Privacy Policy

Last updated: 29 October 2026

1. Who is responsible

The controller under the EU General Data Protection Regulation (GDPR) for the Tuck apps and for tuckshelf.app is:

No data protection officer is appointed, because the law does not require one for an operation of this size. Send any privacy question to the email above.

2. The Tuck apps (Mac and iPhone)

Tuck is a clipboard manager, so it sees what you copy. Everything below happens on your devices. We, the developer, never receive your clipboard contents.

What Tuck stores on your Mac

• Items you copy, with their original formats, the app they came from and when they were copied.
• Pinboards, titles and edits you make.
• Text recognized in images. Recognition runs on your Mac with Apple's Vision framework.
• Your settings.

This is stored in ~/Library/Application Support/Tuck with user-only file permissions. Unpinned items are deleted after 30 days. Pinned items are kept until you delete them.

Tuck does not save copies from apps you exclude, from supported password managers (excluded by default), or copies that the source app marks as confidential or transient.

What leaves your device

• Link previews (on by default, Mac). When you copy a link, Tuck asks Apple's Link Presentation framework to fetch that page's title and image, so that website receives a normal request from your Mac, including your IP address. Turn this off in Settings → General.
• iCloud Drive sync (off by default). If you turn it on, your history and pinboards are written to a Tuck Sync folder in your own iCloud Drive and handled by Apple under your Apple Account. We cannot access it. Turn on Advanced Data Protection in iCloud for end-to-end encryption. The iPhone app reads only the Tuck Sync folder you choose and puts items you tap onto your iPhone's clipboard.
• Backups. Only if you export one, saved where you choose.

Nothing else is sent anywhere. The apps collect no analytics, crash reports or usage data. Tuck's diagnostics report contains only counts, settings and fixed messages, never clipboard contents, and is shared only if you send it yourself.

Permissions

• Clipboard access to read what you copy.
• Accessibility (optional, Mac) to paste directly into other apps and run the paste stack.

Deleting app data

Use Clear History in Tuck, or quit Tuck and delete ~/Library/Application Support/Tuck. If sync is on, also delete the Tuck Sync folder in iCloud Drive. Deleting the iPhone app removes its local data.

If you download Tuck from the App Store, Apple processes your purchase and download under Apple's privacy policy. We receive only aggregated, anonymous statistics that Apple provides to all developers.

3. This website (tuckshelf.app)

Hosting

The website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When you open a page, your browser sends technical data that Vercel's servers process to deliver it: IP address, date and time, page requested, referrer, and browser and operating system. This is necessary to deliver the site securely (Art. 6(1)(f) GDPR, our legitimate interest in a working, secure website). Vercel keeps these logs only briefly. Transfers to the USA are based on the EU–U.S. Data Privacy Framework and the EU Standard Contractual Clauses in Vercel's data processing agreement.

Anonymous visitor statistics (PostHog)

We use PostHog to understand how many people visit and which parts of the page are useful. PostHog is provided by PostHog Inc., 2261 Market St #4008, San Francisco, CA 94114, USA, and our data is stored in PostHog's EU cloud in Frankfurt, Germany.

• No cookies and nothing stored on your device. PostHog runs in cookieless mode: it does not set cookies or use local storage.
• No profile of you. To count unique visitors, PostHog computes a one-way hash of your IP address, browser user agent and the website's domain together with a value that changes every day. Your IP address itself is not stored, so we cannot recognize you on later days or link visits to you.
• What is recorded: pages viewed, the website you came from, campaign parameters in the link, browser, operating system, device type, approximate country, and clicks on the Download and GitHub buttons and the use-case tabs.
• Retention: up to 12 months, then deleted.

The legal basis is Art. 6(1)(f) GDPR (our legitimate interest in anonymous reach measurement to improve the site). Because nothing is stored on or read from your device beyond what is technically needed to deliver the page, no consent under § 25 TDDDG is required. You can object at any time by emailing us, or block eu.i.posthog.com with any content blocker.

Email

If you email us, we use your address and message only to reply (Art. 6(1)(b) or (f) GDPR) and delete them when the conversation is finished, unless we must keep them for legal reasons.

4. Your rights

Under the GDPR you have the right to access your data (Art. 15), to have it corrected (Art. 16) or deleted (Art. 17), to restrict processing (Art. 18), to data portability (Art. 20), and to object to processing based on legitimate interests (Art. 21). Because the website data is anonymous, we usually cannot link it to you, which limits what we can retrieve.

You can also complain to a data protection authority. Ours is the Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59–61, 10555 Berlin, Germany.

5. Children

Tuck is not directed at children and we do not knowingly collect data from them.

6. Changes

We update this policy when the apps or the website change how they handle data. The date at the top shows the latest version.