Privacy Policy

TyraTag Inc. operates TyraTag and is responsible for the personal information described here. For any privacy question or request, contact support@tyratag.com. Our privacy officer is accountable for this policy and can be reached at the same address.

TyraTag is offered across Canada, excluding Quebec: we do not sell to, or open owner accounts for, residents of Quebec. People in the United States may also use TyraTag; section 12 covers them. This policy is framed on PIPEDA. Scanning a tag you have found works everywhere and never requires an account.

Your account. Your email address, which you sign in with and which we use to reach you about your account, and the name you choose to show. Your emergency contacts see that name in the texts we send them, and someone who scans a tag set up for a person sees it on the emergency screen. If you sign in with Google, Google shares your name, email address and profile picture link with our sign-in provider. If you turn on two-step sign-in, we keep only hashes of your recovery codes, never the codes. Our sign-in provider keeps a log of sign-in activity, including the IP address a sign-in came from.

The number we text you on. We confirm it is yours with a one-time code sent through Twilio Verify, then store it encrypted. We record when you agree to receive our texts and when you withdraw that agreement. When someone sends you an everyday or urgent alert, we may check your number with Twilio Lookup, which tells us whether it is a mobile, landline or internet number and how likely it is to be a target of text-message fraud; we keep that result for 7 days, filed under a one-way hash of your number.

Your tags. Each tag’s type (person, vehicle, bag, bike or pet), the name you give it, when it was activated, and whether it is active, paused or switched off. If you add car details — colour, make and model, licence plate — anyone who scans that car’s tag sees them, so they can check it is the right car. For that reason they are stored as plain text.

Your emergency contacts. The name and mobile number of each person you add. The number is stored encrypted, together with a keyed fingerprint of it that lets us honour a STOP reply without decrypting anything. We also record whether each person has been sent our invitation, has confirmed or declined, or has opted out (section 4). When you remove a contact we stop texting them straight away, and 30 days later we erase their name and encrypted number. The same happens 30 days after a contact declines or opts out.

Medical details, only if you add them. On a tag set up for a person you can add blood type, allergies, conditions, medications and notes. You are never required to, and you add them only by an explicit choice, separate from creating your account, which we record. If they describe someone else, you confirm that the person asked you to add them, or that you are the parent or guardian of the child they describe, and we record a parent or guardian’s confirmation. Each field is stored encrypted. Someone who scans the tag sees them only on the emergency screen, and only while “Show critical medical info to finders” is on in your settings. When they are shown, we add an entry to a tamper-evident access log, with the same limit as the scan records in section 3; the entry contains no medical information.

You can do two different things with medical details, and they are not the same: turn that setting off, which stops the details being shown to anyone who scans your tag while keeping them in your account, or delete them, which erases them. Either way the tag keeps working.

Choices we record. When you set up your account we record that you are 18 or older and accept our Terms and this policy; that you are not a resident of Quebec; that you have been shown the notice in section 7 about storage in the United States; and whether you want your emergency contacts texted in an emergency — yes or no. For the first three we also record which version of the wording you saw. Later we record your text-message opt-in and your medical-sharing choices, and any change to them. Each record holds what was decided and when. None of them holds your IP address.

Your alerts. A record of each scan of your tags (section 3), each text we sent you or your contacts and whether it was delivered, what each text or code cost us, and any conversation that followed an alert.

Buying tags. Shopify runs our checkout and collects your name, address and payment details under its own privacy policy; we never see your card number. Shopify sends us each paid order so we can assign your tags. We keep only the order number and how many tags were bought, and we do not store the name, email address or shipping address that come with it.

Setting up before you have an account. If you start setting up a tag before signing up, we keep your progress — the tag, the name you gave it, a keyed fingerprint of the number you verified (not the number itself) and whether your test text arrived — for 7 days after your last step, and never more than 30 days in all.

Analytics, only if you say yes. If you accept analytics, we count which screens you use. The events are tied to your account’s ID — a random identifier, not your name or email — and never include your contacts or medical details; the page addresses we send have tag IDs removed. Your answer is stored in your browser, and you can change it in your settings.

