Privacy Policy
Tapstep lets you build shortcuts and automations on your Android phone. This policy explains what information the app handles, where it goes, and the choices you have. In short: your shortcuts and what they work on stay on your phone; the few things that leave it are listed below, and nothing is sold or used for advertising.
Who we are
The app is published by Ecma Yazılım Eğitim San. Tic. Ltd. Şti. (“we”), the data controller under Turkey’s Personal Data Protection Law No. 6698 (KVKK) and, for people in the European Union, the General Data Protection Regulation (GDPR). Contact: info@ecma.co.
What stays on your phone
Your shortcuts, their steps and settings, their run history, the values they save, your conversations with the shortcut assistant, the files you pick, and the app’s settings are stored only on your phone, except the copies of shortcuts you choose to share and the AI answers you report (below). We cannot see them. Information the app reads with your permission, such as your location, contacts, calendar, notifications or nearby Bluetooth devices, is used on your phone to run your shortcuts and automations and is not sent to us. Uninstalling the app or clearing its storage deletes all of it.
The on-device AI model (Android’s Gemini Nano) also runs on your phone: what it reads is not sent anywhere, and its answers leave your phone only if you report one (see “AI content reports” below).
What leaves your phone
Crash reports
When the app stops working, or an action fails in a way it never should, a report is sent to Firebase Crashlytics (Google): the type of error and where it happened in the app’s code, the app version, the phone model and Android version, and a random installation identifier. Reports never contain your shortcuts, what you type into them, or what they work on; the text of an error is left out because it could. Crash reports are on until you turn them off in Settings → Privacy. Crashlytics keeps them for 90 days.
Usage statistics — only if you agree
Once a shortcut has worked for you, the app asks whether you want to share usage statistics. Only if you say yes, Google Analytics for Firebase and Firebase Performance Monitoring receive information such as which screens you open, which kinds of actions and triggers you add, where a shortcut was started from, whether it ran well, how long it took, and how quickly the app starts. They never include the names or contents of your shortcuts. The app does not collect the advertising ID, and advertising storage and personalisation are always off. You can change your answer at any time in Settings → Privacy.
App configuration
The app fetches settings from Firebase Remote Config (Google), such as which gallery items to show. This uses a random installation identifier and nothing else about you.
Pro
Pro adds AI models in the cloud. When you open Pro or use a Pro step for the first time, the app creates an anonymous account (a random user ID from Firebase Authentication); there is no sign-up and no name or e-mail address.
- Purchases are made through Google Play. Your subscription status (product, price, currency, country, purchase and renewal dates, and a purchase token) is processed by RevenueCat, Inc., which manages subscriptions for us, and linked to your anonymous user ID. We never receive your payment details.
- Genuine app check. Requests to Pro are checked with Firebase App Check and Google Play Integrity to confirm they come from the genuine app.
- What you send to Pro — the prompt and the text, images or files a Pro step uses, and when you build a shortcut with AI, your messages and the shortcut you are building — goes to our function on Google Cloud (in the EU) and from there through OpenRouter, Inc. to the AI model provider (for example Google for images, and companies that run open models such as DeepSeek for answers) to produce the answer. We route requests only to providers that do not store the data or use it for training. We do not store or log what you send or the answer, unless you report the answer (see below); we record only that a request was made (a scrambled form of your user ID, the kind of request, the model, the time it took and its cost) and count your monthly requests to apply the plan’s allowance.
Shortcuts you share
When you share a shortcut, the app uploads a copy of it — its name, steps, texts and settings — to our function on Google Cloud (in the EU), which keeps it in Firestore with your anonymous user ID (made the first time you share) so that only you can stop sharing it. Places, calendars, devices, Wi-Fi networks, NFC tags and files you picked, and your automations’ keys, are left out; the app tells you which. Anyone who has the link can see the shortcut and add it, and the link’s web page shows its name and how many steps it has. The copy stays as it was when shared, until you stop sharing it (for one link in the share screen, or for all of them in Settings) or it is taken down after reports. Opening someone’s link sends only the link. When you report a link, we keep a scrambled form of your user ID with it so each person counts once.
AI content reports
The shortcut assistant’s answers in Build with AI, the results of AI steps in a run’s details (Use Pro Model, Create Image, and the on-device model’s Use Model, Summarize Text and Rewrite Text), and text a shortcut made with them from text you selected or shared, have a Report button. You choose a reason (offensive or hateful, sexual, violent or dangerous, false or misleading, or other) and can add a note. The report holds the reason, your note, the reported answer’s text (its first 4,000 characters; for an image only that it was one, never the image itself), which kind of AI feature made it (the assistant, Pro answers, Pro images or the on-device model) and which model, the time, and a scrambled form of your anonymous user ID. It goes to our function on Google Cloud (in the EU), which keeps it in Firestore. Reporting creates the anonymous account if you do not have one yet (the same random user ID Pro and sharing use; no name or e-mail address). Nothing else about you is attached, and the scrambled ID is used only to limit reports to 20 per person per day. We review reports to improve how AI answers are filtered, for example the models we choose and the instructions we give them. Reports are deleted automatically after 12 months.
Features that use other services because you use them
- Weather actions send the coordinates of the location you ask about, rounded to at most four decimal places (about 11 metres), to the Norwegian Meteorological Institute (MET Norway, api.met.no) to get the forecast. The request carries no identifier other than the app’s name and version.
