Skip to main content
Some Tuck features only work because you explicitly ask Tuck to exchange information with another system.

Shared thoughts

A shared link is a plaintext snapshot you chose to publish. The recipient does not need your vault key to read it.

Calendar and mail connections

When you connect a calendar or mailbox, Tuck fetches information on your behalf so it can attach meeting and message context to your day. Tuck’s design keeps pulled mail as context rather than automatically saving every message as a thought.

Email and SMS ingest

Inbound messages arrive at Tuck before an unlocked device can encrypt them. After a device pulls and acknowledges the item, the ingest service deletes the full inbound body, keeping only the minimum reminder fields when a scheduled reply is required. For email sent to your Send To address, Tuck also keeps a raw copy for 7 days so a delivery that fails can be tried again.
Use share links, connected accounts, and ingest when the convenience is worth the intentional boundary crossing. The rest of your vault stays encrypted.

Address books

CardDAV credentials are stored encrypted in your vault. When you sync, your unlocked device sends the credentials to Tuck’s server so it can fetch your address book over HTTPS. The server handles the credentials and returned contact data during that request. This connection is not end-to-end encrypted between your address-book provider and your vault.

Pocket recordings

Pocket summaries and transcripts can wait on Tuck’s capture service before an unlocked device encrypts them into your vault. Tuck deletes the queued payload after the device acknowledges it. Unclaimed payloads expire after 30 days. Your Pocket API key is stored encrypted in the vault. Tuck’s server handles it when the client makes Pocket API requests, including connection checks and imports. The webhook signing secret is stored server-side so incoming deliveries can be verified while your vault is locked. Choosing a shared destination brain makes imported thoughts available to that brain’s members. See Connect Pocket.

Tuck AI

Tuck AI sends something only when you ask a question or choose a Tuck AI action. Your unlocked device picks what goes and lists it under What’s leaving before you send. Tuck’s server passes it to Anthropic’s Claude models to write the answer. Tuck AI doesn’t receive your vault key, and Tuck’s server doesn’t read your vault to answer. Email addresses, phone numbers, links, files, shared brains, and items your device can’t decrypt are left out. Mail is sent only when you turn on Include recent mail on a person’s card. Person summaries and meeting briefs are kept on your device, encrypted with your vault key, and don’t sync. See Tuck AI.

Hosted MCP

Hosted MCP publishes a separate plaintext copy of information from personal brains you explicitly opt in. Each brain is Off, Summary, or Full text. Summary includes titles, snippets, names, dates, linked todo and Await details, and how many comments a thought has. Full text adds thought text and the text of its comments. An optional Event times switch, off by default, adds the start and end times of events your Awaits wait on. Event titles are never published. The unlocked web app creates and updates this copy. The MCP server reads the hosted copy without decrypting the vault or receiving its key. The copy remains readable through an authorized token while your devices are locked or offline. Tuck can read the hosted copy. Setting a brain to Off deletes its hosted copy; revoking a token stops future access through that token. Neither action recalls information already received by an assistant. See Hosted MCP. Write access is optional and controlled per token. Writable-brain selection does not narrow read access. Write commands are queued in plaintext until an unlocked device applies and encrypts them. Optional per-token webhooks send signed change identifiers without thought bodies. See MCP webhooks.