Tucker is a family meal planner for iPhone and iPad. This policy explains what information Tucker handles, where it goes, and the choices you have. We've tried to write it in plain English. If anything is unclear, please ask us (see Contact us).
1. The short version
- No advertising, no tracking across other apps or websites, no selling. Tucker has no ads, doesn't use your device's advertising identifier, and contains no third-party analytics, crash-reporting or advertising code. Our server does keep short-lived operational records, such as rate-limit counters and technical logs, to keep the service running (see section 6).
- No Tucker account. You don't sign up or give us your name, email address or phone number to use Tucker.
- Your recipes and household data stay with you. They're kept on your devices and, when you share a household, in iCloud through your Apple Account. We, the developer, don't get a copy.
- AI features are optional and are the only part that uses our server. When you use one, the details needed for that job pass through our server to our AI provider, OpenAI. Our server doesn't keep what you send or what comes back.
- Our server keeps a small amount of information to run AI features: subscription status, random member and device identifiers, permissions, the household's planning day and time zone, and this week's AI usage. It holds no names, email addresses, recipes or meal plans.
- Apple handles all payments. We never see your card or bank details.
2. Who we are
Tucker is published under the Paper Plane Labs name by Matt Guetlich ("we", "us" or "our"), based in Australia.
This policy covers:
- the Tucker app for iPhone and iPad; and
- the server that runs Tucker's AI features.
We've written it with Australia's Privacy Act 1988 (Cth) and the Australian Privacy Principles in mind. If you live outside Australia, see section 15 as well.
Tucker is still being tested and built. Some features described here, particularly household sharing and AI features, may not be switched on in the version you're using yet. Where we describe one of those features, we describe what happens when you use it. Features that don't exist yet aren't described as if they do: see section 16.
3. What Tucker handles, and why
Information you put into Tucker
| Information | Examples | Why |
|---|---|---|
| Your recipe book | Recipe titles, servings, cooking times, ingredients, method, notes, tags, effort level, the website, author or link a recipe came from, collections, when you cooked a recipe and for how many, and ratings | So you can keep, scale and cook your recipes |
| Household details | The household's name, the members of the household and what each member is allowed to change | So a family can share one plan |
| Meal planning | Meals planned for each date, with notes, members' votes on meals, and freezer items (name, number of portions and date frozen) | So the household can plan together |
| Details for AI features | The things described in section 6, such as recipe summaries for a weekly plan or a short brief for a new recipe | To do the AI job you asked for |
Information Tucker uses from your device or Apple
| Information | Why |
|---|---|
| Your iCloud account status and an iCloud identifier that Apple creates for Tucker | To sync your household and identify you as a household member and voter. It isn't your Apple Account email address |
| Members' names, as iCloud provides them for shared households | So household members can see who is in the household |
| A device key created by Apple's App Attest service | To prove AI requests come from a genuine copy of Tucker on an Apple device |
| Your subscription status from the App Store | To unlock the features you've paid for |
| Your time zone and chosen planning day | To work out when the household's weekly AI allowance resets |
| Registration with Apple's push notification service | So iCloud can tell the app when someone in the household makes a change. The device token is handled by Apple and CloudKit; our server never receives it. This is a silent background signal, not a notification you see |
What Tucker doesn't ask for
The current version of Tucker doesn't access your location, contacts, photos, camera, microphone, Apple Health data, calendars or reminders. It doesn't ask you for your name, email address or phone number.
4. Where your information is stored
On your device
Your recipe book is stored on your device. At present it stays on your device only.
Tucker also keeps a local copy of your household's shared data, so the app works without a network connection. This copy includes the household's sharing details that iCloud provides, such as members' names.
A record of your App Attest device key is kept in your device's Keychain. It is marked so that it never leaves that device, even in a backup.
Tucker's files are protected by iOS file encryption once you've unlocked your device after it starts up. Like other app data, they may be included in your device backups, depending on your backup settings.
In iCloud
When you create a household, its shared data is stored in the household admin's iCloud account using Apple's CloudKit service. It is shared with the members the admin invites. This includes:
- the household's name, and the invitation links for each shared area;
- each member's iCloud identifier for Tucker, their name as iCloud provides it, and their permissions;
- the meal plan: each meal's date, title and notes;
- votes: which meal, which member voted, and whether it was up or down;
- freezer items: name, portions and date frozen.
This data counts towards the admin's iCloud storage. It is protected by the household members' Apple Accounts. Apple encrypts it in transit and when stored. However, Tucker stores it as standard CloudKit data rather than using CloudKit's optional end-to-end encrypted fields. This means Apple holds the keys and could technically access it, as it can for other standard iCloud data. That stays true even if you've turned on Advanced Data Protection. We, the developer, have no access to your household's iCloud data. Apple's handling of iCloud data is covered by Apple's own privacy policy.
