Privacy Policy

Who is responsible

TAG INTERACTIVE COMPUTER PROGRAMS DESIGN - L.L.C - S.P.C (“Tag Interactive”, “we”, “us”), of Al Ain, Emirate of Abu Dhabi, United Arab Emirates, is responsible for your personal information as its controller. You can contact us about privacy at support@tagg.lol.

This policy applies to the Tagg website, the Tagg apps, our emails and our support. It does not apply to other companies’ websites or apps, even when Tagg links to them.

Information we collect

Information you give us

• Account. Your email address, password (stored only as a secure one-way hash), handle and display name, and your confirmation that you accept the Terms and meet the minimum age. If you use Sign in with Apple, we receive an Apple account identifier, your email address (which can be a private relay address from Apple) and your name if you choose to share it. If you turn on two-factor login, we store your authenticator-app setup, and your backup codes only as hashes.
• Profile. Your profile picture and banner, note, bio, any location you choose to add, links, theme, lettering and decorations, Top Four, sections and visibility settings.
• Library and diary. The titles you save, rate, review and log; ratings and season ratings; reviews; diary entries and private notes; progress; collections and shelves; Quick Rate answers; titles you hide; and the interests, genres, favourite titles, platforms and eras you choose when setting up your taste.
• Social activity. Who you follow, friend requests and friends, blocks, private nicknames you give friends, likes, comments, replies, stickers you upload, and Choose together groups.
• Imports. The export files you upload from Letterboxd, IMDb, Trakt, MyAnimeList, AniList, Goodreads or The StoryGraph, and the history they contain. We read the file to import it and do not keep the file itself.
• Requests and searches. What you search for, and what you write to Help me choose.
• Support and reports. Your messages to support, any screenshots you attach, the email address you use, details about the problem, and reports you make about content or members.
• Purchases. What you bought, when, its status, and transaction references from Apple or Paddle. We never receive your full card details.
• Preferences. Your notification, email, appearance, accessibility and privacy settings.

Information collected automatically

• Device and connection. Your IP address, device and browser type, operating system, app version and time zone, and records of your sign-in sessions, which you can see in Where you’re signed in. Our servers work out from your IP address which country you are in, without sending the address to anyone else.
• Approximate location. If you allow location access, Tagg uses your approximate location on your device or in your browser to find nearby cinemas, your city and your country. Your coordinates stay on your device for a few minutes and are never sent to our servers. Tagg keeps only the city you pick, on your device, and your country, which we use for example to show showtimes and to time notifications.
• Push notifications. If you turn on notifications, your device’s push token, with its platform, app version, time zone and country.
• How you use Tagg. Events such as which Explore shelves you open and act on, search counts without your identity, website page views without your identity, and, only if you turn on Recent activity, the titles you open and share. We record profile and collection views to show their owners a count; owners do not see who visited.
• Cookies and device storage. Cookies and similar technologies that keep you signed in, protect your account and remember your settings. The Cookie Policy lists them.

Information from others

• Other members may follow you, send you a friend request, give you a private nickname that only they see, comment on your reviews, add you to Choose together, or report your content.
• Apple tells us when you sign in with Apple, when you buy or renew through the App Store, and when a purchase is refunded.
• Paddle tells us the status of website purchases, refunds and subscriptions, with a customer reference.
• Cloudflare Turnstile tells us whether a sign-up or sign-in passed its security check.

How we use information

We use personal information only for the purposes below. The legal basis depends on the law that applies to you. For people in the United Arab Emirates, we rely on the grounds in the Federal Decree-Law on the Protection of Personal Data, mainly that processing is needed to provide the service you signed up for, or your consent. For people in the European Economic Area and the United Kingdom, we rely on the bases shown in brackets.

