Privacy policy

When you create an account or use Tuck, you may give us:

• Your email address, and a passkey or a one-time email link used to sign in.
• An invite code, if signup asks for one.
• The thoughts, tags, people, todos, dates, files, and recordings you tuck. Most of that is encrypted on your device before it is stored. See “How thoughts are stored” below.
• Messages you send to your Tuck address (such as you@sendto.tuckthis.app) or by SMS, if you turn messaging on.
• An optional mobile number and verification timestamps if you enable SMS reminders on Settings → Ingest. When you agree to SMS, we record the time and which version of the consent text you agreed to.
• Feedback you send from the site: a subject, a message, the page you sent it from, and any screenshots or email address you choose to include.
• Payment details if you buy a plan. Card numbers are collected by our payment processor, Stripe. We receive the plan, status, and billing identifiers, not your full card number.

Your vault passphrase and the plaintext recovery kit are not sent to us. We cannot reset a forgotten passphrase or decrypt a vault without the key. A recovery kit restores access to an encrypted vault that is still available. It is not a backup of the vault’s contents.

We collect a small amount of information needed to run the service:

• An HttpOnly session cookie named tuck_session so you stay signed in on the web. It lasts about 30 days. We do not use it for advertising.
• A sign-in session for the iPhone, Mac, and Raycast apps. It lasts up to 60 days without use and 365 days in total. Being signed in does not unlock the vault. It still needs Face ID or your passphrase.
• The send-to address assigned to your account.
• Basic server logs, such as the time of a request, an IP address, and your account id, kept so the site can operate and be secured.
• Reminder fields that have to stay readable for a message to go out while the vault is locked: reminder text, due time, and the address or number it is sent to.
• A few fields that stay readable so calendars and boards can work without unlocking the vault: brain names, dates, due dates, and internal ids.

The public marketing pages can load Umami to count page views. That script is cookieless, and it is not loaded in the signed-in app. It is served from our own domain, and page views pass through our servers on their way to Umami, without your cookies. We pass on your IP address so Umami can estimate your country and city. Umami does not store it. If you arrived from a link with campaign tags (utm_source, utm_medium, utm_campaign, utm_content, utm_term), those tags are counted too. Every other part of the address after the page, such as an invite code or sign-in token, is removed before the page view leaves your browser. We honor Do Not Track. We do not use advertising cookies. The only product analytics the app sends are anonymous vault-setup steps, such as that a recovery kit was shown or checked, each with a random id for that one setup. They carry no account, email, passphrase, recovery code, or anything you typed, and are not linked to you. Speech-to-text for a recording runs on your device, in the browser or the iPhone app. That audio is not uploaded for transcription. Your device downloads the speech model from Hugging Face, which sees your device’s IP address.

The Tuck extension is a clipper. It does not browse your vault, and it does not hold the key that decrypts it.

• When you click the extension or use its shortcut, it reads the address and title of the current tab, and any text you have selected. If nothing is selected, it keeps the address.
• Anything you type in the popup — tags, brain, people, todos, and a date — is part of that clip.
• If a Tuck tab is open and unlocked, the clip is handed to that tab and sealed into your vault on the device. An unlocked tab may also show a few related tucks for that page: title and a link, including archived notes.
• If Tuck is not ready, the clip stays on that browser until it can be filed. It remains there across a restart. It is removed after it is filed, if you discard it, or if you remove the extension. Waiting clips are stored on the device. They are not synced to your browser account.
• The shortcut, and a self-hosted Tuck address if you add one, are saved in extension storage. Your browser may sync those settings with its own account.

The extension asks only for access to the tab you invoked it on, permission to read the selection, and local storage. It talks to tuckthis.app, and to a self-hosted address only if you add one. It does not phone home, sell what it reads, or include analytics.

A linked number is used only to match inbound texts to your account and to send verification codes, the opt-in confirmation, HELP / STOP / START replies, and reminders you request. We do not sell phone numbers or use them for marketing texts. We will not share mobile information with third parties for promotional or marketing purposes. Message frequency varies based on your activity. You can remove the number in Settings → Ingest, or reply STOP or UNSUBSCRIBE. Details: SMS reminders.

We use information to:

• Create and sign you into your account, and assign your send-to address.
• Store encrypted vault data so another device of yours can download it and unlock it.
• Deliver inbound mail and SMS into your mailbox, then delete the inbound body after your device has pulled it.
• Send reminders, sign-in links, and replies you asked for.
• Take payment and keep your plan in force.
• Publish a tuck only when you choose to share a link. That link is a copy you opted to make readable. The original stays sealed.
• If you turn on hosted MCP for a personal brain, you'll store the thoughts in that brain so an external AI can read them while your devices are locked. That copy is plaintext. Full thought text is stored only if you turn on a second switch for that brain. Turning the brain off deletes the plaintext copy.
• Respond to feedback and keep the service reliable and secure.

