Privacy Policy

10FORTY3 GROUP operates TyraTag. For any privacy question or request, contact support@tyratag.com.

Account information you give us: your name, email, and mobile number.

Emergency profile you build: the names and phone numbers of the emergency contacts you choose, and optional information about you.

Sensitive information (only if you choose to add it): blood type, allergies, medical conditions, medications, and free-text notes. You are never required to provide this. You add it only by explicit opt-in.

Scan events:when your tag is scanned we log the time, coarse location (only if the scanner’s device permits it), and basic device/browser metadata, so the tag works and so we can detect abuse.

Finder information: if someone who scans your tag chooses to leave a callback number or message, we process it to relay it to you.

Payment:handled on Shopify’s secure checkout when you buy a tag. Shopify processes the purchase and returns an order confirmation; we never see or store your full card number.

• Field-level encryption. Medical fields and contact phone numbers are stored as ciphertext only (AES-256-GCM), never as readable text, at rest.
• Encrypted in transit everywhere.
• Progressive disclosure. A person who scans your tag sees only the minimum. Your medical and critical details are revealed only in a genuine emergency branch, only when you have consented, never in the everyday parked-vehicle flow.
• Data minimization. Location pings, verification logs, and any call audio are kept only briefly and then auto-purged. Photos you upload are stripped of embedded location/EXIF data.
• Logs are scrubbed of emails and phone numbers before they leave our systems.

To operate your tag; to notify your emergency contacts when your tag is scanned; to show a finder or first responder the information you chose to share; to manage your account and process payment; to prevent abuse and fraud; and to meet legal obligations. We do not sell your personal information.

We rely on your consent. For sensitive (medical) information we require your express, opt-in consent, given separately from account creation. You can withdraw consent or delete any field at any time. Withdrawing consent for medical fields removes them; your tag continues to run the core emergency-notification rail.

We share the minimum necessary with the service providers that run TyraTag: Twilio (to send the SMS/OTP), Supabase and Vercel (to host the app and database), Shopify (to run the checkout when you buy a tag), Upstash (a rate-limit store that sees only hashed request keys, to prevent abuse), Sentry (to monitor errors, with personal data scrubbed), and PostHog (privacy-friendly product analytics, only if you opt in; usage data is stored in the United States, and never includes your medical or contact details or anything from a tag-scan page). Each acts on our instructions. In a genuine emergency, the emergency contacts and finder you have configured see the information you chose to make visible. We may disclose information if required by law.

Some providers process data outside Canada, primarily in the United States. By using TyraTag you understand your information may be stored or processed in the U.S. and may be accessible to U.S. authorities under U.S. law. We use providers that offer contractual and technical safeguards.

Account and profile data: while your account is active, and for a limited period after deletion to meet legal and accounting needs, then purged. Scan logs and location pings: short retention, then auto-purged. Verification/OTP logs: short-lived.

You may access, correct, or delete your information, withdraw consent, and ask how it is handled, by emailing support@tyratag.com. You may complain to the Office of the Privacy Commissioner of Canada. Our privacy officer can be reached at the same address.

TyraTag is not directed to children under the age of majority as an account holder. A tag configured for a minor is managed by a parent or guardian, who provides consent on the child’s behalf.

We will post any change here and update the last-updated date. Material changes affecting sensitive data will be notified to you.