Tacq Privacy Policy
The Tacq Team has developed this platform to restore your control over your digital space. Tacq’s core principle is Zero PD (Zero Personal Data). Tacq does not just promise not to share your data: the system is built so that it is not collected in the first place.
Tacq’s internal privacy standards are designed in the spirit of the world’s strictest data protection regulations, including the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA), as Tacq’s architecture physically excludes the collection of personal information by default.
1. What Tacq DOES NOT Collect
Tacq does not request, verify, or store:
- Your phone number.
- Your real email address.
- Links to your social media profiles.
- Information about your real name or location (unless you voluntarily choose to broadcast a geo-tag within a specific group). Tacq does not ask for your date of birth either — only your age group (see section 3).
2. How Tacq Identifies You (Master ID System)
Instead of traditional logins, Tacq generates a random alphanumeric code (Master ID) for your device. This code is your access key. Tacq does not ask for or store a link between it and your real-world identity — no name, phone number, or email is attached to it. Even so, a Master ID can still qualify as personal data, so Tacq protects it accordingly (see section 8).
3. What Data Tacq Stores
To facilitate communication, Tacq stores only the information you voluntarily create within the platform:
- Nicknames and pictures: the nickname and picture you choose for each connection pass to the other person through the server in encrypted form and are deleted from the server as soon as they are received. Your group card (your nickname and picture for that group) is kept on the server only in encrypted form under the group key while you are a member, so that the other members can see it. Your profile nickname and picture and your session topics are kept only on your devices.
- Messages and Media: Text, voice messages, and files you exchange in chats — only in encrypted form and only while they are being delivered (see sections 4 and 11).
- Technical Metadata: Timestamps of sent messages (for chat sorting) and system logs to protect against spam.
- Age Group (Tier): on first launch the app asks for your age group once, to keep minors safe. Only the group is remembered (e.g., "13–15" or "18 or older"), never your date of birth, and it is stored only on your device — it is not sent to the server.
- No analytics and no automatic crash reports (since version 1.0.179): the app sends neither information about how you use it nor error reports. The latest errors are recorded in a log on your device only — without your Master ID, nickname or messages. It reaches Tacq only if you send it yourself by email to support@tacq.app (“Settings → Report a problem”); Tacq keeps such an email while investigating the error.
4. Where Your Messages are Stored and Who Has Access
Private conversations (one-to-one, including replies to listings and QR-sticker conversations). The text of your messages, and the photos, files and voice messages you attach, are encrypted on your device and can be opened only on your contact's devices (and on your own linked devices). Messages pass through the server in an encrypted form the server cannot read, and are deleted from it as soon as they reach the recipient's devices. If the recipient never picks a message up, it is deleted automatically after 30 days. Photos, files and voice messages travel the same way and are deleted from the server together with the message. The private keys never leave your devices. Your conversation history is therefore kept on your devices, not on Tacq’s servers; you can keep up to five linked devices and make an encrypted archive file yourself. If you lose all your devices and have no archive, the history cannot be restored — it is not on the server.
Groups. Group messages and their attachments are encrypted on the sender's device separately for each device of each member. They pass through the server only in this encrypted form, which the server cannot read, and are deleted from it after 30 days; for a member who has not opened the group during that time, they wait no more than another 30 days. The group's conversation history is kept on the members' devices.
Requests to organisations and to Tacq support. Messages in a request are encrypted with a key that only you and the organisation's staff have, so on the server they are stored in a form that nobody else can read, including Tacq. In a request to Tacq support, the organisation's staff are the Tacq Team. Only service information remains readable on the server: which organisation and service the request is addressed to, its status and the time of messages. The Tacq Team does not use automated scanners to analyze the content of your conversations for marketing or profiling purposes.
A one-to-one chat has two secrecy levels:
- "Encrypted": the default level — end-to-end encryption, as described above.
- "Top secret": a level you choose yourself. On top of encryption, the content never passes through the server at all — it waits on your device and is delivered straight to the other person over a direct connection when you are both online. The server only knows that there is a message for the other person, never its content. Such a message arrives on one of the other person's devices only.
Please note, at either level: to deliver messages and notifications, the server works only with anonymous identifiers of the sender and the recipient and the time of the message. The server does not know who is behind these identifiers: Tacq does not collect real names, phone numbers or email addresses. "Top secret" is available in one-to-one chats only, not in groups or in requests to organisations.