You never need an account, and we never ask for your name. If anyone is in danger, call 911 first.

When you open a tag. Your browser tells us the page was viewed. We record which tag, when, whether it opened the emergency screen or the everyday one, and whether the owner’s medical details were shown. The record of a page view contains no IP address, no location and no information about your device or browser. Because your browser sends it after the page loads, a scan made with JavaScript turned off, or by a tool that only fetches the page, can show the page without leaving a record.

When you send an alert. The text we send says what happened in words chosen from a fixed list — for example “Lights are on” or “Crash or collision” — never your own words. On a tag set up for a person, an emergency alert goes to the owner’s emergency contacts. On other tags it goes to the owner, and also to the owner’s emergency contacts if you report something urgent about a vehicle. Contacts are texted only if the owner has chosen that. Nobody we text is given a phone number for you; sending an alert never asks for one. Unless the tag is set up for a person, sending an alert also logs that you were shown this page’s notice; the log names the tag, not you.

If you share your location. Only if you tap to share it, when you send an alert or later in the conversation. We read it once, never continuously, and round it to about 11 metres. It is stored with the alert so the people responding can see where you were, and we delete it with the alert (section 8). If you share it when you send the alert, it also goes into the text as a Google Maps link, and stays in that message on the recipient’s phone and in Twilio’s message records. If you don’t share it, we have no location for you.

If you message the owner or their contacts. The conversation happens on a secure page, not by text message. Your messages are stored encrypted and deleted with the alert. The link to the conversation works for 24 hours.

Your device fingerprint. When you send an alert or verify a phone number, your browser works out a fingerprint of your device from basic technical characteristics: browser and operating system, platform, language, time zone, screen size and colour depth, number of processor cores, and touch support. We do not use canvas, WebGL or audio fingerprinting. Your browser turns the fingerprint into a one-way SHA-256 hash before anything leaves your device, and only the hash is sent, with that request and no other. It is not a cookie, and nothing is stored on your device. We keep the hash with the scan record and use it only to limit abuse and to let an owner block a sender. It is cleared from the scan record after 30 days.

If an owner blocks you. An owner who marks a scan as abuse adds that scan’s device fingerprint hash to our block list. After that, everyday and urgent alerts from that device are refused on every TyraTag, not just the owner’s. A block never stops an emergency alert from a tag set up for a person. Blocks do not expire on their own.

If the owner has turned on private calling. Private calling is off unless an owner switches it on for a tag. If it is on, you can ask for a call from the conversation page, and only then do we ask for your mobile number. We confirm it is yours with a one-time code sent through Twilio Verify. After the code is accepted, your browser holds a signed cookie for up to 10 minutes so your request can be completed; it is cleared once the request is made. Your number is stored encrypted with the alert and deleted with it. Calls connect through our phone number, so the person you speak to never sees your number and you never see theirs. We do not record calls. We keep each call’s times, length and outcome with the alert and delete them with it. Twilio, which connects the call, keeps its own record of the numbers and the call’s length.

Your IP address. None of our records about your scan or alert contain your IP address. Like any website, our hosting provider sees it, and its platform logs record it with your browser type and the page address for a limited period. Cloudflare sees it on the pages protected by its bot check: the find-a-tag form, and the alert form on tags that are not set up for a person. To limit abuse, our abuse-prevention store keeps a one-way hash of it, which deletes itself within about 30 minutes.

No tracking. We never run analytics on the pages you use — the tag page, the find-a-tag form and the conversation page — and our error monitoring does not run in your browser on them.

What the owner gives us. Your name and mobile number. We store the number encrypted. We send you a text saying who added you, with a link where you can confirm or decline (the owner can resend it if you missed it), and we record whether it was sent and your answer. The link works for 7 days.

When we text you. Only after you tap Accept. Until then, the only texts you get are the invitation and any resend the owner asks for; when you accept, we text you once to confirm. From then on, unless you opt out, we text you when someone reports an emergency on the owner’s tag for a person, or something urgent about the owner’s vehicle, if the owner has chosen to have contacts texted. The text includes the owner’s name, what was reported, a map link if the person at the scene shared their location, and a secure link.

