Legal

TAGGR iOS App Privacy Policy

Effective September 9, 2026

This policy applies specifically to the TAGGR iOS app and explains how it accesses, uses, stores, shares, retains, and deletes information, including Google and YouTube user data. TAGGR is a decentralized social network, so information a user chooses to publish can be public and stored on-chain.

This is the official privacy policy for the TAGGR iOS app, maintained by the TAGGR open-source project. It is not a template or a policy for an unrelated service.

Google user data disclosure summary

Data collected or accessed: the connected YouTube channel ID and title, Google authorization credentials, and the video and metadata the user explicitly selects for upload.
Purpose: to display the destination channel and upload the selected video to that channel only when the user requests it.
Storage: Google credentials and temporary upload state remain in protected storage on the user’s iOS device; they are not stored in a TAGGR canister or developer-operated server.
Sharing: the selected upload data is transferred only to Google/YouTube to perform the requested upload. TAGGR does not sell it or disclose it to advertisers or data brokers.
Retention and deletion: saved upload jobs older than seven days are deleted when the app next loads the saved job. Disconnect YouTube requests revocation and removes local upload state; successful revocation also clears the Google Sign-In credentials.

Information handled by TAGGR

Posts, comments, reactions, reports, realm activity, uploaded files, and profile information a user chooses to submit.
Public identifiers, including Internet Identity principals and TAGGR user identifiers.
Public ledger information and wallet actions expressly initiated by the signed-in user.
A TAGGR authentication session stored locally on the device to keep the user signed in, using Internet Identity or the Password method described below.

Public content and public identifiers submitted to the Internet Computer may be visible to anyone and may not be fully erasable because of the decentralized, append-only nature of the service.

TAGGR Password and Internet Identity sign-in

The Password option signs in to an existing TAGGR account created with the website's Seed Phrase method. The input is processed on the device to derive a signing key, not sent as a password to TAGGR, Google, or the website hosting this policy. The app sends signed requests and public authentication information to the Internet Computer to verify the account. Internet Identity accounts continue to use their original sign-in method.

The app does not persist the entered phrase. It clears the input field after successful sign-in or dismissal. A delegated authentication session, including its session signing key, is saved in the iOS Keychain with device-only, unlocked-device access. Sign out removes the saved TAGGR session; an expired session requires signing in again. Signing out does not delete the on-chain account or its published content, and does not disconnect YouTube. Protect the phrase: anyone who knows it can control the associated TAGGR account. TAGGR sign-in is separate from optional Google/YouTube authorization.

Google and YouTube user data

Connecting YouTube is optional and begins only when the user selects “Connect YouTube.” Google shows a consent screen before access is granted.

Data accessed

youtube.readonly: the ID and title of the user’s YouTube channel, obtained with channels.list and mine=true.
youtube.upload: permission to upload a video selected by the user and set the title, description, and privacy status entered by the user.
Google OAuth access and refresh credentials managed by the Google Sign-In SDK on the user’s device.

How the data is used

The channel ID and title are used only to show and verify the destination channel before upload. Authorization credentials are used only to access the YouTube Data API for the connected account. A completed video’s canonical YouTube URL is inserted into the user’s TAGGR draft and becomes public only if the user submits that draft.

Storage and retention

Google authorization credentials are managed by the Google Sign-In SDK in the iOS Keychain to restore the connection and refresh access when needed. They are retained while the connection is maintained, and cleared by the SDK after successful disconnection. TAGGR does not store Google credentials on its canisters or developer-operated servers. The connected channel ID and title are held in app memory for display and cleared on disconnection; they are fetched again when the connection is restored.

The app temporarily copies the selected video and stores upload metadata (title, description, privacy setting, resumable-upload URL, progress, and any returned video ID) in its private app storage. The video copy is removed when upload completion is processed; completion metadata can remain until the draft receives the link and acknowledges completion. Cancellation and explicit disconnection remove local upload jobs. Saved jobs older than seven days from creation are deleted when the app next loads the saved job. This is not a background deletion guarantee: data can remain on the device longer if the app is not run. These operations do not delete the original video from the user's photo library.

Sharing

The selected video and metadata are sent directly from the device to YouTube at the user’s request. TAGGR does not sell Google user data, use it for advertising, or share it with data brokers. Google user data is not used to train generalized artificial intelligence or machine-learning models.

Disconnecting and deleting Google data

A user can select “Disconnect YouTube” in TAGGR. This requests revocation of TAGGR's Google authorization, clears the displayed channel information, and removes local YouTube upload state. When revocation succeeds, Google Sign-In clears its saved credentials. If disconnection fails, for example because the device is offline, credentials or authorization may remain: retry when connected or revoke access at Google Account Connections. Revoking access on Google's website does not remotely erase files on an offline device; use the in-app disconnection to remove local upload state.

Videos already uploaded to YouTube remain in the user's YouTube account. To delete them, use YouTube or YouTube Studio; disconnecting TAGGR does not delete them. A YouTube URL already inserted in a TAGGR draft or published post is separate from the temporary upload job and is not removed by disconnection. Remove it from the draft or edit/delete the post separately, subject to the network's limits on erasing published data.

TAGGR’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Photos and videos

The app accesses only media the user explicitly selects with the system picker. TAGGR does not scan the user’s photo library. A video selected for YouTube is handled as described above.

Analytics, advertising, and tracking

The TAGGR iOS app contains no analytics SDK or advertising SDK and does not perform advertising tracking. It does not collect native contacts, precise location, microphone recordings, HealthKit data, or push-notification tokens.

Third-party services

Internet Identity provides one TAGGR authentication option; Password sign-in uses locally derived signing keys as described above. Google Sign-In and the YouTube Data API provide optional YouTube connection and upload. Public Internet Computer ledgers provide wallet information. External community links open their respective services, whose own terms and privacy policies apply.

Security

Google sign-in, token refresh/revocation, and YouTube upload requests use HTTPS/TLS to protect data in transit. Google credentials are protected at rest by the iOS Keychain. Temporary video copies, upload chunks, and job metadata are stored in the app's sandbox with iOS Data Protection (Complete Until First User Authentication), allowing background uploads after the first device unlock following a restart. The upload directory is marked as excluded from device backups. These protections rely on iOS and are not end-to-end encryption of videos uploaded to YouTube.

Google authorization tokens and temporary upload files are not stored by the operator's policy/moderation service or on TAGGR canisters. Users should enable a device passcode, protect their TAGGR phrase, and disconnect services they no longer use. No system can guarantee absolute security.

Children

TAGGR is not directed to children under the age required to consent to online services in their jurisdiction.

iOS reports and moderation

Report on a post or profile sends the target canister, post or user ID, your reason, and a random request ID to the operator's Cloudflare Worker. Reports are stored in D1 for manual review; no token or credit balance is required. Reports do not automatically hide content. Do not include passwords, private keys, or other sensitive information.

The operator can hide individual posts or a user's content in the official iOS app. The public list contains only target IDs and a version, not report text or decision reasons. Closed reports are deleted after 90 days during the operator's review process. Display decisions and their reasons are retained for review and reversal.

Terms acceptance, personal blocks, and the last fetched display-stop list are stored on your device. Signed-in block choices are synchronized with TAGGR when possible. The app fetches the display-stop list without sending your identity credentials. IP addresses are used transiently by Cloudflare's rate limiter to limit report abuse; they are not stored in the report database.

Changes and contact

This policy may be updated when TAGGR’s data practices change. The effective date above identifies the current version. Contact the iOS operator through @FF on TAGGR. Profile posts and replies are public. Send private safety reports using Report in the iOS app.