• Providing Tagg (performance of our contract with you): creating and securing your account, keeping your library and diary, publishing what you post to the audience you choose, friends and following, notifications, imports, exports and support.
• Recommendations (contract, and you can turn personal recommendations off): Tagg Sense ranks titles for you from your ratings, library, Top Four, Quick Rate answers, hidden titles, taste choices and, if you allow it, recent activity.
• Improving Tagg (legitimate interests in making Tagg better): understanding which features are used, fixing problems, and testing Tagg Sense against pseudonymised rating histories that do not include names, handles or account identifiers.
• Popularity and discovery (legitimate interests, and consent for opens and shares): counting activity across members, such as ratings, public reviews and public saves, to rank titles in search and Explore. A count is used only when at least three members contributed, and opens and shares count only if you turned on Recent activity and agreed to it.
• Regional availability (legal obligations and legitimate interests): using the country your IP address belongs to, and the App Store country of your Apple account, to offer only the features available where you are.
• Safety and security (legitimate interests in protecting members and Tagg, and legal obligations): preventing spam, fraud and abuse, checking new passwords against known data breaches, rate-limiting, reviewing reports and enforcing our Terms and Community Guidelines.
• Payments (contract and legal obligations): unlocking what you bought, handling refunds, and keeping tax and accounting records.
• Emails and messages (contract, and consent for optional emails): sending verification codes, security alerts, billing notices and replies to support requests. Optional emails, such as check-ins about what you are watching or reading, are sent only if you turn them on.
• Legal matters (legal obligations and legitimate interests): complying with the law, responding to lawful requests, and establishing or defending legal claims.

We do not sell personal information. We do not use it for targeted advertising, Tagg shows no third-party advertising, and we do not share personal information with data brokers. We do not make decisions that have legal or similarly significant effects on you based solely on automated processing.

Tagg Sense and AI

Tagg Sense

Tagg Sense is Tagg’s own recommendation system and runs on our servers. It is not a generative AI service, and your information is not sent to an outside AI provider to produce your recommendations. Sense reads your library and taste information when it prepares recommendations and does not keep a separate copy.

If you turn off Personal recommendations in Settings › Tagg Sense, Sense stops personalising for you, and your activity is left out of the counts and pseudonymised histories used to improve Sense.

Recent activity

Recent activity is off unless you turn it on. When it is on, Sense also uses the titles you opened and shared in the last 14 days. These records are deleted after 14 days, and you can delete them sooner with Forget recent activity.

Help me choose

Before your first request, Help me choose asks whether AI may read what you write. If you allow it, the text of your request is sent to Anthropic, our AI provider, so that it can work out what you are asking for. Nothing else about you is sent: not your name, handle, email address, account identifier or library. Anthropic processes the text on our behalf, does not use it to train its models, and may keep it for a short period for safety and abuse monitoring under its own policies. You can turn this off in Settings › Tagg Sense › Read my requests with AI, and Help me choose will still work without it. Do not include personal or sensitive information in a request.

Choose together

In a Choose together group, the other members see the group’s picks. If you turn on Use my taste, your taste information helps rank the picks, but your library is not shown to the group.

Catalogue information

We use AI services, including Anthropic and OpenAI, to help prepare catalogue information such as summaries and lists of related titles. That work uses public catalogue sources only, not members’ information.

Who can see your information

You decide who sees much of what you add to Tagg:

• Your profile can be visible to Everyone, Friends or Only me. New accounts start at Friends.
• Reviews, collections and profile links each have their own audience: Everyone, Friends or Only me. A collection set to Everyone is public even if your profile is not, and shows your handle and display name.
• Your library is shown on your profile only if you turn on Share my library, and your ratings only if you turn on Show ratings. Otherwise a rating is shown only with a review that the viewer can see.
• Diary entries and private notes are visible only to you.
• Profile visits are shown to you as a count, without saying who visited.

Your handle, display name and profile picture appear with anything others can see you do, such as comments, likes, follows, friend requests and public collections, even when your profile is not public. Members whose profiles are discoverable can appear in search and in Meet someone new suggestions, with how closely their taste matches yours, according to their taste-match setting.

Content set to Everyone can be viewed by anyone, including people who are not signed in, and can be copied or shared by others. When you delete content, it is removed from Tagg, but we cannot remove copies that other people have made. If you block a member, neither of you can see or interact with the other’s profile or content.

