Effective: 26 September 2026
This policy covers haptic-pulse.com and the Garmin apps and watch faces I develop under Haptic-Pulse, including Haptic Pulse, Prestage, Prestage Face, TapStage, enough and its companion watch faces, and other Haptic-Pulse products that link to this policy. Only the sections relevant to the features you use apply.
Who is responsible?
I am Herman Tagger, the sole independent developer behind Haptic-Pulse. This is my hobby project; Haptic-Pulse is a project name, not a separate company. I am responsible for personal information processed through the website, support and optional online services described here.
Postal address: Herman Tagger, Stenflisgränd 6, Viken, Sweden.
Email: info@haptic-pulse.com
Most app features work locally
Local app features do not create an online account with me or send me your settings, health readings, routines, reviews or local game history. The apps contain no advertising or third-party analytics SDKs. TapStage’s optional Ranked service is the exception for online game data, explained below. Website analytics is separate from the apps.
- Haptic Pulse and rhythm tools: settings, selected patterns and custom rhythm timings are stored on your watch. Where a feature offers adaptive heart-rate pacing or a heart-rate/stress display, available readings are processed on the watch during use and are not uploaded to me.
- Prestage: routine and mode choices, ready words, practice focus, stage counts, progress, timestamps, optional reviews, history and reminder preferences stay on your watch. Tune in briefly uses available heart-rate readings in memory to set its pace; those readings are not saved in review history or sent to me.
- Prestage Face: selected fields can use time, units, steps, recent heart rate, battery and Garmin weather. Weather’s observation location can be used to calculate sunset. The face does not start GPS or send these readings to me.
- enough, its companion faces and reminder tools: preferences, local reminder schedules, progress or history needed by the selected tool are stored on the watch. The simple watch faces use time, date and display preferences. They do not send a usage history to me.
- TapStage local play: practice, matches, target settings, tap reviews and records remain on your watch. TapStage does not request your location, health readings, contacts or public Garmin identity.
You control the permissions and features available through Garmin. Unavailable sensor data may limit a feature or cause it to use its documented fallback. Using a sensor locally does not give me access to that sensor’s readings.
Optional connection between Prestage and Prestage Face
On supported watches, a private Garmin connection can share the latest mode, ready words, focus, stage counts and a timestamp between the products on the same watch. It contains no heart rate, location, review answers or personal identifier. Sharing is enabled by default in Prestage and can be disabled under Watchface connection. The face can separately stop using shared content or hide cues; ready words are hidden by default. This connection needs no developer account or internet connection.
Local storage and your controls
Settings remain until changed, reset or removed using Garmin’s controls. Some apps keep bounded history and retire older entries; some totals may remain as aggregates. In Prestage, History & data → Clear history removes past records and lifetime totals while preserving the current match and unfinished practice, as the confirmation explains. The face does not build a history of shared snapshots.
Each app has separate storage. Uninstall each product whose local data you want removed. Garmin controls cached publications, synchronisation and platform backups. I cannot remotely retrieve or delete watch-local records that have never been sent to me.
TapStage: optional Ranked play
You can play locally without an online profile. Linking a watch creates a random player ID and a watch access credential. You choose a public nickname and receive a private recovery code. The server stores cryptographic hashes of access credentials and recovery codes, rather than their readable values. The watch stores its credential locally. Keep your recovery code private.
For a Ranked attempt, the service receives its one-time challenge ID, course and ruleset, app version, watch model and screen dimensions, screen start times, and tap times and coordinates within the game. It calculates the score independently. It also retains attempt/submission times and status, validation results, moderation status and a temporary fingerprint used to detect repeated tap traces. This is gameplay validation, not biometric identification, and the trace is not used to recognise you outside TapStage.
Public results show your nickname, rank where applicable, factor, points, time and course. Achievement boards may also show the number of misses and No-tap hits. All supported watches currently share the same leaderboard. They do not expose your player ID, access credential, recovery code, raw tap trace or IP address. Choose a nickname that does not identify you if you prefer. Public results may be copied or indexed by others. Completed daily and weekly results remain available in a dated results archive under the same retention, moderation and deletion rules as current results. This is separate from the optional frozen beta tribute.