On our server
Our server runs on Cloudflare. It is used only for AI features. Section 6 explains exactly what it keeps.
5. Sharing with your household
- Invitations are private. The household admin invites people through the iOS share sheet (for example, by Messages or Mail). Only people the admin invites can join. The household isn't publicly accessible.
- What members can see. Every member can see all of the household's shared data. This includes the household name, other members' names, the meal plan, votes and the freezer list. The admin's permission settings control who can change each area, not who can see it.
- What Apple shows. Apple's iCloud sharing may show household members each other's names, and the admin may see the email address or phone number someone was invited with. That's part of how iCloud sharing works.
- What a member adds stays with the household. Changes a member makes to a shared area are stored in the admin's iCloud. They stay there if that member leaves.
- Leaving. A member can leave a household, or the admin can remove them. Leaving removes your access and deletes the household's data from the local copy on your device. If the household uses AI features, your device may also be listed on our server: see section 12.
- Children. See section 10.
Please only invite people you're happy to share the household's information with.
6. AI features and our AI provider
AI features, such as AI weekly plans, meal swaps, new recipes and tidying up ingredient lists, are part of the Household Plus subscription. They're optional: you can use Tucker without them. The app contacts our server only when you use an AI feature or set up the household's AI access.
Checking requests are genuine
Each AI request is signed using Apple's App Attest service. App Attest creates a key on your device and lets our server confirm that the request came from a genuine copy of Tucker on an Apple device. Our server receives the key's public part and a counter. App Attest doesn't tell us who you are.
What is sent for each AI job
The lists below are representative. Alongside the items named, requests also carry short reference IDs that let the app match the answer to your data, such as recipe, freezer-item and night IDs, and limits on sizes and counts.
Weekly plan or meal swap:
- the week's dates;
- for each night: the date, the effort preset, how many people are eating, any short event label or theme for that night, any meal you've locked in, and the IDs of the recipes and freezer items that could suit it;
- summaries of candidate recipes, each with a short ID: title, tags, time, equipment, cuisine, main protein, whether it's vegetarian and how it could be made vegetarian, vegetable serves, protein level and up to 30 ingredients;
- freezer items (each with a short ID, name, what recipe it came from, portions, date frozen and what to serve with it), open packs of food with use-by dates, and typical pack sizes;
- recently cooked recipes, kitchen equipment, the week's goal (balanced, healthier or high protein) and your planning-rule settings;
- each household member as a number, not a name, with any diet (vegetarian, vegan or gluten free) and dislikes;
- for a swap, the reason you give for wanting a change, the ID of the meal being replaced, and the rest of the week's meals with their IDs and titles;
- for a retry, the problems Tucker's own checks found in the previous attempt.
Allergies are not part of a weekly plan or swap request. Tucker is designed to remove recipes that don't suit the household's allergies on your device before anything is sent. That filtering will be in place before these AI features are switched on.
New recipe: the short brief you write, how many it serves, any time limit, the equipment available, whether it should be one-pan, the allergens to avoid, whether it should be vegetarian or vegan, the most non-staple ingredients it may use, and any ingredients to avoid or to use. Tucker doesn't ask for names here, but anything you type into the brief or the ingredient fields is sent as written for that request, so please leave out names and other personal details.
Tidying up ingredient lines: the recipe ingredient lines you ask Tucker to read, up to 40 at a time and up to 160 characters each.
Please don't include names or other personal details in the free-text boxes, such as a recipe brief or a reason for a swap. They aren't needed.
What our server does with it
Our server checks the request is genuine and that the household has Household Plus. It then checks the weekly allowance and builds the request to the AI model from fixed templates. It sends the request to OpenAI and returns the answer to your device.
Our server doesn't store the details you send or the answer that comes back.
There are two kinds of logs:
- Our application logs record only the event type, the route (which part of the server was called), the result status, any error code, the kind of AI job, how long it took and how many units of AI processing ("tokens") it used. They contain no request or answer content.
- Cloudflare's platform logs. Cloudflare's Workers Logs are switched on for our server. Cloudflare records technical details about each request (invocation metadata) alongside our application logs, and keeps them for up to 7 days by default.
Our AI provider: OpenAI
AI requests are sent to OpenAI, in the United States, which provides the AI model. OpenAI processes them under its API terms and policies. Our server asks OpenAI not to store the response for later use (the API's store: false setting). We've chosen the most restrictive data-retention setting OpenAI offers for our account. OpenAI's published API policies say it doesn't use API data to train its models by default. OpenAI may still keep API data for a limited time under its own policies, for example to detect abuse. Please see OpenAI's privacy policy and API data-use terms for details.