Who we share information with

Service providers

We use companies that process information on our behalf, under contracts that limit their use of it to providing their service to us:

• Hostinger International Ltd hosts our servers and databases, in India.
• Cloudflare, Inc. stores the images you upload and protects sign-up and sign-in with its Turnstile security check.
• Resend sends our account, security and billing emails, and the check-in emails you choose to receive.
• Anthropic reads Help me choose requests, only if you allow it, as described above.
• Apple provides Sign in with Apple and delivers push notifications to Apple devices.
• Have I Been Pwned checks whether a new password has appeared in a known data breach. It receives only a short, partial fingerprint of the password, never the password itself.

Payment providers

Apple, for App Store purchases, and Paddle, for website purchases, process payments as independent controllers under their own privacy policies. Paddle is the merchant of record for website orders and receives your name, email address, payment details and billing country to process the payment and meet its tax obligations.

Catalogue and media providers

In the Tagg app, posters and other artwork load directly from providers such as The Movie Database (TMDB), IGDB, AniList, MyAnimeList and Wikimedia, so the provider receives your IP address and device information, as it would from any website. On the website, artwork is delivered through our own servers. Trailers play in YouTube’s embedded player, in its privacy-enhanced mode where available; the player starts loading when you point at or press play, and from then on YouTube receives your IP address and device information. To find titles that are not yet in our catalogue, we may send the words of a search, or the title and year of an imported item, to TMDB or IGDB, without any information about your account. Showtimes and bookshop offers are looked up by our servers without any information about you, and bookings and purchases happen on the cinema’s or shop’s own website.

When you share

When you share a card or link to an app such as Instagram, Snapchat, WhatsApp or X, that content goes to that app under its terms. Sharing to Snapchat places the card and its link on your device’s clipboard for five minutes.

Legal and safety reasons

We may disclose information to courts, law enforcement or other authorities when we believe in good faith that the law requires it, or that it is necessary to protect someone from death or serious harm, to respond to child sexual exploitation, to prevent fraud, or to protect the rights and safety of Tag Interactive, our members or the public. We review each request, decline requests that are not lawful or are too broad, and tell the member concerned unless the law prevents it or doing so would put someone at risk.

Business changes

If Tagg is reorganised, merged or sold, personal information may be transferred to the new owner, who must continue to protect it in line with this policy. We will tell you before that happens.

Aggregated information

We may publish or share information that has been combined and does not identify anyone, such as the number of members who rated a title.

International transfers

Tag Interactive is based in the United Arab Emirates. Our servers are in India, and some of our service providers process information in other countries, including the United States, the United Kingdom and the European Union. Wherever your information is processed, we protect it as this policy describes.

Where information leaves the United Arab Emirates, we rely on the grounds permitted by UAE data protection law: the transfer is necessary to provide the service you asked for, it is covered by a contract that requires the recipient to protect your information to an equivalent standard, or you have consented. Where the GDPR or UK GDPR applies, we use an adequacy decision or the European Commission’s standard contractual clauses and the UK addendum. You can ask us for details of these safeguards.

How long we keep information

We keep personal information only as long as we need it for the purposes in this policy, then delete it or remove anything that identifies you.

• Your account and content are kept while your account exists. When you delete your account, they are removed when the 30-day waiting period ends.
• Backups of our database are kept for up to eight days, then overwritten.
• Server logs that contain IP addresses are kept for up to 30 days for security and troubleshooting.
• Recent activity is kept for 14 days.
• Explore usage events linked to your account are kept for 90 days.
• Website page views are counted without your identity and kept for 30 days.
• Search records do not identify you. Individual searches are kept for 90 days, and weekly totals are kept after that.
• Notifications are deleted 90 days after you read them, and all of them after 180 days.
• Push tokens are kept until you sign out, turn notifications off or the token stops working.
• Profile and collection view records are kept while the profile or collection exists. They no longer link to the visitor once the visitor’s account is deleted.
• Imports are previewed for up to 7 days. The working copy of your imported history is deleted 30 days after the import ends.
• Help me choose keeps the picks it made for you for one week.
• Support requests and reports are kept while we deal with them and for up to three years after they are closed, so that we can handle follow-up questions, safety concerns and legal claims. This includes the email address you used.
• Records of moderation actions are kept while the account exists. If the account is deleted, the records stay without the account details, so that we can show what action was taken and why.
• Purchase and tax records are kept for as long as tax and accounting laws require, which is generally seven years.
• A deletion record contains a one-way fingerprint of your account identifier and the dates of your request and deletion, so that we can show that we honoured it.

