Last updated September 30, 2026.
The short version
We use Google Analytics to see which parts of the site people find useful, and it sets cookies to do that. Beyond that we run no advertising trackers and no social media pixels, and we do not sell anything here, so we never see a card number. Our mailing-list emails do carry a hidden image that tells us an email was opened — there is a plain explanation of that below, including how to stop it. If you fill in one of our forms we keep what you typed, because we need it to reply to you. If you join our mailing list we keep your email address until you leave — one email a week, sometimes a second, and leaving is one click in any email we send.
We know some of our customers would rather the internet did not keep a record of where they drink. We have built the site that way on purpose.
When you are just looking at the site
Google Analytics sets cookies. They let Google tell a returning visitor from a new one and follow which pages get looked at in a visit. We see the totals — how many people, which pages, roughly where in the world — never a name, and never a way to point at a row and say that was you.
The one other thing this site stores in your browser is a note that you closed the announcement banner, so it does not reappear on every page. That note never leaves your device and we cannot see it.
Like every website, our server records the requests it receives: your IP address, the time, the page you asked for and which browser you used. These logs exist so we can fix faults and block attacks. They are deleted automatically after about ten days.
Cloudflare sits in front of our site to keep it fast and to absorb attacks, so it also sees those requests. Cloudflare handles that data under its own privacy policy.
To understand which parts of the site people find useful, we read back counts from Cloudflare — how many times a page was requested, and a rough split of countries and devices. There is no script on this website doing that, nothing is tied to you as an individual, and we do not store visitors’ IP addresses for it.
Google Analytics means your visit is also recorded by Google, under Google’s privacy policy rather than ours. We have not switched on its advertising features, so we are not building audiences for ads or matching you across other websites — but we should be straight with you that the data reaches Google either way.
If you would rather not be counted, you do not have to be. Google publishes a browser add-on that switches Google Analytics off everywhere at once, and most browsers can block these cookies on their own. Nothing on this site stops working if you do. We would rather you visited on your own terms than showed up in a chart.
There is no advertising pixel here and no social media tracker. Our fonts are served from our own server rather than fetched from a third party.
When you use our contact form
We collect what you type: what your message is about, your name, your email address, a phone number if you give one, and your message. We also record the IP address the message came from, which helps us deal with spam.
That message is saved on our own server and emailed to whoever at the bar needs to answer it. The email is delivered through Amazon Simple Email Service, so it passes through Amazon’s systems on the way.
When you send us photos
We collect your name, your email address, the photos themselves and any caption you write. We also keep a record of exactly what you agreed to and when, so that if a photo of yours is shown anywhere there is no confusion about permission. As with the contact form, we record the IP address it came from.
We remove the hidden location data from every photo before it goes anywhere. Phones quietly record the GPS coordinates of where a picture was taken and bury them inside the file. A photo taken in a gay bar therefore carries the coordinates of a gay bar, and anyone who downloads that file can read them. We strip that out — along with the camera’s serial number and timestamps — the moment a photo is uploaded, and it never reaches the public site.
Nothing you send is published automatically. Someone at the bar looks at every submission first.
A photo you send us may appear in three places: on this website, on our own social media, and on the screens inside the bar. The consent box on the form names all three, so you know what you are agreeing to before you agree to it.
When you join our mailing list
We send one email a week listing what is on at the bar, and now and then a second one — a one-off show worth turning up for, or an offer good for a single night. That is the most you will ever get from us, and it is all your address is ever used for. We do not sell your address, we do not share it, and we do not advertise anything that is not happening here.
You have to say yes twice. Filling in the form does not put you on anything. We send one email with a link in it, and you are only on the list once you click that link. If you never click it, we delete the address within thirty days. This is deliberate: it means a stranger cannot put someone else’s address on our list, which for a bar like ours matters more than it might elsewhere.
There is one other way on, and it involves a person. If you ask someone at the bar — in person, by phone or by email — a manager can add you directly, without the confirmation link. Some people simply cannot get on with clicking a link in an email, and being told to go and find one is not a good answer to “put me on your list”. When that happens we record who added you and that you asked in person, because that record is the permission. Nobody is added this way unless they asked a member of staff themselves.
We keep your email address, your name if you gave us one, and the date, time and IP address of the moment you signed up. That last part is not tracking and we do not use it for anything else — it is the record that you asked, and it is the only evidence we would have if anyone ever questioned whether you did.
Leaving takes one click. Every email has an unsubscribe link, it works immediately, and there is nothing to fill in. Your email program may show its own unsubscribe button as well; that one works too.
We can see whether an email was opened, and which links were followed. Every email we send carries a single transparent image, one pixel across. When your email program loads that image, Amazon tells us the message was opened, and if you follow a link in the email we are told which link it was. It is tied to your address rather than counted anonymously — we can see that a particular subscriber opened a particular email.
We use it for one thing: working out whether what we sent was worth sending. It decides what goes in the next email, and nothing else. It is not used to build a profile of you, it is never combined with anything else we hold, it is not shared, and it has no bearing on how you are treated in the bar.
