Sign in to your account.
A passkey or an email link tells Tuck it’s you. It lets your devices sync, but it doesn’t unlock your saved thoughts.
Private by design
Your thoughts
stay yours.
Your ideas, plans, and half-finished thoughts deserve a private place. Tuck™ locks your saved content on your device before syncing it. You hold the key to unlock it.
Unlock your thoughts.
Your vault is the encrypted home for your content. Your passphrase unlocks it on your device. That passphrase isn’t sent to Tuck.
Keep a backup key.
Your recovery kit is another way to unlock your content if you forget your passphrase. Save it somewhere safe, outside Tuck.
Private on your device. Protected between devices.
When you create your vault, your device makes a random encryption key. Your notes, titles, tags, attachment content, and people details are encrypted with that key. Sync carries the locked version, along with protected copies of the key.
On a new device, sign in and unlock with your passphrase or recovery kit. The device does the unlocking. Signing in alone doesn’t give Tuck—or someone with access to your account—the ability to read your encrypted content.
A few things worth knowing.
What isn’t hidden by encryption?
Some information, such as brain names, dates, and reminder details, stays readable so Tuck can organize and deliver things. Your account and billing information are separate from your encrypted content.
What if I connect a cloud AI?
Hosted MCP stays off until you turn it on for a personal brain. Tuck then stores that brain’s thoughts in plaintext so an AI can read them while your devices are locked. Thought text is included only if you turn on a second switch. Tuck still doesn’t have the vault key and doesn’t unlock the vault to make that copy. Your device writes it. Turning the brain off in the MCP settings deletes the plaintext copy. A shared brain can’t be published this way at this time.
What happens when I share something?
Sharing is your choice. A public share link publishes a readable snapshot for anyone who has the link. Your original tuck stays encrypted.
What about email, texts, and integrations?
Sending something through email or SMS involves those services and Tuck’s capture service before it reaches your vault. Connecting a calendar or mailbox also lets Tuck fetch information on your behalf. Those paths have different privacy considerations from writing directly in an unlocked Tuck app.
Read the privacy policy for details →Does Tuck stay unlocked?
Your browser can keep the key on this device so refreshing the page doesn’t interrupt you. Use “Lock this device” or sign out when you’re finished, especially on a shared computer.
Can I read the technical explanation?
Tuck uses AES-256-GCM encryption with a key generated on your device. Your passphrase and recovery kit protect separate copies of that key, so either can unlock it.
Explore Tuck support and documentation →Looking for the formal documents? Privacy policy · Terms of Service.