Timing, coordinate, version and pattern checks may reject invalid attempts or hide suspicious results for review. These checks cannot prove that every run came from an unmodified watch. They affect only game results, not decisions about your health, employment, finances or other legal entitlements. Email me to request human review, appeal a result or report an inappropriate name. Names and scores can be hidden, corrected or removed.
TapStage: private friend challenges
Friend challenges use the same linked profile and server-verified game data as Ranked play. I store the invitation code, the two participant IDs, selected match length, creation and acceptance times, expiry time, each one-time attempt and its validated result. A person with an invitation link can see the creator’s public nickname and match length and may accept the remaining place. The link does not provide access to either player’s profile, recovery code or watch credential.
Challenge results are visible to their two participants and to me for service administration and moderation. Your opponent’s score is shown only after both runs are complete and eligible. These scores do not enter public leaderboards or the optional beta tribute. Sharing an invitation is your choice and uses the messaging service you select; TapStage does not access Garmin Messenger contacts or send messages for you.
Unused invitations expire after seven days. Accepted challenges close 48 hours after acceptance. Challenge records and results are removed after 90 days from closing or invitation expiry, during routine cleanup. Raw tap traces follow the shorter retention periods below. Deleting either profile removes the shared challenge; remaining associated challenge data is removed during routine cleanup. Providing this data is necessary for the private challenge service you request, on the same service-agreement basis as Ranked play. Local tutorial progress and achievements remain on your watch.
Classifier calibration and the optional beta tribute
Verified results across completed classifier sets help calibrate provisional levels from D-Tapper to Grand-Tapper. Analysis uses aggregate statistics across eligible players; results are not sold or used for advertising.
You may separately opt into a planned frozen beta tribute containing your public nickname and best eligible results. Consent is off by default and is not required to play Ranked. You can change your choice or withdraw later in My profile. The archive may stop accepting new results while still allowing privacy and moderation removals.
Website hosting, email and cookies
STRATO supplies website/database hosting and domain/email infrastructure. Hosting systems process connection data such as IP addresses, requested pages and browser information to deliver the service and prevent abuse. STRATO states that IP addresses used to detect and prevent attacks are retained for up to seven days. See STRATO’s hosting data-protection information.
TapStage uses a necessary secure session cookie for sign-in and form protection. Sign-in expires after 30 minutes of inactivity. WordPress also uses necessary cookies when an administrator signs in. These are not advertising cookies. TapStage’s separate pages and API do not load Independent Analytics, advertising, remotely hosted fonts or third-party tracking scripts.
Website analytics
The WordPress pages use Independent Analytics, hosted in this website’s database, to understand visits and improve the site. Records include page views, visitor/session counts, referrers, approximate location, general browser/device information and a derived visitor identifier. The plugin briefly processes the IP address to estimate location and combines it with browser information and a salt to produce a one-way hashed identifier. Original IP addresses are not stored in those analytics records; analytics cookies are not used.
The identifier salt is refreshed daily, limiting recognition through that identifier to no more than 24 hours. This does not by itself delete historical analytics. The optional vendor data-sharing programme is disabled, and the analytics database is not sent to an external analytics provider. It receives no health readings, routines or tap traces from the apps. See Independent Analytics’ explanation of daily salt refreshing.
Support and purchases
If you email me, I receive your address, message and any attachments you choose to send. I use them to answer the request, investigate problems and provide support. Send only what is relevant; health details, precise location and private recovery/access codes are not needed. Public feedback or reviews you choose to post on Garmin may also be visible to me under that platform’s terms.
Garmin and its payment providers handle native Connect IQ purchases. I do not collect payment-card details through these apps or this website. Garmin may supply sales, transaction and payout reports used for purchase-related support, accounting and legal obligations. These reports are separate from watch-local data.
Purposes and legal bases
- Requested online functionality and purchase-related support: linking, verified Ranked results, profile tools and support needed to provide a service you request rely on performance of the service agreement (GDPR Article 6(1)(b)). Providing the required gameplay data is necessary for Ranked; local play remains available without it.
- Security and fair play: limited logs, rate limits, validation and moderation rely on legitimate interests in preventing abuse and maintaining a reliable service (Article 6(1)(f)).