If you open the secure link. You can respond, message the person at the scene, and mark the alert resolved. If you tap Respond, we record that you chose to respond to that alert, and when. Only the owner sees your name as the person responding. Your messages are stored encrypted and deleted with the alert. The link works for 24 hours. If private calling is on and you accept a call request, we ring your phone from our number and connect the person at the scene only after you press 1. Neither of you sees the other’s number, and the call is not recorded.

Replying STOP. Reply STOP to any of our texts and we stop texting you, for every owner who has listed you, not just one. To make that last, we keep a keyed fingerprint of your number (not the number itself) until you reply START. We keep it even after an owner deletes their account, so an opt-out cannot be undone by accident. If you decline the invitation instead, we stop texting you about that owner’s alerts; the owner could add you again, which sends a new invitation, whereas STOP blocks every text from us.

If the owner removes you, we stop texting you straight away, and any secure link we already sent you stops working. We erase your name and encrypted number from the owner’s account 30 days later, and the same happens 30 days after you decline or reply STOP. You can ask us to erase them sooner (section 11).

We use personal information only to: run your tags and send the alerts people ask us to send; show the right information to the person at the scene; let the owner and their contacts talk privately with that person; run accounts and purchases; prevent abuse, fraud and runaway telephone costs; keep the service secure and fix faults; and meet our legal obligations.

We do not sell personal information. We do not use it for advertising. We do not send marketing texts, and our alert and notification texts contain no promotional content.

People at the scene and emergency contacts see what sections 2 to 4 describe, and nothing more. Beyond them, we share the minimum needed with the service providers that run TyraTag. Each acts on our instructions, under its published data-processing and security terms:

• Supabase — our database and sign-in service, and the sender of our sign-in emails (confirmations, sign-in links and password resets).
• Vercel — hosts the app. Its platform logs record each request’s IP address, browser and page address.
• Twilio — sends and receives our texts, sends verification codes, checks owners’ numbers (Lookup) and, where it is switched on, connects private calls. It keeps its own records of messages and calls, including their content and the numbers involved.
• Upstash — our abuse-prevention store. It holds short-lived counters and a phone-check cache, filed only under one-way hashes; our sub-processors page lists every kind.
• Cloudflare — the bot check on the find-a-tag form and on the alert form of tags that are not set up for a person. It receives the visitor’s IP address and the browser signals it uses to tell people from bots.
• Sentry — error monitoring. Emails, phone numbers and known medical form fields are removed before a report leaves our systems. A medical note that appears only as unstructured text in an error message is not reliably matched and may still reach Sentry in the United States.
• PostHog — analytics, only if you accept them. It never runs on the pages a person scanning a tag uses, or on the secure alert page and the invitation page an emergency contact opens.
• Shopify — runs the checkout when you buy tags.

Google receives information only if you choose Google sign-in, or if someone opens a map link in an alert.

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All the above categories exclude text messaging originator opt-in data and consent; this information won’t be shared with any third parties.

We may disclose information if the law requires it; our Law-Enforcement Guidelines explain what we require and how little we hold. If TyraTag is reorganized, merged or sold, the information may pass to the organization that continues the service, which must protect it as this policy describes.

TyraTag is run from Canada, but most of the providers that store and process your information do so in the United States:

• our database and sign-in service (Supabase) is hosted in Northern Virginia;
• the servers that run the app (Vercel) are near Washington, D.C., and requests reach them through Vercel’s worldwide network;
• texts, verification codes, number checks and calls (Twilio), error reports (Sentry) and analytics, if you accept them (PostHog), are processed in the United States.

Upstash, which holds our short-lived hashed counters, and Cloudflare, which runs our bot check on its worldwide network, may also process information outside Canada.

While your information is in the United States, U.S. law applies to it, and U.S. authorities can require these providers to disclose it through lawful-access requests, which can happen without our knowledge. We encrypt the most sensitive fields ourselves (section 9). When you create an account we ask you to confirm you have been shown this notice, and we record that you were.

