Privacy policy

Last updated 13 November 2026

This policy explains how the Tuck app ("Tuck", "we", "us") for iPhone and Android handles your information. If anything here is unclear, email us at hello@tuckvault.app.

What we collect

Nothing. Tuck has no accounts and no sign-up. It contains no analytics, no advertising, no tracking and no crash-reporting tools that send data to us or to anyone else. We don't know who uses Tuck or what they keep in it.

What stays on your device

The photos, videos, notes and documents you add to Tuck are stored only on your device, inside the app's private storage. Before anything is saved, Tuck encrypts it on your device:

• Your passphrase is turned into a key with Argon2id, a slow, memory-hard function designed to resist guessing.
• Your files and your list of items are encrypted with XChaCha20-Poly1305.
• Your passphrase is never stored or sent anywhere. If you turn on Face ID, Touch ID or fingerprint unlock, an unlock key is kept in your device's secure keychain or keystore, available only on that device and only after biometric approval.

Because only you have the passphrase and the 24-word recovery key, we can't recover, reset or read your vault.

Backups

If you choose to turn on backup, Tuck copies your already encrypted vault to your own iCloud Drive (on iPhone) or your own Google Drive (on Android). The upload goes straight from your device to Apple or Google. Tuck never receives a copy, and Apple and Google only ever see scrambled files they can't read. Those services are covered by Apple's and Google's own privacy policies. You can turn backup off or delete your backup at any time, and deleting your vault in Tuck also deletes its backup.

Permissions Tuck asks for

• Photos: so you can choose photos and videos to move into Tuck, and to save items back to your library when you export them. Tuck only reads the items you pick.
• Camera and microphone: so you can take photos, record videos and scan documents straight into the vault.
• Face ID, Touch ID or fingerprint: to unlock the vault. Your biometric data never leaves your device's secure hardware and Tuck never sees it.

Everything captured through these permissions is encrypted and kept on your device.

Purchases

Subscriptions and the lifetime purchase are handled by the App Store or Google Play. We never see your name, email or payment details. To check whether your subscription is active, Tuck uses RevenueCat, which receives your purchase receipt and a random, anonymous app ID. It doesn't receive anything from your vault. See RevenueCat's privacy policy.

Children

Tuck isn't directed at children under 13, and we don't knowingly collect information from anyone, including children.

Your rights

Since we hold no personal data about you, there's nothing for us to access, correct, export or delete. You stay in full control of your data in the app: you can export items, delete items, or delete your whole vault and its backup from Settings.

Changes

If we change this policy, we'll update the date at the top of this page. If a change ever meant collecting something new, we'd say so clearly in the app first.

Contact

Questions about privacy: hello@tuckvault.app