Privacy Policy

Last updated: August 2026

⚠️ DRAFT — REQUIRES PROFESSIONAL LEGAL REVIEW BEFORE PUBLISHING. This document is a starting point only, not legal advice.

1. Who we are

Tuckt ("we", "us", "our") provides a personal wealth management app for iOS. This policy explains what personal data we collect, why, and your rights over it, in line with UK GDPR and the Data Protection Act 2018.

Data controller: [Your name / company name], [registered address], [contact email].

2. What data we collect

• Account data: name, email address, password (encrypted), date of birth
• Financial data you enter: investments, cash, property, pensions, crypto, debts, income, budget, retirement goals, dependants' details (name, type, date of birth)
• Usage data: app interactions, feature usage, crash reports
• Device data: device type, OS version, IP address (for security/fraud prevention)

We do not collect bank login credentials directly — bank connections (if enabled) go through TrueLayer, a regulated open banking provider, under their own security standards.

3. How we use your data

• To provide the app's core functionality (tracking your wealth, generating insights, budget/retirement planning)
• To power AI-generated analysis and chat responses (your financial data is sent to Anthropic's Claude API to generate this — see Section 5)
• To send you notifications you've opted into (payment reminders, insights)
• To improve the app (aggregated, anonymised usage analytics)
• To communicate with you about your account or the service

4. Legal basis for processing (UK GDPR)

• Contract: processing necessary to provide the service you've signed up for
• Consent: for optional features like notifications, marketing communications
• Legitimate interests: fraud prevention, service improvement

5. Third parties we share data with

• Supabase (database/authentication hosting) — [region/hosting location]
• Anthropic (Claude AI) — receives financial data you choose to analyse, to generate AI responses. Not used to train Anthropic's models [confirm this against Anthropic's actual API data usage policy]
• Twelve Data / CoinGecko (market price data, when active) — we send ticker symbols only, not personal data
• TrueLayer (open banking, when active) — regulated under FCA open banking standards
• RevenueCat (subscription management, when active) — processes purchase data
• [Analytics provider, if any]

We do not sell your personal data to third parties.

6. Data retention

We retain your data for as long as your account is active, plus [X months/years] after account deletion for legal/accounting purposes, after which it is permanently deleted.

7. Your rights

Under UK GDPR, you have the right to: - Access the personal data we hold about you - Correct inaccurate data - Request deletion of your data ("right to be forgotten") - Export your data in a portable format - Object to or restrict certain processing - Withdraw consent at any time (for consent-based processing)

To exercise these rights, contact [email]. You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk.

8. Data security

We use industry-standard encryption in transit and at rest. Access to your data is restricted to what's necessary to provide the service. [Add specifics once confirmed with your infrastructure — e.g. Supabase's security certifications.]

9. International data transfers

[Confirm where Supabase/Anthropic/other providers process/store data — if outside the UK/EEA, this section needs to describe the legal safeguard used, e.g. Standard Contractual Clauses.]

10. Children's privacy

Tuckt is not intended for use by anyone under 18. We do not knowingly collect data from children. Dependant information (including minors) may be entered by an adult user about their own dependants for financial planning purposes only.

11. Changes to this policy

We may update this policy from time to time. Material changes will be notified via the app or email.

12. Contact us

[Email address] [Postal address, if required]