Your choices

• Audience for your profile, reviews, collections and links, and the Share my library and Show ratings settings.
• Tagg Sense settings: Personal recommendations, Read my requests with AI, Use recent activity and Forget recent activity.
• Notifications for each kind of activity, set to Push, In Tagg or Off, as well as your device’s own notification settings.
• Emails. Check-ins and other optional emails are off unless you turn them on, and every one has an unsubscribe link. Account, security and billing emails cannot be turned off while you have an account.
• Device permissions. You can turn location, photos, notifications and Face ID off at any time in your device settings. Tagg only uses the photos you pick.
• Blocking any member.
• Your data. In the Tagg app, download a copy of your data in Settings › Account & security › Download your data, or delete your account in Settings › Account & security › Delete account. You can also ask us by email.

Your rights

Depending on where you live, including under UAE data protection law and the GDPR or UK GDPR, you have the right to:

• be told how we use your information, and get a copy of it;
• correct information that is inaccurate or incomplete;
• have your information deleted;
• restrict how we use it, or object to our use of it, including for direct marketing and where we rely on legitimate interests;
• receive your information in a structured, machine-readable format and have it sent to another service where technically possible;
• withdraw consent at any time, without affecting what we did before;
• object to decisions based solely on automated processing that significantly affect you;
• complain to a data protection authority.

You can do most of this yourself in Settings. For anything else, email support@tagg.lol from the address on your account, with “Privacy request” in the subject line. We may ask you to confirm your identity. We reply within one month. If a request is complex, we may extend that by up to two more months and will tell you why. We do not charge for requests unless they are clearly unfounded or excessive.

If you are unhappy with how we handled your information, please contact us first. You can also complain to the competent data protection authority in the United Arab Emirates, or, if you live in the European Economic Area or the United Kingdom, to the authority where you live, such as the Information Commissioner’s Office in the UK.

If you live in a US state with a consumer privacy law, you have similar rights to access, correct and delete your information, and you can use an authorised agent. We do not sell personal information or share it for cross-context behavioural advertising, and we will not treat you differently for exercising your rights.

Deleting your account

1. In the Tagg app, open Settings › Account & security and choose Delete account.
2. Confirm with your password or with Apple.
3. Your account is scheduled for deletion 30 days later, and your profile is hidden straight away. To cancel, sign in and choose Keep my account.

If you use Tagg only on the website, or cannot sign in, email support@tagg.lol from the email address on your account and we will delete it for you after confirming the request.

When the 30 days end, we delete your account and everything linked to it: your profile, library, ratings, diary, reviews, collections, comments, likes, follows, friends, blocks, uploads, imports, notifications, push tokens, settings and sign-in methods. Comments you wrote are deleted together with the replies in their thread. Your information then remains only in backups, until they are overwritten within eight days, and in the records described under How long we keep information.

Deleting your account does not cancel an App Store subscription. Cancel it in your Apple account settings to stop future charges.

Children

Tagg is not for children under 13, or under 16 in the countries listed in the Terms, and we do not knowingly collect personal information from them. If we learn that an account belongs to someone below the minimum age, we close it and delete its information. If you believe a child below the minimum age is using Tagg, contact us at support@tagg.lol.

Members under 18 need a parent’s or guardian’s permission to use Tagg. We do not use anyone’s information for targeted advertising.

Security

We protect personal information with technical and organisational measures appropriate to the risk. These include encryption of information in transit, hashing of passwords and backup codes, encryption of sign-in tokens from Apple, secure storage for your session on your device, two-factor login, checks against breached passwords, and limited staff access that requires two-factor authentication and is logged.

No service can be completely secure. If a breach affects your personal information, we will notify you and the relevant authorities where the law requires. Please report security issues to support@tagg.lol.

Changes to this policy

We will update this policy when Tagg or the law changes. The date at the top shows the latest version. If a change is significant, we will tell you by email or in Tagg before it takes effect.

Contact

TAG INTERACTIVE COMPUTER PROGRAMS DESIGN - L.L.C - S.P.C, Al Ain, Emirate of Abu Dhabi, United Arab Emirates. Email support@tagg.lol.