How we look after your account and your visitors
The plain facts about what we do today. If something you need is not on this page, ask us at support@chowtap.co.
We do not keep visitor addresses as they are
When someone scans a code, we scramble their internet address with a secret value and the day's date, so the result changes every day. That lets us count unique visitors without keeping the real address on the scan.
Scan exports show the scrambled value only. You see how many people scanned and roughly where from, not who they are.
Our forms keep out automated spam
Our sign-up, contact and newsletter forms can use Cloudflare's check to keep out automated spam.
Two-step sign-in with an authenticator app
You can turn on two-step sign-in in your account settings. After your password, we ask for a six-digit code from an authenticator app on your phone.
You get recovery codes when you set it up, in case you lose your phone. We do not send codes by text message.
We cannot read your password
- Passwords are stored as a one-way scrambled value (bcrypt). Nobody at ChowTap can read yours.
- A password needs at least 8 characters.
- Too many sign-in attempts in a short time are blocked for a while.
- Your account shows your recent sign-ins, so you can spot one that was not you.
Where your data lives
Your account and scan data is stored with Hetzner in Helsinki, Finland.
Tell us and we will look into it
If you think you have found a security problem in ChowTap, email support@chowtap.co with "Security" in the subject.
- What you found and where you found it
- The steps to see it again
- Screenshots or links if you have them
Please do not open or change anyone else's data while checking, and give us time to fix it before telling others.