Privacy
Effective 24 October 2026.
Kipat lets two people swap public profiles by touching their phones. This policy explains what Kipat stores, what leaves your phone, and the choices you have.
The short version
- No account needed. Everything Kipat keeps stays on your phone, unless you choose to put your profile online (below).
- No ads, no analytics, no tracking. Kipat contains no advertising or analytics code.
- You decide what is public. Only the profile you create is shared, and only when you touch another phone, tap a card, or share your Kipat code.
What Kipat stores on your phone
- Your profile: your name and the details you choose to add (for example school, program, role, company, profiles you list), your Reveal style and accent colour, and a random public id.
- People you met: profiles you received with Kipat Tap, your recent taps, and the Connections you chose to keep.
- Your Kipat cards: each linked card's random id and status, and a signing key that never leaves your phone's secure hardware (it signs your cards so copied or altered cards can be detected).
- Settings: for example whether Kipat Tap is on.
This data is not backed up to the cloud by Kipat and is not sent to us, except the online profile you choose to publish (below).
What leaves your phone, and when
| When | What is sent | To whom |
|---|---|---|
| Kipat Tap is on and your phone is unlocked | A random code that changes every 10 minutes, so nearby Kipat phones can find yours. It contains no name or id | Nearby phones running Kipat |
| You hold your phone against another Kipat phone | Your public profile; you receive theirs | That one phone |
| You share your Kipat code | Your public id | Whoever you share it with |
| You link a Kipat card | The card stores the card's random id and a signature. No profile details are written to the card | The card |
| You tap Save contact | The other person's details are passed to your Contacts app, where you decide to save them | Your Contacts app |
| You tap Report a problem | A technical report: app version, phone make and model, Android version, Kipat Tap settings and timings, and one-way codes in place of profile ids. It contains no names, profile details, phone numbers, device ids or location | Whoever you choose in the share sheet |
The exchange between phones is not encrypted. It carries only the profile you made public; do not put anything in your profile that you would not show the person you tap.
Optional online profile
Where your version of Kipat offers it, you can put your profile online so your link (kipat.evieza.me/c/<your id>) shows it on the web. This is off until you turn it on.
- What is stored on Kipat's server: your account id, the email address of the Google account you sign in with, the public profile you publish (the same profile you share by touching phones) and when it was last updated. Your sign-in session is stored on your phone, encrypted.
- Who can see it: anyone who has your link sees your published profile. Your email address and account id are never shown. Profiles can't be listed or searched, and profile pages tell search engines not to index them.
- Service providers: Supabase (database and sign-in), Google (Sign in with Google) and Vercel (the website). They process this data only to run Kipat's online features.
- How long: until you remove your online profile or delete your account. Removing or deleting takes effect at once on Kipat's server.
- Your choices: in Profile → Online profile you can remove your online profile, sign out, or delete your account and everything stored with it. You can also ask for a copy or correction of your data, or for its deletion, using the contact below.
The website
kipat.evieza.me uses no cookies, no analytics and no advertising. Like any website, its host processes your IP address to deliver pages and to limit abuse; Kipat does not store it.
Security
Data sent to Kipat's server is encrypted in transit (HTTPS). Access rules on the server let only you change your own profile; payment, tester-code and card records can be read only by Kipat's server functions. Keys that could bypass those rules never leave the server.
Permissions
- Nearby devices: finds and connects to other Kipat phones for Kipat Tap. Kipat never uses it to find your location.
- Location (Android 8 to 11 only): those Android versions require it before an app can find nearby devices. Kipat never reads, stores or shares your location.
- Internet (optional features only): signing in and the online profile. Everything else works offline.
- Notifications: shows that Kipat Tap is on, and who you just met.
- Display over other apps (optional): opens the Reveal over the app you are using when you touch phones. You can turn it off in Android settings at any time.
- Kipat cards: reads and links Kipat cards.
- Run at startup: turns Kipat Tap back on after a restart, if you left it on.
Your choices
- Turn Kipat Tap off at any time in Profile.
- Edit or delete any profile detail in Profile → Edit profile.
- Remove a Connection from its page.
- Disable a linked card in Profile → Kipat cards.
- Remove your online profile, sign out, or delete your account in Profile → Online profile.
- Uninstalling Kipat deletes everything Kipat stored on your phone. Profiles you already gave to other people stay on their phones, like a business card you handed over.
Children
Kipat is not directed to children under 13.
Your rights
Depending on where you live (for example under the Philippine Data Privacy Act of 2012 or the GDPR), you have the right to be informed, to access, correct and delete your data, and to object or complain to your data protection authority. Kipat answers such requests through the contact below.
Changes
If this policy changes, the new version will be posted at this address with a new effective date.
Contact
Questions or requests: through the Kipat app, Profile → Report a problem. A contact email will be listed here.