What our server keeps
Our server keeps only what it needs to check requests and run each household's weekly AI allowance:
| Record | What it holds |
|---|---|
| For each device | A random App Attest key ID, the key's public part and counter, whether the key came from a developer build or a TestFlight or App Store build, and which household and member number it belongs to. For set-up and rate limits: the latest one-time set-up challenge with its 5-minute expiry, and the times of recent set-up attempts and AI requests. Timestamps older than an hour are cleared the next time that device makes the same kind of request; an unused challenge stays until it is replaced or used |
| For each household | Details from the admin's Apple subscription: the original transaction ID, product, expiry date, whether it was refunded or revoked, any billing grace period, whether it was a test purchase (such as one made in TestFlight), and when Apple signed it. Also: a household identifier supplied by the app, the member list (random member IDs, device key IDs, permissions and the date each joined), pending invitations (stored in a scrambled, hashed form, with permissions and a 7-day expiry), the planning day and time zone, this week's AI usage, and how many times the subscription has been moved to a different household. For in-progress AI requests: reservations, each with a random ID, the estimated tokens and the time it was made. A reservation is removed when its request finishes. One left unfinished for 5 minutes is charged at its estimate and kept, up to the 20 most recent, until the household's week ends |
It holds no names, email addresses, phone numbers, Apple Account details, recipes, meal plans, allergies or AI answers.
AI output can be wrong. Always check recipes and plans against your household's allergies and needs.
7. Subscriptions and payments
- Subscriptions are sold and billed by Apple through the App Store. We never receive your payment card, bank details, name or email address from Apple.
- The app checks what you're subscribed to with Apple's StoreKit, on your device.
- When the household admin sets up AI features, the admin's app sends Apple's signed record of the Household Plus purchase to our server. The server checks it and keeps the subscription details listed in section 6.
- Apple may send our server signed notices when a subscription renews, ends, is refunded, changes plan, or enters or leaves a billing grace period. This keeps the household's AI access correct. Our server applies a notice only to households it already knows about. It discards the others without storing them.
- You manage or cancel subscriptions in your Apple Account settings, and ask Apple for refunds.
8. Information Apple gives us
- TestFlight. If you test Tucker through TestFlight, Apple gives us some information about testers under Apple's TestFlight terms. This can include the name and email address you were invited with, the feedback and screenshots you choose to send, crash reports, and basic device and usage details.
- App Store. If you've chosen in iOS settings to share analytics with app developers, Apple may give us crash reports and summary usage statistics.
We use this information only to fix problems and improve Tucker.
Tucker writes some diagnostic messages to Apple's system log on your device. Tucker doesn't send these anywhere itself. Apple's own diagnostics may collect system logs if you've turned that on in iOS settings. Tucker's messages don't include names, contact details, links or iCloud identifiers. Identifiers appear only as short scrambled tags.
9. What we don't do
- We don't show ads.
- We don't use your device's advertising identifier, and we don't track you across other companies' apps or websites. The only records our server keeps about devices are the operational ones described in section 6, and Cloudflare's short-lived technical logs.
- We don't sell or rent personal information, or share it for advertising.
- We don't include third-party analytics, crash-reporting, advertising or social-media code in Tucker. The app contains no third-party code libraries.
- We don't build profiles of you or your family.
- We don't send you marketing email. We don't have your email address unless you write to us.
If you open a recipe's source link, it opens on that website. The website's own privacy policy applies.
10. Children
Tucker is designed for adults running a household. It isn't directed at children under 13, and we don't knowingly collect personal information directly from children.
Families often include children, so a household's information may relate to them:
- A child with their own Apple Account can be invited to a household. Their name, as their Apple Account provides it, is then visible to the household. The admin decides what each member can change. For example, the admin might allow a child to vote only.
- Parents may record things about children, such as dislikes.
This information stays on your family's devices and in iCloud. Our server holds no names. For AI features, children are included only as numbered household members with any diet and dislikes, as described in section 6.
We recommend that a parent or guardian sets up the household and decides who joins. If you believe we hold information about a child that we shouldn't, contact us and we'll delete it.
11. Allergies, diets and other health-related information
Diets and allergies can be health information, which Australian privacy law treats as sensitive. We handle it carefully:
- This kind of information reaches our server only through AI features. It can include diets (vegetarian, vegan or gluten free), dislikes and the week's goal for plans and swaps, or a list of allergens to avoid when writing a new recipe. It is never linked to a name. It isn't stored on our server, and it is passed to OpenAI only to complete that request.
