FAQ
Everything you need to know about TapTheMap, from getting started to data security.
General
TapTheMap is an NFC-powered venue wayfinding platform. Visitors tap an NFC sticker or scan a QR code at your venue, and your custom interactive map opens instantly in their phone's browser. No app download required. No account creation. No personal data collected.
Museums, resorts, convention centers, universities, hospitals, stadiums, historic towns, and any venue where visitors need to find their way around. TapTheMap works for both permanent venues and temporary events.
No. TapTheMap is a Progressive Web App (PWA). It opens in the visitor's mobile browser. There is nothing to install, no login required, and no account to create.
Yes. TapTheMap uses a service worker to cache your venue map and data after the first load. Visitors can continue to use the map even when cellular signal is weak or unavailable.
Setup & Maps
You need one map image of your venue (PNG preferred, JPG or PDF accepted) and a list of points of interest you want visitors to find. TapTheMap handles everything else: hosting, NFC sticker programming, QR codes, and the interactive map viewer.
PNG (preferred), JPEG, and PDF. Files must be under 5 MB. Recommended dimensions are 2400 by 1800 pixels in landscape orientation. Every uploaded file is validated at the binary level to verify it matches the declared format.
Yes. Upload a new map from the admin dashboard at any time. TapTheMap automatically archives the previous version. You can keep up to 12 archived versions and restore any of them with one click. An email notification is sent to the venue contact when a map is changed.
We do not create maps directly, but we provide guidance on getting one made. Visit our Get Your Map Started page for five options, from free DIY approaches to working with a freelance artist.
Security & Privacy
No. TapTheMap collects zero personal data from visitors. No names, no email addresses, no phone numbers, no device identifiers, no GPS coordinates, and no tracking cookies. We use cookieless, privacy-first analytics (Plausible and Umami) that measure only aggregate page views and scan sources.
Every uploaded map goes through five layers of security: magic-byte file validation (verifies the file is what it claims to be), dangerous content scanning (blocks disguised scripts or HTML), SHA-256 integrity hashing (detects tampering), size and dimension limits, and email notification to the venue contact when any map change occurs. Previous versions are archived automatically.
Only users you authorize. TapTheMap uses a six-tier role-based access control system. Each user is assigned a role (Viewer through Super Admin) and can only see venues they have been assigned to. An admin for one venue cannot access another venue's data. All logins and permission changes are recorded in an audit log.
Yes. All connections use HTTPS with TLS encryption. HTTP requests are permanently redirected to HTTPS. HSTS headers instruct browsers to always use the secure connection. Let's Encrypt certificates are used and renewed automatically.
All passwords are hashed with bcrypt at a cost factor of 12. Passwords are never stored in plain text and cannot be recovered. If a password is lost, the user can reset it via a time-limited email link. Failed login attempts are rate-limited to 5 per 15 minutes to prevent brute-force attacks.
TapTheMap collects no personal data from visitors and uses cookieless analytics tools that are GDPR and CCPA compliant by design. Admin user data (username and email for password resets) is stored in an encrypted database and is never shared with third parties. For a detailed overview, visit our Security & Data Protection page.
Yes. The production server runs automated weekly backups using AES-256-CBC encryption. Backups include venue configurations, maps, and database snapshots. Map uploads are also archived individually, with 12 versions retained per venue.
NFC & QR
Yes. TapTheMap uses NTAG 213 NFC tags, which are read-only data carriers. They contain a single URL that points to your venue's map page. An NFC tag cannot install software, access the phone's data, or run code on the visitor's device. The visitor's phone shows them the URL before opening it. For more details, visit our NFC Safety page.
No. NFC stickers are passive. They do not record who tapped them or when. TapTheMap's analytics track only aggregate scan counts (how many NFC taps versus QR scans per venue). No individual visitor can be identified.
Every TapTheMap sticker includes both an NFC chip and a QR code. If a visitor's phone does not support NFC (or if the NFC reader is disabled), they can scan the QR code with their camera app instead. The result is identical.
Pricing
Visit our Pricing page for current plans. The Starter Plus bundle starts at $49 per month. Founding Venues receive 25% off with a three-year rate lock at $37 per month. All plans include hosting, analytics, and NFC sticker support.
Contact us at tapthemap.online/contact for current setup and onboarding details. We work with each venue individually to get your map configured and your stickers placed.
The Founding Venues program offers the first 15 venues 25% off the Starter Plus plan with a three-year rate lock. Founding Venues pay $37 per month instead of $49. Spots are limited. Visit tapthemap.online/founding-venues for details.