Security

No system is unhackable. Here is what we actually do, so you can judge for yourself.

• Your card can't be re-programmed. Chips are write-locked at the factory. Cloning one only copies a public link; mark it lost and the clone dies with it.
• Your link can't be guessed. Each chip carries a random 22-character token (about 128 bits). Unknown tokens and inactive cards look identical to outsiders.
• No passwords to steal. Sign-in is by one-time email link or passkey. Tokens are stored as keyed hashes; a database leak alone cannot be used to sign in.
• Links are checked twice. Every link you save must be https (or tel:, mailto:, viber:); Google review links must point at Google. Changing a review link emails you.
• Strict browser policy. Content-Security-Policy with no third-party scripts, HSTS, frame-ancestors none. Pages render plain text only; nothing you type becomes HTML.
• Rate limits everywhere. Sign-in, taps, feedback, and contact forms are throttled per IP; forms carry honeypots.
• Everything is logged. Every change to your account is recorded with time, IP and device, and you can see the log in Settings. “Sign out everywhere” kills all sessions.
• Visitors stay anonymous. Tap analytics never store a visitor's IP or identity.

Responsible disclosure

Found something? Email security@tapdali.com. We reply within 2 working days, fix confirmed issues quickly, and credit you if you want. Please don't access other people's data or disrupt the service while testing.