Effective date: July 23, 2026
This Privacy Policy explains what data Tucked (“the app”, “we”, “us”) collects, why we collect it, where it lives, and what you can do about it. Jose Hiram Negrete d/b/a Fuegaux is the operator of the app.
What Tucked actually is
Tucked is a gift-card wallet. You store your gift cards in one place so you actually REMEMBER to use them instead of losing them in a drawer. Card numbers and balances live encrypted on your device — we do not send your card numbers to our servers.
What we collect and WHY
Account info (required to sync): email and password (hashed). You only need this if you want to sync your wallet between devices. If you use Tucked on one device only, you can skip account creation entirely.
Gift card details (stored on-device, encrypted): card number, PIN, balance, merchant, and any notes you add. These are encrypted with a key stored in the iOS Keychain. If you enable sync, an encrypted blob is uploaded to our database — we can’t read the contents server-side.
Card metadata (synced if you enable sync): merchant name, nickname, and remaining balance are stored in your account so we can show your wallet on multiple devices.
Purchase records (if you subscribe): Apple sends us confirmation of your subscription so we can unlock premium features. We don’t see your credit card.
Technical data (automatic): device model, iOS version, app version, crash logs, and anonymized usage events. This is how we find bugs and figure out what people actually use.
Where your data lives
Card numbers and PINs are stored on your device, encrypted with a key in the iOS Keychain. If you enable sync, an encrypted blob and metadata are stored in Supabase (Postgres + auth) hosted in the United States. See supabase.com/privacy.
Affiliate links
Tucked integrates with Rakuten Advertising (pending approval as of the effective date above) to let you buy new gift cards from participating merchants. When you tap an affiliate link and buy a card, Rakuten and the merchant may share purchase confirmation data with us, and we may earn a commission. This costs YOU nothing extra. If Rakuten integration is not active in your version of the app, this section does not apply. See Rakuten’s privacy policy.
Third-party services Tucked uses
- Supabase — auth + database (encrypted card blobs + metadata, only if you enable sync). Privacy policy.
- PostHog — product analytics. No third-party ads. Privacy policy.
- Sentry — crash and error reporting. Privacy policy.
- RevenueCat — subscription management. Privacy policy.
- Rakuten Advertising (pending) — affiliate purchases of new gift cards. Privacy policy.
- Apple — App Store purchases, push notifications, Keychain. Privacy policy.
Tucked does NOT show third-party ads and does NOT sell your card data.
Your rights
You can ask us to do any of the following at any time:
- Access the data we hold about you.
- Correct anything that’s wrong.
- Delete your account and the data tied to it.
- Export your data in a portable format.
- Opt out of analytics collection.
Email fuegaux@gmail.com and we’ll handle it within 30 days.
If you’re in California (CCPA/CPRA)
You have the right to know what personal information we collect, the right to delete it, the right to correct inaccurate information, and the right to opt out of the “sale” or “sharing” of personal information. We do not sell your personal information. To exercise any of these rights, email fuegaux@gmail.com. We will not discriminate against you for exercising your rights.
If you’re in the EU/UK (GDPR)
Our legal basis for processing your data is (a) your consent, (b) performance of our contract with you (i.e. providing the app), and (c) our legitimate interests in keeping the app running and free of fraud and errors. You have the right to access, rectify, erase, restrict, and port your data, and to object to processing. You also have the right to lodge a complaint with your local data protection authority.
Children
The app isn’t for kids under 13 (or under 16 in the EU/UK). We don’t knowingly collect data from anyone in that age range. If you think a child has given us data, email fuegaux@gmail.com and we’ll delete it.
Data retention
We keep account data for as long as your account is active. When you delete your account, we delete your personal data from our production systems within 30 days and from backups within 90 days, except where retention is required by law (e.g. tax records for purchase receipts).
Security
We use industry-standard measures to protect your data — encryption in transit (TLS), encryption at rest on our providers’ infrastructure, and access controls. No system is 100% secure, but we take this seriously.
Changes to this policy
If we change this policy in a meaningful way, we’ll update the effective date at the top and, where required, notify you in the app or by email. Continued use after the change means you accept the updated policy.
Governing law
This Privacy Policy is governed by the laws of the State of Texas, USA, without regard to conflict-of-laws principles.
Contact
Questions? Email fuegaux@gmail.com.