- Product improvement, general enquiries and limited website measurement: aggregate classifier calibration, responding to messages and cookieless first-party analytics rely on legitimate interests in improving and supporting these hobby projects (Article 6(1)(f)). I minimise the information used and do not use it for advertising or cross-site profiling. You may object to this processing.
- Optional beta tribute: your separate consent (Article 6(1)(a)). Withdrawal does not affect processing that was lawful before withdrawal.
- Required records and rights requests: applicable accounting duties and responding to data-protection requests rely on legal obligations (Article 6(1)(c)).
Retention
- Local app information: until changed, reset, retired by the app’s documented history limits, or removed with the app using Garmin’s controls.
- Watch linking: unused pairing codes expire after 15 minutes; unclaimed device records are removed after a further day.
- Ranked attempts: daily and weekly matches must be completed and synced within one hour of starting and before the event closes. Other Ranked submissions expire after one hour. Limited attempt records remain to prevent reuse. Ordinary raw tap traces and fingerprints are erased after 30 days; flagged traces may remain for up to 90 days for review. Score, course, version and moderation metadata remain with the result.
- Online profiles and scores: while you use the service, unless you delete them or a beta reset removes them. Profiles with no new attempt, score or watch link for 12 months are removed, except where needed for an opted-in beta tribute.
- Beta tribute: while the archive is offered, until consent is withdrawn or deletion is requested.
- Rate limits: keyed hashed identifiers expire within the applicable window, at most one day. Routine expiry cleanup runs on service requests, so expired records may be erased on the next request.
- Website analytics: retained for comparing site-use trends while needed for that purpose. Historical records are reviewed at least annually and deleted or reduced to anonymous totals when no longer needed; daily salt changes do not erase the historical records.
- Support messages: normally up to 24 months after the last relevant exchange, unless a continuing issue, dispute or legal obligation requires longer. Required accounting records are kept for the applicable statutory period.
- Restricted recovery backups: retained while needed for rollback or recovery, reviewed after deployments and at least monthly. Deleted information may remain temporarily in such copies, but is not used for ordinary service access. Deletion requests must be reapplied before a restored backup is put into service.
Recipients, location and security
I access information only as needed to operate and support the products. STRATO processes hosted website, leaderboard and email information for these services; its hosting guidance describes German data centres. Independent Analytics runs within the WordPress installation. Information may be disclosed where required by law or necessary to establish or defend a legal claim. I do not sell personal information or provide it to advertising networks.
Garmin operates its own device, account, connectivity, weather, store and payment services under Garmin’s privacy policies, including its arrangements for international processing. Email sent over the internet also passes through your chosen email provider. Following an external link makes that provider’s policy relevant. I do not instruct a separate non-EEA analytics service to receive these website analytics or Ranked traces. If my own processing arrangements introduce a transfer outside the EEA, I will identify it here and use an applicable GDPR transfer mechanism.
Online communication uses HTTPS. Credentials are hashed on the server, administrative functions are separated from the public API, and access to configuration and backups is restricted. No online system can guarantee absolute security.
Your choices and rights
You can use local app features without linking to TapStage. In My profile, your recovery code lets you download your online information, change archive permission or delete your profile and results. Deletion revokes linked-watch access; it does not erase watch-local history.
You may request access, correction, deletion, restriction or portability where applicable, object to processing based on legitimate interests, or withdraw consent. Contact info@haptic-pulse.com or write to the postal address above. I may ask for proportionate evidence that you control the profile; please do not send an identity document unless a specific need has been explained. Requests are normally handled within one month. If an allowed extension is needed because of complexity or volume, I will explain it within that month.
You may complain to Integritetsskyddsmyndigheten (IMY), Sweden’s data-protection authority, or another competent supervisory authority. Garmin controls requests about its own account and platform data. I cannot supply local records I have never received.
Policy changes
TapStage is a public beta for testing. Scores and leaderboards may be reset, and the app will become paid after testing, with details announced separately. Device compatibility and features may change during testing. Material privacy changes will be published here with a new effective date before new processing begins. A new purpose requiring consent will be presented separately.