Tuckalong

Privacy policy

Tuckalong ("we", "us", or "our") operates the Tuckalong mobile application (the "App"). This page explains what information we collect, how we use it, and your rights.

Effective date: 1 June 2026

1. Information we collect

1a. Information you provide

  • Account data – name, email address, phone number, and password (stored as a secure hash).
  • Parcel data – parcel description, photos, weight, dimensions, recipient details.
  • Payment data – payment is processed by Stripe, Inc. We do not store raw card numbers; we receive only a Stripe payment intent ID and status.
  • Messages – in-app chat messages between senders and carriers.

1b. Information collected automatically

  • Device token – Firebase Cloud Messaging token for push notifications.
  • Usage data – app interactions logged for debugging (no PII in logs; auth headers, passwords, and tokens are redacted).

2. How we use your information

  • Create and manage your account.
  • Match parcel senders with travellers.
  • Process payments and hold funds in escrow until delivery is confirmed.
  • Send push notifications about matches, payments, and deliveries.
  • Prevent fraud and enforce our Terms of Service.
  • Improve the App and fix bugs.

3. Sharing your information

We do not sell your personal data. We share it only with:

  • Stripe, Inc. – payment processing. Governed by Stripe's Privacy Policy.
  • Google Firebase – push notification delivery. Governed by Google's Privacy Policy.
  • Other users – your display name, city, and trip route are visible to matched counterparties to enable the delivery.
  • Law enforcement – where required by law or to protect rights and safety.

4. Data retention

We retain your account data for as long as your account is active. After account deletion we retain transaction records for 7 years to comply with financial regulations. Uploaded parcel and delivery-evidence photos are deleted within 90 days of account closure unless retention is required by law.

5. Security

All data is transmitted over TLS. Passwords are hashed with argon2. Payment secrets, auth tokens, and personal identifiers are redacted from all server logs. We use JWT-based authentication with short-lived tokens.

6. Children

The App is not directed to children under 18. We do not knowingly collect data from minors. If you believe a minor has created an account, please contact us immediately.

7. Your rights

Depending on your jurisdiction you may have the right to:

  • Access a copy of your personal data.
  • Correct inaccurate data.
  • Delete your account and associated data.
  • Object to or restrict certain processing.
  • Data portability.

To exercise any of these rights, email us at support@tuckalong.co.uk.

8. International transfers

Your data may be processed in countries outside your own. Where we transfer data from the EEA we use appropriate safeguards such as Standard Contractual Clauses.

9. Changes to this policy

We may update this policy from time to time. We will notify you of material changes via in-app notification or email. Continued use of the App after changes constitutes acceptance of the updated policy.

10. Contact us

Questions or requests regarding this policy:
Email: support@tuckalong.co.uk