Privacy Policy

Last updated: 11 October 2026

Tagzo ("Tagzo: Lost & Found QR") is made by Workaholic Developers. Tagzo puts QR tags on your things so that whoever finds them can reach you without either of you seeing the other's phone number. This policy explains exactly what Tagzo stores, why, and for how long.

The short version: no ads, no trackers, no analytics SDKs, no selling of data. You don't need an e-mail, a password or a phone number to use Tagzo. A finder doesn't need an app or an account.

If you own tags (the app)

Your account is anonymous. When you first use Tagzo, the app creates an account identified only by a random ID and a sign-in token stored in your phone's secure storage. We store your chosen display name (optional), your language and your time zone (to write notifications in your language and local time), and your alert settings.

Backup code. Your account has a 16-character backup code that lets you restore your tags on a new phone. We store only a one-way hash of it, so we cannot show it to you again; you can make a new one in Settings.

Your tags. For each tag we store its type, name, the message you write, the details you add (for example a pet's name, a school name, emergency contacts or a vehicle number), your choice of which details are public, an optional photo, and settings such as lost mode or a reward message. The details you add (such as emergency contacts, medical notes or a vehicle number) and your phone number (kept only while "Show my phone number" is on) are encrypted at rest; a tag's name and public message are not. Photos are re-encoded on our server, which removes all embedded metadata such as GPS location and camera details; a photo is shown to finders only if you mark it public.

What finders see. Only what you mark as public. A vehicle number is always shown partially masked (for example "MH •••• 4821") unless you choose to show it in full. Emergency contacts are shown only if you made them public, and your phone number only if you switched on "Show my phone number".

Scans and messages. When someone opens a tag's page we record a scan: the time, a rough device description (for example "iPhone · Safari"), the page language and, if the finder chose to share it, a location. Messages between you (and family members you invited) and a finder are encrypted at rest. Link previews (for example when a tag's link is pasted into a chat app) are recorded as such and never notify you.

Push notifications. To alert you about scans and messages we store your device's push token. On iPhone, notifications go through Apple Push Notification service; on Android, through Firebase Cloud Messaging once it is enabled (until then the Android app checks Tagzo for new activity in the background). These services receive the notification text needed to show it. We keep a 30-day log of delivery attempts without the text.

Family alerts. If you invite someone, they see your tag's details (without your phone number or emergency contact numbers), its scans and its conversations, and can reply to finders.

If you found something (the web page)

• You don't need an app or an account. Viewing a page stores no cookie and loads nothing from other websites (fonts and scripts come from Tagzo itself).
• If you send something (a message, a quick reply, your location or your contact details), your browser keeps a random token in a cookie for that tag (tzf_<code>, up to 400 days), so you can see the owner's replies. We store only a hash of the token, plus your device description (for example "iPhone · Safari") and language.
• Your location is sent only when you tap "Share my location" and your browser asks for permission. It is sent once, as a single point. It is never tracked.
• Your contact details (name, phone, e-mail) are optional, encrypted at rest, and shown only to the tag's owner and the family members they invited.
• IP addresses are never stored. To stop abuse we keep a keyed hash of your IP address combined with the date, which lets us rate-limit and count a repeated scan only once on the same day, but cannot follow you from one day to the next. Our web server keeps no access log for Tagzo; its error log can contain the address of a request that failed and is deleted after 14 days.
• Messages that our spam checks drop are not stored.
• You can report a tag that is being misused; the report is stored privately with the hashed IP described above.

Sticker shop

The sticker shop is only available when it is switched on in the app. If you order something, we store your delivery address (name, phone number and street lines encrypted; city, state and PIN code in plain form for shipping) and the order. Payments are processed by Cashfree Payments; we never see or store your card, UPI or bank details. We keep Cashfree's payment notifications (without your contact details) for 400 days. Cashfree's privacy policy applies to the payment itself.

How long we keep data

• Your account, tags, photos and saved addresses: until you delete them or your account.
• Scans: 180 days (link-preview visits: 30 days).
• Conversations, their messages and the finder's contact details: 180 days after the conversation is closed, or after 365 days without any new message.
• Abuse reports: 365 days. Push delivery logs (no message text): 30 days. Used or expired invite codes: 7 days.
• Payment notifications: 400 days. Paid orders: as long as tax law requires, without your address or any link to you once you delete your account.

Deleting your data

• Delete a tag in the app: its details, photo, scans, conversations and family members are erased. The tag code is kept, inactive and empty, so it can never be given to someone else.
• Delete your account (Settings → Delete account): all your tags, conversations, scans, photos, devices, sign-in tokens and addresses are erased immediately. Unpaid orders are deleted; paid orders are kept for tax records without your address or any link to you.
• A finder can ask us to delete their messages by writing to the address below with the tag code.

Sharing

We don't sell or share personal data. We use these processors only to run Tagzo: our hosting provider (servers in a data centre we rent), Apple and Google for push notifications, and Cashfree for shop payments (only if you use the shop). There are no advertising or analytics services.

Children

Tagzo is not directed at children. A child's school-bag tag shows only the school name by default; adding a child's name or class is optional and hidden from finders by default.

Contact

Workaholic Developers · info@workaholicdevelopers.com · https://workaholicdevelopers.com