5. Non-Transferability of Contacts
Tacq's architecture excludes the systemic exchange of your profiles. No one can export your contact list or transfer your communication session to a third party without your knowledge. The connection exists only between you and your interlocutor.
6. Data Deletion
You can block a session or delete your account at any time. Upon account deletion, your Master ID and all associated profiles are permanently erased from Tacq’s active databases.
7. Children and Child Safety
Tacq is intended for users aged 13 and older; people under 13 cannot create an account or use the app. On first launch the app asks only for your age group (see section 3) — never your date of birth. Tacq acts on reports: a report carries the part of the conversation needed to review it — the reported message and up to ten messages before it, with images — sent from the reporter's device only with the reporter's consent, after they have seen what will be sent.
Tacq has zero tolerance for child sexual abuse and exploitation (CSAE). You can report abuse from inside the app or by email, and Tacq bans the offender’s account and reports to the appropriate authorities where required by law. Full details are set out in Tacq’s Child Safety Standards.
8. How Data-Protection Laws Apply (GDPR and Others)
Even though Tacq deliberately avoids collecting your name, phone number, or email, some of the limited data Tacq does handle — your Master ID, device and push identifiers, technical logs and the network (IP) addresses Tacq’s providers process, message metadata, and any content you choose to send — can still count as "personal data" under laws such as the EU/UK GDPR. So Tacq treats that data according to those laws. Tacq’s lawful bases are: performing its agreement with you (to deliver your messages and run the service); Tacq’s legitimate interests (keeping the service secure and preventing spam and abuse); your consent where Tacq asks for it (for example, before you broadcast a geo-tag); and compliance with legal obligations (for example, child-safety reporting). Tacq keeps the amount of personal data to the minimum needed — that is the heart of the Zero-PD approach.
9. Your Privacy Rights
Subject to applicable law, you have the right to access the data associated with your account, to correct it, to delete it, to object to or restrict certain processing, and to receive a copy in a portable form. Because Tacq stores so little and ties it to an anonymous Master ID, the simplest way to exercise most of these rights is inside the app: you can edit your profiles, block sessions, and delete your account, which erases your Master ID and associated profiles from Tacq’s active databases. You can also contact Tacq at support@tacq.app. Tacq will not charge you for exercising your rights or treat you differently for doing so. If you are in California, you have the right to know what personal information Tacq holds, to delete it, and to opt out of its "sale" or "sharing" — and Tacq does not sell or share your personal information. If you are in the EU or the UK, you also have the right to lodge a complaint with your local data-protection authority.
10. International Data Transfers
Tacq runs on global infrastructure (such as Google Firebase, and Hetzner in Germany for Tacq’s own call relay server), so the limited data Tacq processes may be stored or handled on servers outside your country, including outside the EU. Where the law requires, Tacq relies on its providers' safeguards for such transfers (for example, standard contractual clauses). By using Tacq, you understand that your data may be processed in other countries whose data-protection laws differ from your own.
11. How Long Tacq Keeps Data
Tacq keeps data only as long as needed. Private messages and their attachments pass through the server in encrypted form and are deleted from it as soon as they are delivered; a message that is never picked up is deleted automatically after 30 days. Photos and files in groups are deleted from the server after 30 days. Group messages (in encrypted form) and profiles remain until you delete them or delete your account. Requests to organisations are kept by the organisation: it decides how long to keep them and answers requests to delete them or to provide a copy. If you delete your account, your requests remain with the organisations, and after that Tacq cannot tell that they were yours — so it is better to ask an organisation to delete your requests or give you a copy before deleting your account; messages you have sent to other people stay with them after you delete your account (see Account & Data Deletion). The part of a conversation attached to a report is kept for 90 days after the report has been reviewed (for child-abuse reports passed to the authorities, one year after they were passed on, as the law requires) and then deleted; the decision on the report remains. Technical logs kept to protect against spam and abuse are retained for a limited period and then removed. When you delete your account, your Master ID and associated profiles are erased from Tacq’s active databases; residual copies in backups are overwritten in the ordinary course.
12. Who Is Responsible and How to Reach Tacq
Tacq is operated by the Tacq Team, which is responsible for the data described here. You can contact Tacq about privacy at support@tacq.app, or by post at P.O. Box 5431, Israel. If you have concerns Tacq cannot resolve, you may also contact the data-protection authority in your country.
Last updated: 27 October 2026.