1. Purpose and responsibility
This policy applies to every use of taplyy, including Customer Content, passes, campaigns, notifications, links, scans, redemptions, API activity, and integrations. Customers are responsible for their users and for anyone acting through their workspace.
You may use the service only for lawful business programs that are accurately represented to passholders and permitted by Apple, Google, and applicable law.
2. Prohibited programs and content
- Illegal goods, services, transactions, gambling, controlled substances, weapons, trafficking, exploitation, terrorism, or content that facilitates crime.
- Fraud, phishing, impersonation, counterfeit credentials, deceptive offers, fake tickets, misleading balances, fabricated affiliations, or unauthorized use of brands.
- Hateful, harassing, threatening, sexually exploitative, abusive, or violent content, including any content that exploits or endangers children.
- Malware, malicious links, credential theft, surveillance, security bypasses, or activity that harms a device, network, person, or service.
- Content that infringes privacy, publicity, copyright, trademark, database, confidentiality, or other third-party rights.
3. Sensitive and regulated data
Do not place government identifiers, passwords, complete payment-card data, bank credentials, medical records, biometric templates, precise device-location histories, or other highly sensitive data in a pass unless taplyy has expressly approved the use case in writing and the relevant platform supports the required protected pass type.
You may not use taplyy as a payment account, bank, identity document, medical record, government credential, or regulated financial product without a separate written agreement and all required approvals. Google may require Generic Private passes and additional review for sensitive data.
4. Notifications and marketing
- Send only messages connected to the program the passholder knowingly joined or another lawful purpose they reasonably expect.
- Obtain and record consent where required for direct marketing, location-based relevance, personalization, or optional tracking.
- Honor opt-outs and consent withdrawal promptly and do not obscure how to leave a program or remove a pass.
- Do not send excessive, disruptive, misleading, discriminatory, or unrelated notifications.
- Do not combine Apple pass data with other user or device data for targeted advertising, advertising measurement, or data-broker activity.
5. Platform and service integrity
- Do not share signing keys, service-account keys, access tokens, passwords, or certificates with unauthorized persons.
- Do not probe, scan, overload, disrupt, bypass limits, introduce malicious code, or attempt unauthorized access to taplyy or third-party platforms.
- Do not create duplicate, automated, or deceptive accounts or use the service to send spam.
- Use the correct Apple or Google pass category and keep every pass accurate, current, functional, and capable of being honored upon presentation.
- Follow Apple and Google branding, button, issuer, content, and technical requirements and promptly cooperate with compliance reviews.
6. Enforcement and reporting
We may investigate suspected violations, request information, limit distribution, disable content, suspend credentials or workspaces, preserve evidence, and cooperate with platforms or authorities where legally required. We will consider severity, repetition, risk to passholders, and whether a violation can be cured.
Report suspected abuse or compromised credentials immediately to support@taplyy.com. Emergency action may occur without advance notice when needed to protect users, platforms, or the service.