier versions
Versions of TapHush released before 2.0 used Google Sign-In and Firebase Authentication for a server-managed trial and purchase access. TapHush 2.0 no longer signs users in and does not create new TapHush accounts.
Earlier versions still available during the release transition collect Google account name, email address and user identifiers through Firebase Authentication for sign-in and account management. The legacy backend stores trial/access timestamps, a Google-subject hash, and purchase-token and entitlement records for verification, restoration and fraud prevention. These records may remain while the older release is supported. They are not used to target advertising in TapHush 2.0. You may request deletion at:
https://taphush-301a3.web.app/delete-account
## Display over other apps
TapHush uses Android’s “Display over other apps” permission to:
- show the floating TapHush fox button;
- place a transparent touch-protection layer over visible content;
- display temporary protection status messages.
TapHush does not read, record, capture, or store the visual contents of other apps.
## Touch processing
While touch protection is active, TapHush processes gestures received by its own overlay to block accidental touches and recognize control gestures.
Touch input is processed locally on the device. TapHush does not record touch history or send touch gestures to TapHush Studio.
## Information stored locally
TapHush stores a small amount of configuration on the device, such as:
- whether initial setup has been completed;
- whether the floating control is enabled;
- recent actual interstitial impression timestamps, used for a 25-minute cooldown and a maximum of three ads in a rolling 24 hours;
- a bounded purchase confirmation containing verified expiry, server time and local elapsed time;
- consent information stored by Google’s User Messaging Platform as required for advertising privacy choices.
The local ad-timing information may reset if TapHush is removed and installed again.
## Advertising
TapHush may show a short interstitial advertisement when the user explicitly starts a new protection session, including on first use. Ads are shown only inside TapHush before it is minimized. TapHush does not display ads over other apps or while touch protection is active. An active verified ad-free purchase disables ads.
TapHush uses the Google Mobile Ads SDK. According to Google’s documentation, the SDK may automatically collect and share data including:
- IP address, which may be used to estimate general location;
- app interactions such as app launches, taps, and ad/video views;
- diagnostic information such as app performance, hang rate, and energy usage;
- device or account identifiers, including the Android advertising ID, App Set ID, and other applicable identifiers.
Google may process this information for advertising, analytics, and fraud-prevention purposes. Depending on the user’s region and privacy choices, ads may be personalized, non-personalized, or limited.
TapHush uses Google’s User Messaging Platform to request consent where required and provides a Privacy choices entry point when required by the consent framework.
TapHush Studio does not sell user data and does not share data with independent data brokers.
## Google Play purchases
TapHush offers an optional six-month prepaid purchase that removes ads. The purchase is processed by Google Play and does not renew automatically.
Google Play handles payment credentials directly. TapHush Studio does not receive or store credit-card numbers, bank-account numbers, or other payment credentials.
TapHush obtains purchases from the Google Play account on your device and sends a purchase token over HTTPS to our Firebase Cloud Functions verification service. The service verifies the package, product, prepaid base plan, current state and expiry directly with the Google Play Developer API and acknowledges valid purchases. Starting with the updated verification service, we store the purchase token, its SHA-256 hash, verified expiry, verification time and acknowledgement status in server-only Firestore records. Google Play notifications allow us to process payment completion, expiry and revocation even when the app is closed, including notifications concerning earlier app releases. These records are used only for purchase verification, restoration, acknowledgement and fraud prevention, not advertising targeting. No TapHush account is created. Google Cloud may process request metadata, such as IP address, timestamps and operational diagnostics, to operate and secure the service. Purchase tokens and personal details are not intentionally written to application logs. Legacy verification services remain available for users of older releases.
Firebase App Check with Google Play Integrity checks that verification requests come from a genuine app installation. Google processes app/device integrity signals and issues an attestation token; our purchase service does not store a device identifier from that check. Firebase Remote Config and Firebase Installations fetch advertising settings using an app-installation identifier and technical metadata. TapHush does not enable Google Analytics for Firebase.
Restoration uses the Google Play account; no TapHush sign-in is required.
After server verification, TapHush may keep a local confirmation for up to 24 hours, capped at the verified prepaid expiry. This prevents brief network outages from immediately showing ads. A successful check with no active purchase clears the confirmation. Rebooting requires a new verification; changing the device clock cannot extend the cached entitlement.
Google Play may retain purchase and transaction records under Google’s own legal, accounting, security, fraud-prevention, and retention requirements.
## Network security
Data exchanged with Google Mobile Ads, Google’s consent services, Google Play and our Firebase verification service is transmitted using encrypted network connections provided by Google’s SDKs and services.
## Children
TapHush is a general-purpose utility and is not directed specifically to children. TapHush does not knowingly create accounts for or request personal information from children.
## Data retention and deletion
TapHush 2.0 does not create a TapHush user account. Local app settings can be removed by clearing TapHush storage or uninstalling the app. Legacy account records created by earlier releases can be deleted through the account-deletion page linked above.
New purchase-verification records are retained while the entitlement is active and for up to 60 days afterward, then removed by daily cleanup. In TapHush 2.0.2 or later, use "Delete purchase verification data" to remove the raw token and verification details for purchases available through Google Play on your device. This also disables their ad-free benefit; free touch protection continues. To prevent delayed Google Play notifications from recreating deleted data, only a token hash, deletion marker and retention deadline remain until the verified expiry plus 60 days (or 60 days after deletion, whichever is later), then daily cleanup removes them.
For expired purchases no longer returned by Google Play, or if you cannot use the app, email mixan000@gmail.com with the subject "TapHush data deletion". Explain which data you want deleted. If needed to locate and verify a purchase record, we will ask for the Google Play order reference or other minimal proof of ownership. Do not send passwords, payment-card details or purchase tokens. Deletion does not cancel or refund Google Play purchases. Contact correspondence is used only to process your request.
Advertising and purchase information processed by Google is subject to Google’s own retention and deletion policies and the user’s Google account and Android privacy controls.
## Third-party services
TapHush uses:
- Google Mobile Ads SDK;
- Google User Messaging Platform;
- Google Play Billing;
- Firebase Cloud Functions and Firestore for purchase verification, Firebase App Check/Play Integrity, Firebase Remote Config and Firebase Installations; legacy Firebase Authentication for earlier-version accounts;
- standard Android and AndroidX components.
TapHush does not use third-party advertising mediation, social-network SDKs, independent analytics SDKs, or developer-operated user tracking.
## Changes to this policy
This policy may be updated if TapHush features, advertising configuration, or data-handling practices change. The current version will be available from the Google Play listing and inside the app.
## Contact
**TapHush Studio**
Email: **mixan000@gmail.com**