We do not sell personal information or use it for advertising. Tuck never uses your content or personal information to train, fine-tune, or improve AI or machine-learning models. Providers we engage, including any future Tuck-hosted AI, are not permitted to use that data for those purposes. If you connect your own AI account, that provider’s training and retention are governed by your agreement and settings with them. We will say what is sent and to whom before that feature can be turned on. We do not control those settings.

Titles, note bodies, tag names, attachment bytes and filenames, todo titles, calendar and mail secrets, and people names, emails, notes, and files are encrypted on your device with a key we do not have. Sync uploads that ciphertext and the wraps of the key. A passkey or email link signs you in. It does not unlock the vault.

Encryption does not cover every path. Email and SMS pass through their providers and Tuck’s capture service before they enter the vault. Reminder text and delivery details, some organizational metadata, content you publish, enabled integrations, and clips still waiting in the browser extension are not end-to-end encrypted vault content. Hosted MCP is off until you opt in, per personal brain, in Settings. The thoughts (and the full text, only if you also turn that on) are stored in plaintext so Tuck, a breach, or a subpoena can read them. We do not have the vault key, and we do not unlock the vault to make that copy. Your device writes it. Shared brains cannot be published this way. Hosted Tuck AI chat is not available yet.

On iPhone, a reminder’s text can show on the Lock Screen when it goes off. Tuck keeps its local files on the device out of iCloud backup.

Connecting a calendar or mailbox lets this site fetch on your behalf. Those credentials are not stored on our servers. Why a passkey, a passphrase, and a recovery kit are separate.

We share information with service providers that process it for us:

• Amazon Web Services, for hosting and inbound email.
• Stripe, for payments.
• An email provider (such as Resend) for sign-in links and reminders.
• Telnyx, if you use SMS.
• Linear, for feedback you send: the message, the page you sent it from, and any email address or screenshots you include. A deletion request covers that feedback too.
• New Relic, for server logs. Logs can carry your account id.
• Hugging Face, which serves the speech-to-text model your browser or iPhone downloads. It sees your device’s IP address.
• Todoist, if you connect it. Your todo titles and due dates go to your Todoist account.
• Umami, for page-view counts on the public marketing site, when that tracker is turned on. It does not receive vault contents.

A share link is readable by anyone with the link, because you published that snapshot. A share for one email address opens for anyone with the link who enters that address. We may also disclose information if the law requires it, or to protect Tuck, our users, or the public from harm. We do not share vault contents with advertisers.

The session cookie is the one we set so the app knows you are signed in. The marketing site does not set an analytics cookie or an advertising cookie. When Umami is configured, it counts page views without a cookie. The extension uses the browser’s extension storage, described above, which is not a website cookie.

• Account information and encrypted vault data stay while your account is open. Files over a downgraded allowance stay until you delete them or close the account.
• When you delete the account in Tuck, we mark it deleted immediately and purge it from active systems 30 days later. You do not need a second email for that purge. Email privacy@tuckthis.app to ask for erasure sooner. There is no account restore during the 30 days.
• After the purge, we keep only a one-way hash of your email address, so we can honor the deletion.
• Automated backups of the database that stores accounts and encrypted vault data are kept for 14 days. After the active-system purge, a backup copy can remain until that backup expires, up to 14 more days. We do not keep a longer database backup. Restoring a backup reapplies completed deletions instead of putting an erased account back into use.
• Server logs are kept separately for about a week. That is not the vault backup.
• Inbound message bodies are deleted after your device pulls them.
• A raw copy of each email sent to your send-to address is kept for 7 days, so a failed delivery can be replayed.
• An SMS opt-out is kept so we do not text a number that asked us to stop.
• A clip waiting in the extension stays until it is filed, you discard it, or you remove the extension.
• Billing records are kept as tax law requires. When the account is purged, the email and name on your Stripe customer record are cleared.
• Some other records are kept where the law requires it. Those records are not used to operate the deleted account.

SMS is optional. You can use Tuck without giving a phone number. Change or remove the number anytime, or email support@tuckthis.app.

You can sign out, lock a device, and remove the browser extension. Removing the extension deletes clips still waiting on that browser. It does not delete the vault.

You can ask us to access, correct, or delete your account by emailing privacy@tuckthis.app or by writing to support@tuckthis.app. Depending on where you live, you may have additional rights to access, correct, delete, or receive a copy of personal information, and to appeal a refusal. We will not discriminate against you for exercising those rights. Some records, such as payment history, may be kept where the law requires it.

Tuck is not directed at children under 13. A terms checkbox is not parental consent for a child under 13. If we learn an account belongs to a child under the applicable minimum age, we restrict it and delete the personal information, subject to records the law requires us to keep. Email privacy@tuckthis.app to report one.

Tuck is hosted in the United States. If you use Tuck from somewhere else, your information is processed in the United States.

If we change this policy, we will post the new version on this page and update the date above. Where a change is material, we will give notice in the product or by email when we have an address for you.

Privacy requests: privacy@tuckthis.app. Legal notices: legal@tuckthis.app. Anything else: support@tuckthis.app. Related: Terms of Service.