It is also not very accurate, and we would rather say so. Apple Mail loads that image automatically for everybody, whether or not a person ever looked at the message, so our “opened” figure counts people who never read it. We treat it as a rough way of comparing one of our emails against the next, not as a count of readers.
If you would rather not be counted: set your email program not to load images automatically. Most can, many already do, and our emails read perfectly well without them — the image never loads, so nothing is recorded. Not clicking a link means no click is recorded. And unsubscribing stops all of it at once.
Text messages (staff only)
If you work at Tap That and choose to get shift texts, we use your mobile number only to send you messages about your own schedule. We do not sell, rent or share mobile numbers or text-message opt-in data with third parties or affiliates for marketing or promotional purposes. Your number is shared only with our messaging provider, Amazon Web Services, to deliver those messages. Reply STOP to any text to stop them, or HELP for help. Your number is deleted when you stop working here. Texts are only for staff aged 21 or over: to turn them on you give your date of birth, which we keep as the record that you are old enough and delete, with your number, when you stop working here.
Spam protection on our forms
Both forms are protected by Cloudflare Turnstile, which works out whether you are a person or a bot. It sends your IP address and a one-time token to Cloudflare to make that judgement. It does not set a tracking cookie and it does not build a profile of you across other websites.
Who else can see any of this
- Cloudflare — sits in front of the site, so it sees requests, and it runs the spam check on our forms.
- Amazon Web Services — delivers the emails our forms generate, and the mailing list itself. Amazon also handles the open and click measurement described above, and reports it back to us.
- Our hosting provider — runs the server the site lives on.
- Google — Search Console tells us which search terms lead people to us, which is Google reporting on its own results. Google Analytics is the other direction: it sends Google a record of your visit to this site.
- Meta — our Facebook and Instagram pages are Meta’s. When we post about a night, or share a photo you sent us and agreed we could share, it goes to Meta to publish.
- Anthropic — after a photo you sent us has been approved for the gallery, we may send a smaller copy of it to Anthropic’s AI service to draft a short text description for people who use screen readers. The draft never names anyone or says who they are, and a person at the bar reads it before it is used. Anthropic handles it under its own commercial terms. We also use the same service to draft wording about our events, which contains nothing about you.
If you tap “Get directions” or “Add to Google Calendar”, you are leaving our site for Google, and what happens there is covered by Google’s privacy policy rather than ours.
What we never do
- We never sell or rent your information, to anyone, for any price.
- We never share it with advertisers or data brokers.
- We do not build a profile of you ourselves, and we have not enabled Google Analytics’ advertising features. What Google does with what it collects is governed by Google, not by us, and we will not pretend otherwise.
- We do not take payments on this website, so we never hold card details.
How long we keep things
- Server logs — about ten days, then deleted automatically.
- Google Analytics — kept by Google on its own schedule, currently 14 months, and governed by Google’s terms rather than ours.
- Contact form messages — deleted automatically 24 months after you send them.
- What our emails did — whether a message was delivered, opened or clicked is kept for twelve months and then deleted automatically. Long enough to compare this year’s Pride with last year’s; not a permanent record of your reading habits.
- Mailing list — your address stays while you are subscribed. If you never confirm, it is deleted within thirty days. If you unsubscribe, we keep the address on a do-not-email list and nothing else, so that we can be certain we never mail you again by mistake — unless you tell us to erase it, which you can do with a box on the unsubscribe page.
- Photo submissions — deleted automatically after 24 months, along with any photos we did not use. The one exception: if a photo of yours is still being shown, we keep the record of your permission for as long as it is up, because that record is the proof you agreed to it. Take the photo down and the record goes too.
None of that depends on anyone remembering to do it. The site deletes expired records by itself, every night.
Asking us to delete your information
Just ask. Use our privacy request form, or call the bar on (954) 990-7422, and tell us what you sent and roughly when. We will delete it and confirm that we have, normally within a few days and always within 30. You do not have to give a reason.
For the mailing list there is a faster route, and a choice. Unsubscribing takes you off the list immediately, and we keep your address on a do-not-email list so we cannot mail you again by accident. If you would rather we held nothing at all, tick Forget me completely on the unsubscribe page and the record is deleted outright. The trade-off is real and worth knowing: once it is gone we have no record that you ever left, so if the address were entered again we would have nothing to check it against.
If you would rather a photo of you came down, the same applies — ask and it comes down, from the website and from the screens in the bar alike. You do not need to have been the person who submitted it.
One honest note: asking us to delete something means sending us a message, and that message is itself a record with your name and email on it. We keep it only until we have dealt with your request and confirmed it back to you, and then it goes too.
Age
Tap That is a bar, and this website is meant for adults. We do not knowingly collect information from children. If you believe a child has sent us something, tell us and we will delete it.
Changes to this policy
If we change how any of this works, we will change this page and update the date at the top. We will not start collecting something new and quietly leave this page as it was.
Questions
Ask us through our privacy request form or call (954) 990-7422. Tap That, 2240 Wilton Dr, Wilton Manors, FL 33305.