- We'll ask first. Before any feature sends allergy or diet information to our AI provider, the app will ask for your explicit permission and explain that the information will be processed by OpenAI in the United States.
- Allergies aren't part of weekly plan or swap requests. Tucker is designed to filter out unsuitable recipes on your device first, and that filtering will be in place before these AI features are switched on.
- Coming later: saving each member's allergies and diets in the app is still being built. Our plan is to keep it on your devices and in your household's iCloud, like other household data, and not on our server. We'll update this policy before that feature is released.
Tucker isn't a medical or dietetic service. Always check ingredients yourself.
12. Keeping and deleting your information
On your device
You can delete recipes and other items in the app. Deleting Tucker from a device removes the data it stores on that device. iOS may keep the small Keychain entry that holds Tucker's random device-key ID until the device is erased. That entry contains nothing about you or your household.
In iCloud
- Household admin: you can delete Tucker's iCloud data in your iPhone or iPad Settings, under your Apple Account's iCloud storage, by choosing Tucker. Doing this deletes the household's shared data for every member.
- Member: leaving the household removes your access. It doesn't delete what's in the admin's iCloud, including changes you made.
- Apple's own retention of iCloud data is described in Apple's privacy policy.
On our server
- This week's AI usage resets at the start of each household week. Earlier weeks' usage isn't kept.
- Invitations expire after 7 days.
- A member's device is removed from the household list when the member leaves or the admin removes them. It's also removed when the device joins another household.
- There is no automatic deletion of the other server records yet. They stay until you ask us to delete them, or until we delete them while maintaining the service. We intend to add automatic deletion of records for households and devices that are no longer active.
To ask us to delete server records, email [email protected]. Because our server holds no names or email addresses, please include something that lets us find your household. The best option is the order ID from the Apple receipt for your Tucker subscription. Deleting the records turns off AI features for that household until they're set up again. We'll confirm when it's done, within 30 days.
Emails you send us
We keep your emails only as long as we need them to deal with your request, and to keep a record of it.
13. Security
- The app talks to our server over encrypted connections (HTTPS) only. Our server accepts household and AI requests only when they're signed by a genuine copy of Tucker.
- The key our server uses to reach OpenAI is held in Cloudflare's secret storage. It is never in the app.
- Invitation codes are stored on our server only in a hashed form.
- Our application logs are limited to technical details, with no request or answer content. Cloudflare's platform logs are kept for up to 7 days by default.
- On your device, Tucker's files use iOS data protection, and the device key record stays on that device.
No system is perfectly secure, but we work to protect the information we handle. If a data breach is likely to cause you serious harm, we'll tell you and, where required, the Office of the Australian Information Commissioner.
14. Information that leaves Australia
Some of the services Tucker relies on store or process information outside Australia:
| Provider | What | Where |
|---|---|---|
| Apple | iCloud household data, App Store purchases, App Attest and TestFlight | Apple's data centres, which may be outside Australia |
| Cloudflare | Runs our server and stores its records. Cloudflare sees your device's internet (IP) address when the app connects. Our server's code uses that address only to count device set-up attempts for a one-minute rate limit, and doesn't save it. Cloudflare's rate-limiting service holds that count briefly. Cloudflare's platform logs record technical details about each request and are kept for up to 7 days by default | Cloudflare's global network, so the location may be outside Australia |
| OpenAI | AI requests, as described in section 6 | The United States |
These providers handle information under their own terms and privacy policies.
15. Your rights and choices
- Use Tucker without telling us who you are. Tucker works without giving us your name or contact details.
- Access and correction. You can see and change almost everything Tucker holds directly in the app. To ask what our server holds about your household, or to correct or delete it, email [email protected]. We'll respond within 30 days. We may need information such as your Apple receipt order ID to find your records.
- Complaints. If you have a privacy concern, please contact us first and we'll respond within 30 days. If you're not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC) at www.oaic.gov.au.
- Outside Australia. Depending on where you live, you may have other rights under local law. These can include the right to access, correct, delete or move your information, or to object to how it's used, and the right to complain to your local data protection authority. Contact us and we'll help where those rights apply. We haven't yet reviewed this policy against every country's privacy laws.
16. Changes to this policy
Tucker is still growing. Features being built include a shared recipe book and shopping list, saved allergies and diets for each member, Apple Health, calendar and Reminders connections, notifications you see (such as use-by reminders, which are separate from the silent iCloud signal described in section 3), importing recipes from photos and other apps, and widgets. We'll update this policy before any feature that uses information in a new way is released.
When we change this policy, we'll update the effective date at the top. For significant changes, we'll also let you know in the app or in the release notes where practical.
17. Contact us
Matt Guetlich (Paper Plane Labs)
Email: [email protected]