- Web actions send requests to the addresses your shortcuts use.
- Google Home actions and triggers use Google’s Home APIs with the access you grant in Google’s own screen; see Google Home below.
- Places use Android and Google Play services to turn addresses into locations and to watch the places your automations name.
- Sharing to another app, for example an AI app, happens only when you share and only with the app you choose; that app’s own policy then applies.
Google Home
Google Home actions and the Home Device trigger work with the devices in your Google Home. The app reaches them through Google’s Home APIs, and only after you allow it in Google’s own screen, where you choose the home and the devices you share with Tapstep.
- What the app reads and does. For the devices you shared: their names, the rooms they are in, what each one can do, whether it is online, and its current state (on or off, brightness, how far curtains are open, whether a door or window is open, motion, whether a lock is locked, and button presses). When one of your shortcuts runs a Google Home step, the app turns devices on or off, sets the brightness, or opens and closes curtains.
- Why. Only to run your shortcuts and automations: to list your devices when you pick one in the editor, to carry out Google Home steps, and to start an automation when a device changes. While an automation with the Home Device trigger is on, the app listens for changes of the devices it names, and a notification says so.
- Where it is kept. On your phone. A Google Home step or trigger keeps the device you picked (its ID, name and room) in the shortcut, and run history keeps what each run worked with, such as a device’s name and state. If backup is on for your phone, Android includes the app’s data in your backup to your Google Account, as it does for other apps. Uninstalling the app or clearing its storage deletes all of it.
- When it leaves your phone. Google Home information is not sent to us or to anyone else, except in two cases you start yourself. Build with AI sends the shortcut you are building to Pro’s AI model, as described under “Pro” above: the names of the devices it uses go with it, never their IDs, rooms or states, and an assistant answer you report keeps its text, which may name them. And a shortcut sends Google Home information wherever you pass it, for example a device’s state to a Pro step, a web request or a message. Shortcuts you share leave out the devices you picked, and crash reports and usage statistics never include device names, rooms or states.
- What we never do. We do not sell Google Home information, use it for advertising or to train AI models, or share it with anyone beyond what is described here. Tapstep’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
- How to stop. Remove Tapstep’s access in the Google Home app (Settings → Linked apps), where you can also change which devices it may use, or in your Google Account under Third-party apps & services. From then on the app can no longer read or control your devices, and Google Home steps and automations with the Home Device trigger stop working until you allow access again.
Why we process this (legal bases)
| Purpose | Legal basis |
|---|---|
| Keeping and showing the shortcuts you share, and taking down reported ones | Performance of a contract (KVKK art. 5(2)(c); GDPR art. 6(1)(b)) and our legitimate interest in preventing abuse (KVKK art. 5(2)(f); GDPR art. 6(1)(f)) |
| Providing Pro, its purchases and its requests | Performance of a contract (KVKK art. 5(2)(c); GDPR art. 6(1)(b)) |
| Reviewing AI content you report and improving how AI answers are filtered | Our legitimate interest in safe AI features (KVKK art. 5(2)(f); GDPR art. 6(1)(f)) |
| Crash reports, genuine app checks, abuse prevention and records required by law | Our legitimate interest in a working and secure app, and legal obligations (KVKK art. 5(2)(ç), (f); GDPR art. 6(1)(c), (f)) |
| Usage statistics and performance data | Your explicit consent (KVKK art. 5(1); GDPR art. 6(1)(a)), which you can withdraw at any time |
Service providers and transfers abroad
We use Google (Firebase, Google Cloud, Google Play), RevenueCat, Inc., OpenRouter, Inc. and the AI model providers it routes to, and the Norwegian Meteorological Institute (MET Norway) for weather. Some of them process data outside Turkey and the EU, including in the United States. We transfer data abroad only to the extent needed for the purposes above and under the safeguards the law requires, such as standard contractual clauses (KVKK art. 9; GDPR chapter V).
How long we keep it
- Data on your phone: until you delete it or uninstall the app.
- Crash reports: 90 days.
- Usage statistics: for the retention period set in Google Analytics, then deleted.
- Pro: the anonymous account and your monthly request counts for as long as you use Pro; purchase records for as long as tax and commercial law require.
- What you send to Pro: not kept.
- Shortcuts you share: until you stop sharing them, or until they are taken down after reports; the count of links you shared today, until the next day. If you no longer have the app on which you shared a link, write to us with the link and we delete it.
- AI content reports: 12 months, then deleted automatically; the count of reports you sent today, until the next day.
Your rights
Under KVKK article 11 and, where it applies, the GDPR, you may ask whether we process data about you and receive information about it, have it corrected or deleted, object to processing, withdraw consent, learn the third parties it is transferred to, and seek compensation for unlawful processing. Write to info@ecma.co; we answer within 30 days. You may also complain to the Turkish Personal Data Protection Authority (KVKK) or, in the EU, to your data protection authority. The switches in Settings → Privacy take effect at once.
Children
The app is not directed to children under 13, and we do not knowingly collect their personal data.
Security
All connections are encrypted, Pro accepts requests only from the genuine app, and we collect as little as the features need.
Changes
If this policy changes, we update this page and its date; significant changes are also shown in the app.