Privacy policy

When you create an account or use Tuck, you may give us:

• Your email address, and a passkey or a one-time email link used to sign in.
• An invite code, if signup asks for one.
• The thoughts, tags, people, todos, dates, files, and recordings you tuck. Most of that is encrypted on your device before it is stored. See “How thoughts are stored” below.
• Messages you send to your Tuck address (such as you@sendto.tuckthis.app) or by SMS, if you turn messaging on.
• Feedback you send from the site: a subject, a message, and any screenshots or email address you choose to include.
• Payment details if you buy a plan. Card numbers are collected by our payment processor, Stripe. We receive the plan, status, and billing identifiers, not your full card number.

Your vault passphrase and the plaintext recovery kit are not sent to us. We cannot reset a forgotten passphrase. The recovery kit is the backup.

We collect a small amount of information needed to run the service:

• An HttpOnly session cookie named tuck_session so you stay signed in. It lasts about 30 days. We do not use it for advertising.
• The send-to address assigned to your account.
• Basic server logs, such as the time of a request and an IP address, kept so the site can operate and be secured.
• Reminder fields that have to stay readable for a message to go out while the vault is locked: reminder text, due time, and the address or number it is sent to.
• A few fields that stay readable so calendars and boards can work without unlocking the vault: brain names, dates, due dates, and internal ids.

We do not use marketing analytics or advertising cookies. Optional hosted telemetry, if it is running, is counts and channels only, never the text of a thought. Speech-to-text for a recording runs in your browser. That audio is not uploaded for transcription.

The Tuck extension is a clipper. It does not browse your vault, and it does not hold the key that decrypts it.

• When you click the extension or use its shortcut, it reads the address and title of the current tab, and any text you have selected. If nothing is selected, it keeps the address.
• Anything you type in the popup — tags, brain, people, todos, and a date — is part of that clip.
• If a Tuck tab is open and unlocked, the clip is handed to that tab and sealed into your vault on the device. An unlocked tab may also show a few related tucks for that page: title and a link, including archived notes.
• If Tuck is not ready, the clip stays on that browser until it can be filed. It remains there across a restart. It is removed after it is filed, if you discard it, or if you remove the extension. Waiting clips are stored on the device. They are not synced to your browser account.
• The shortcut, and a self-hosted Tuck address if you add one, are saved in extension storage. Your browser may sync those settings with its own account.

The extension asks only for access to the tab you invoked it on, permission to read the selection, and local storage. It talks to tuckthis.app, and to a self-hosted address only if you add one. It does not phone home, sell what it reads, or include analytics.

We use information to:

• Create and sign you into your account, and assign your send-to address.
• Store encrypted vault data so another device of yours can download it and unlock it.
• Deliver inbound mail and SMS into your mailbox, then delete the inbound body after your device has pulled it.
• Send reminders, sign-in links, and replies you asked for.
• Take payment and keep your plan in force.
• Publish a tuck only when you choose to share a link. That link is a copy you opted to make readable. The original stays sealed.
• Respond to feedback and keep the service reliable and secure.

We do not sell personal information. We do not use it for cross-context advertising.

Titles, note bodies, tag names, attachment bytes and filenames, todo titles, calendar and mail secrets, and people names, emails, notes, and files are encrypted on your device with a key we do not have. Sync uploads that ciphertext and the wraps of the key. A passkey or email link signs you in. It does not unlock the vault.

Connecting a calendar or mailbox lets this site fetch on your behalf. Those credentials are not stored on our servers. Why a passkey, a passphrase, and a recovery kit are separate.

We share information with service providers that process it for us:

• Amazon Web Services, for hosting and inbound email.
• Stripe, for payments.
• An email provider (such as Resend) for sign-in links and reminders.
• Twilio, if you use SMS.

A share link is readable by anyone with the link, because you published that snapshot. We may also disclose information if the law requires it, or to protect Tuck, our users, or the public from harm. We do not share vault contents with advertisers.

The session cookie is the one we set so the app knows you are signed in. The marketing site does not add analytics or advertising cookies. The extension uses the browser’s extension storage, described above, which is not a website cookie.

• Account information and encrypted vault data stay while your account is open.
• Inbound message bodies are deleted after your device pulls them.
• A clip waiting in the extension stays until it is filed, you discard it, or you remove the extension.
• Payment records are kept as needed to run the subscription and for accounting.
• Server logs are kept for a limited time for security and operations.

You can sign out, lock a device, and remove the browser extension. Removing the extension deletes clips still waiting on that browser. It does not delete the vault.

You can ask us to access, correct, or delete your account through the Feedback link in the header of tuckthis.app. Depending on where you live, you may have additional rights to access, correct, delete, or receive a copy of personal information, and to appeal a refusal. We will not discriminate against you for exercising those rights. Some records, such as payment history, may be kept where the law requires it.

Tuck is not directed at children under 13, and we do not knowingly collect personal information from them. If you believe a child has given us personal information, contact us and we will delete it.

Tuck is hosted in the United States. If you use Tuck from somewhere else, your information is processed in the United States.

If we change this policy, we will post the new version on this page and update the date above. Where a change is material, we will give notice in the product or by email when we have an address for you.

Questions about this policy go through the Feedback link in the header of tuckthis.app. Include a way to reply if you want a response.