We keep information only while it is needed. Automatic jobs run once a day, starting at 03:00 UTC, and remove whatever has passed its time limit, so an item can outlast its limit by up to a day.

Your account and emergency profile: kept while your account is open. When you ask us to delete your account, we schedule the deletion for 30 days later; until then everything keeps working and you can cancel from your settings. After that, the daily job erases your account and everything it owns — your tags, medical details, emergency contacts, scan history, alerts and notification records. Deleting your account permanently disables every TyraTag you own.

• Scan records (which tag, when, which screen, whether medical details were shown): kept as your access history until your account is deleted. The device fingerprint hash on a scan record is cleared after 30 days.
• Emergency contacts who were removed, declined or opted out: erased 30 days later. A STOP opt-out itself is kept (below).
• Alerts and conversations — the reason, any shared location, the messages, who responded, call details and a caller’s number: deleted 30 days after the alert began.
• Notification records and delivery receipts (when we texted you or a contact, which message, whether it was delivered): kept until your account is deleted. They hold no phone numbers; the fields reserved for a masked relay number are cleared after 30 days.
• Cost records (what each text, code or call cost us, by tag): kept until your account is deleted, except the cost of verification codes, which is deleted after 90 days.
• Records of START replies (the message ID and when it arrived, nothing else): kept, so an old reply can never be replayed to undo a STOP.
• Hourly activity counts, which contain no personal information: deleted after 14 days.
• Abuse-prevention records in our database: our allow-or-block decisions are deleted after 30 days; time-limited bans are deleted when they expire; blocks placed by an owner, and permanent bans, are kept until we remove them.
• Short-lived abuse counters in our abuse-prevention store delete themselves within about 30 minutes, except the limit on verification codes for a private call, which lasts about 48 hours; a phone-check result is kept for 7 days; daily spending counters are deleted 26 hours after their last update.
• Unfinished setups (section 2): deleted 7 days after the last step, and never kept more than 30 days.
• Order records (Shopify’s order number and how many tags were bought): kept, including after your account is deleted.
• Records we keep as evidence: consent records (what was agreed or declined, and when); STOP opt-outs, until the person replies START; tamper-evident logs of medical-detail displays and of actions in our admin tools, which contain no medical information; counts of failed attempts to link a tag, by account; privacy requests and how we answered them; and our breach register, for at least 24 months as PIPEDA requires. These survive account deletion because they are the record of what happened.
• Copies held by our providers: Sentry keeps error reports for 30 days. Vercel’s platform logs, Twilio’s message and call records, our sign-in provider’s sign-in log, PostHog analytics and Cloudflare’s bot-check data are kept under each provider’s own retention settings. Deleted information can also remain in our database provider’s encrypted backups until those backups expire on their own schedule.

We do not keep a location history. A location exists in our records only when someone at the scene chose to share it, and it is deleted with the alert.

• Encrypted in transit everywhere, and encrypted at rest by our database provider.
• Encrypted again by us before storage: every phone number we hold (yours, your contacts’ and a caller’s), medical details, and conversation messages. We use AES-256-GCM with a separate key for every value; those keys are themselves encrypted with a master key that only our servers hold, and each value is bound to its own record so it cannot be moved to another. Names, tag names and car details are not encrypted this way; they are protected by the database’s access rules.
• Access is denied by default. Our database refuses every request it has not been told to allow. People without an account reach only what their secure link opens, and those links expire.
• The least possible disclosure to the person at the scene: medical details only on a tag set up for a person, only on the emergency screen, and only with the owner’s consent.
• Staff access. We do not read conversations in the normal course of running the service. When a conversation is reported, our review list shows only that it was reported and when, never its messages.
• Tamper-evident logs record displays of medical details (with the limit described in section 3) and actions in our admin tools.
• Error reports are scrubbed of emails, phone numbers and known medical form fields before they leave our systems. The filter matches common patterns and field names; a medical note that appears only as unstructured text in an error message can miss. It does not cover our hosting provider’s own request and application logs, which record standard technical details such as IP address, browser and page address, plus whatever an error message happens to contain.
• Abuse controls — rate limits, bot checks and a daily cap on telephone spending — limit how the service can be misused.

