How Tuck protects your vault

Encryption is part of Tuck’s default design, not an optional mode. Your vault uses a random 256-bit data-encryption key. Tuck uses that key to encrypt the content that should stay private, including thought titles and bodies, tag names, attachment bytes, and todo titles. Your passphrase does not encrypt every thought directly. It protects the vault key that does.

What stays readable to the service

Some metadata must remain available so Tuck can perform work while no device is unlocked. Examples include reminder timing, reminder destination, some dates and IDs, account information, and the plaintext snapshot of a thought you explicitly share. If you enable hosted MCP, the selected personal brains also have a separate readable published copy. Even without full text, the Summary level includes short snippets and other selected fields. This is an explicit exception to keeping thought content within the encrypted vault. See Sharing and connected-data privacy. When you use Tuck AI, the items your device lists under What’s leaving are sent through Tuck’s server to an AI model so it can answer you. See Tuck AI.

What Tuck does not need for product telemetry

Product telemetry is designed around counts and mediums rather than thought bodies.

For implementation details, see the Encryption model and Architecture pages in Reference.