Privacy policy

1. Who we are

tucck is run by the independent developer of tucck, an individual based in India (“tucck”, “we”, “us”). Under India’s Digital Personal Data Protection Act, 2023, we are the data fiduciary for the personal data described here. For any question or request about your data, write to support@tucck.app.

2. What you save

Links, notes, screenshots and photos, PDFs and other files, voice notes, tasks, reminders, tags and tucck spaces are your content.

• On Free, your content stays on your phone. It isn’t sent to us, and you can use tucck without an account.
• With Starter, your content is copied to our servers so it syncs to your other phone and opens on tucck web. We use it only to give you the service: syncing, search, thumbnails and exports. To make PDFs searchable, our servers read the text inside them.
• Some things happen only on your phone: reading the text in screenshots (with Google ML Kit, on the device), fetching a link’s title and picture for its preview card, reminders (scheduled on the phone, not sent by us), and tucck locks (your face or fingerprint is checked by Android; we never receive it).
• Contacts: tucck asks to read your contacts only when you tap Contact in “+”, to show the list you pick from. Only the people, numbers and addresses you tick are saved, as a tucck like any other (so with Starter they sync too). tucck never adds to or changes your address book; “Add to contacts” opens Android’s own form.

3. Your account

If you sign in, we keep:

• your email address, and your name if your Google account shares it;
• the devices signed in to your account: a device name, its operating system, when it was last active, and its approximate city and country, worked out from its network address when it pairs, so you can recognise it in your devices list. We don’t keep the network address itself;
• your plan, and settings such as whether usage analytics are on.

Sign-in, including the codes we email you, is handled by Clerk on our behalf. A browser that opens tucck web stays signed in for up to 30 days. You can sign out any device from Account → Devices.

4. Purchases

Starter is bought and billed through Google Play. We never see your card or bank details. Google Play and RevenueCat (which manages subscriptions for us) tell us whether you have Starter, which plan it is, when it renews or ends, and a purchase reference, so we can turn Starter on and keep it in step across your devices.

5. Usage analytics

To learn which parts of tucck help people, the app and tucck web send named events to PostHog, such as “first search done” or “Starter bought”. An event can carry fixed details like the app version, the answers you picked during onboarding, and the ad campaign an install came from (Google Play’s install referrer). Once you sign in, events are linked to your account’s ID.

Events never include what you save: no titles, notes, links, file contents or search text. The code only lets a fixed list of details through. There is no session recording and no advertising ID. This website, tucck.app, sends no analytics at all.

Analytics is off until you say yes: tucck asks once, after you sign in or sign up (“Help make tucck better”). Change it any time in Privacy center → Usage analytics on the phone, or Settings → Privacy on tucck web. It is one setting for your whole account.

6. Crash reports

When tucck crashes or hits an error, a report goes to Sentry so we can fix it: the app version, device model, operating system, and where the error happened. Reports are cleaned before they leave your device or our servers, and never include what you saved, what you searched for, your email address or your network address. Crash reports are off until you say yes, in the same question as analytics, and you can turn them off any time in the same places. Errors on our own servers are reported without any account or device identifier.

7. AI with your own key

AI features are optional and use your own key from Anthropic, OpenAI or Google. Your key is kept on your phone. When you pair a browser, the phone can share the key with tucck web, encrypted so that only that browser can open it. We pass the encrypted copy along and delete it once it’s delivered; we can’t read it. We only record which provider you use and whether the key works.

When an AI feature runs, your phone or browser sends what it needs, such as an image, a PDF, a voice note or a few snippets of your saves for a question, straight to the provider you chose. It doesn’t pass through our servers. That provider’s own terms and privacy policy apply to those requests, and any charges are between you and them.

8. Cookies and storage on tucck web

tucck web asks for no browser permissions (no camera, microphone, location or notifications) and uses only what it needs to work:

• a session cookie that keeps a paired browser signed in, and a short-lived pairing cookie;
• Clerk’s cookies while you sign in;
• your browser’s local storage for preferences (theme, reduced motion, views), for the protected copy of your AI key if you shared it, and for PostHog’s ID while analytics are on.

We use no advertising or cross-site tracking cookies.

9. Who helps us run tucck

These service providers process data for us, only to run tucck. We don’t sell or share your personal data with anyone else, except where the law requires it.

• Heroku (Salesforce): hosting and the database.
• Cloudflare: the network in front of tucck.app, and file storage for Starter.
• Clerk: sign-in and sign-in emails.
• Google Play and RevenueCat: purchases and subscriptions.
• PostHog: usage analytics.
• Sentry: crash reports.

Some of these providers store and process data outside India, including in the United States. We use them only as Indian law allows.

10. How long we keep it

• Your saves are kept until you delete them.
• Deleted saves wait in Recently deleted for 30 days, then are erased for good, files included.
• When you delete your account, you have 30 days to change your mind. After that, your account, everything in it, its files and your sign-in record at Clerk are erased.
• Data exports can be downloaded for 24 hours, then are deleted. Pairing codes last 60 seconds.
• Analytics events and crash reports don’t contain what you save. When your account is erased, we also tell PostHog to delete your analytics and RevenueCat to delete your purchase history. Sentry has no way to delete one person’s reports, so they expire with its standard retention period (30 to 90 days, depending on the plan). Google Play keeps its own order records. Write to support@tucck.app to have your analytics deleted without deleting your account.
• A record of what you agreed to and withdrew, and when (with your network address in a form that can’t be read back), is kept for one year after your account is erased, to show we respected your choices. It holds nothing you saved.
• Our providers’ routine backups may hold a copy for a short time after deletion, until they are replaced.

11. Your rights and choices

Under India’s Digital Personal Data Protection Act, 2023, you can:

• get a copy of your data: in the app, Account → Export all data;
• correct it: edit your saves directly, or write to us about account details;
• erase it: delete saves, or delete your account from Account → Delete account;
• withdraw consent, as easily as you gave it: turn crash reports or analytics off, or tap Withdraw all consent in Privacy center (or Settings → Privacy on tucck web); remove your AI key; or delete your account. Asking to delete your account withdraws every consent and signs out your other devices at once;
• nominate someone to exercise these rights if you die or can’t act;
• complain to us at support@tucck.app. If you’re not satisfied with our answer, you can go to the Data Protection Board of India.

We’ll answer within the time the law sets, and usually much sooner.

12. Age

tucck is for people aged 18 and over. We don’t knowingly collect personal data from anyone younger. If you believe a child has given us personal data, write to support@tucck.app and we’ll delete it.

13. Security

Everything travels over HTTPS. Sign-in tokens and pairing codes are stored only as hashes, files are reached through short-lived signed links, and locked tucck spaces stay closed on tucck web until your phone opens them, for 15 minutes at a time. No system is perfectly secure; if a breach affects your data, we’ll tell you and the Data Protection Board as the law requires.

14. Changes to this policy

When tucck changes what it collects or who processes it, we update this page and its effective date. If a change matters to how your data is used, we’ll tell you in the app or by email before it takes effect.

15. Contact

Questions, requests and complaints: support@tucck.app. This address also reaches our grievance officer.