If personal information under our control is lost, accessed or disclosed without authorization, and we judge that it creates a real risk of significant harm to you, we will report it to the Office of the Privacy Commissioner of Canada and notify you directly, as soon as feasible. We will also tell any other organization that could reduce the harm. We keep a record of every breach, including ones that do not meet that threshold, for at least 24 months.

You may access the personal information we hold about you, correct it, delete it, withdraw consent, and ask how it is handled.

If you have an account, two of these you can do yourself. You can download a copy of your account data from your settings at any time: your account details, consent history, tags, emergency contacts, medical details, and your tags’ scan and notification history. And you can delete your account from the same place. Withdrawing consent and deleting are not the same thing for medical details, and section 2 explains the difference.

You do not need an account to use these rights. If you scanned a tag or are someone’s emergency contact, email us. Because we keep so little that identifies you, we may need details from you — such as the tag, roughly when, or your phone number — to find what we hold.

For anything else, email support@tyratag.com. If you have an account, write from its email address: we check requests against the account you already have and never make you create a new one. We respond within 30 days. If a request needs longer we will tell you before that deadline, and why. Consumer health data requests run on a different clock, described in our Consumer Health Data Privacy Policy.

You may complain to the Office of the Privacy Commissioner of Canada at any time, and you do not have to come to us first. Our privacy officer can be reached at the address above.

TyraTag Inc. is a Canadian company. If you use TyraTag from the United States, this policy applies to you exactly as written, and your information is stored and processed in the United States (section 7).

Your rights. You have the rights in section 11 wherever you live: to confirm whether we hold information about you and to access it, to correct and delete it, to withdraw consent, and to get a copy in a format you can reuse. The download in your settings gives you your account data as a standard data file right away; email us for a copy of anything else we hold about you, such as alerts and conversations. You also have the right to opt out of the sale of your information, targeted advertising and profiling, though we do none of these. The same goes for any other right your state gives you, such as a list of who bought your information or a review of a decision made by profiling: we do neither, so there is nothing to list or review, but you can still ask.

What we never do. We do not sell personal information, use it for targeted advertising, or use it for profiling that produces legal or similarly significant effects. We do not use it to train large language models or any other AI model, and we do not sell or share it for that purpose. So there is nothing to opt out of, and you are covered whether or not your browser sends an opt-out signal such as Global Privacy Control. You, or an agent you authorize, can still email us an opt-out request. If we ever plan to sell personal information or use it for targeted advertising, we will update this policy and add an opt-out link to our website before we start.

Sensitive information. Medical details are sensitive information, and we process them only with your opt-in consent (section 2). Our Consumer Health Data Privacy Policy covers them in more detail, including for Washington, Nevada and Connecticut. Two other things count as sensitive, and we take each only by choice: a location someone at the scene taps to share (section 3), and details a parent or guardian gives us about a child (section 13).

Appeals. If we decline a privacy request, we tell you why. To appeal, reply to our decision with “Appeal” in the subject line; we answer in writing within 45 days. If we deny your appeal, you can contact your state’s Attorney General (in Connecticut, the Attorney General’s complaint form, choosing “Consumer Data Privacy”).

Text messages. Our SMS & Messaging Terms explain what we text, how you opted in, and how to stop.

You must be 18 or older to hold a TyraTag account, and we do not knowingly collect personal information from anyone under 18 as an account holder. A parent or guardian may set up a tag for a child in their care and provides consent on the child’s behalf.

We will post any change here and update the date at the top. If a change materially affects how we handle sensitive information, we will tell account holders directly. If we make a material change that would apply to information we already hold, we will email account holders before it applies, including what it changes about what we collect from then on, and give them a reasonable chance to withdraw consent to any materially different collection, processing or transfer of that information, or to delete their account. For people we cannot email, such as an emergency contact or someone who scanned a tag, we will not apply such a change to them at all unless they agree to it first.