Your information.

What the app collects, and why

• How you sign in: your email address and the identifiers of the Apple or Google account you sign in with, through Privy. We use them to create and secure your account and to let you back in.
• Your wallet and payments: your wallet address, the payment codes you scan, merchant names, amounts, exchange rates and transaction references, some of which are on the public blockchain. We use them to show your balance, payments and receipts, and to handle refunds.
• Passport details you type in: given names, surname, nationality and passport number. The payment partner in each country requires the payer’s details with every QR payment, so we send them with each one.
• Identity verification for bank transfers: if you add money by bank transfer, Bridge verifies your identity in its own flow, including documents and a selfie. Bridge keeps those. We keep only the outcome and its reference.
• Your bank details: the account details Bridge issues in your name, so the app can show them to you.
• Diagnostics: which screens and steps succeed or fail, and error reports, so we can keep Tucu working. They never include a payment code, a merchant, a wallet address, a transaction reference or an exact amount. There is no session recording, and we do not use your IP address to locate you.
• Notifications: if you allow them, your phone’s notification address, so we can tell you about your payments, money arriving or coming back, security, your identity check, your eSIM and replies from support. A notification shows the amount, the shop or person and what happened, unless you turn on Hide amounts in the app. You can turn notifications off in your phone’s settings.
• Messages you send us, in Tucu Support in the app or at tucu.app/help, and the photos you attach to them. How Tucu Support handles them is described below.

The app uses the camera only to read payment codes. It does not collect your location. We do not sell personal data. The legal bases are the contract with you, legal obligations such as anti-money-laundering rules, and our legitimate interest in keeping the service working and secure.

Who processes it for us

• Privy: sign-in and the infrastructure behind your wallet key.
• Bridge (a Stripe company): bank details in your name, identity verification for that service, and conversion of your bank transfer to USDC.
• Manteca and its group companies: conversion and payment to the merchant in Argentina and Brazil. They receive your passport details with each payment.
• Convex: our database and backend.
• PostHog and Sentry: diagnostics and error reports, both hosted in the European Union.
• Resend: email. Vercel: hosting for this website.
• Anthropic (Anthropic, PBC, in the United States): writing Tucu Support’s automatic replies, and helping the Tucu team read and sort Tucu Support conversations, as described below.
• Expo, Apple and Google: delivering notifications to your phone. Their text passes through Expo’s servers in the United States, which do not store it in a database.

Each provider processes information on our behalf or under its own terms, and may process it outside your country. Transfers out of the European Economic Area and the UK rely on standard contractual clauses or equivalent safeguards.

Tucu Support

Tucu Support answers your questions in the app and at tucu.app/help. Most replies are written automatically by Claude, a model made by Anthropic, and a person from the Tucu team joins when a question needs one. Anthropic processes the conversation for us under its Commercial Terms and Data Processing Addendum, and may not train its models on it. Anthropic deletes what it receives within 30 days, unless it must keep something longer to enforce its usage policy or because the law requires it (Anthropic’s privacy center, page dated 1 July 2026).

• What Claude reads: your messages and the Tucu records it needs to answer you, such as the payment, deposit or send you ask about. Only your own records.
• What Claude never receives: the photos you attach. Email addresses, phone numbers, document numbers, bank details, wallet addresses and transaction references are masked before your words are sent: Claude is told what kind of detail was there, not the detail itself. Recovery phrases, private keys, card numbers and login codes are removed before anyone sees them, the Tucu team included.
• What is not masked: names and street addresses you write in a message.
• Who else reads it: the Tucu team reads conversations, and answers when a question needs a person. The team also uses Claude to read and sort conversations and the records behind them, with the same masking and with your name cut to initials, under Anthropic’s Commercial Terms and Data Processing Addendum. Anthropic may not train its models on them and deletes them within 30 days.

How long we keep it

• Account, payment and deposit records, and the passport details you entered: five years after your account closes, as anti-money-laundering rules require. Then we erase your name, @name, email and passport details, and the records left no longer say who you are.
• Identity verification results: kept by Bridge for the period its rules require.
• Error reports: up to 90 days. Product diagnostics: up to seven years, without your name or contact details.
• Tucu Support conversations: two years after their case closes. Photos you attach: 30 days after their case closes, or at once when your account closes.
• Your phone’s notification address: until your account closes. The record of notifications we sent: 180 days.

Blockchain records are public and permanent, and no one can delete them.

Deleting your account

You can delete your account in the app: Account, then Delete account. Your wallet must be empty first, or its key exported, and no payment, refund or bank deposit may still be in progress. Payments and deposits to your bank details stop at once, and if you sign in with Apple, Tucu’s access to your Apple ID is removed. We close the account 30 days later, and you can cancel until then by signing in.

Closing deletes your sign-in, so it can’t be used again. Privy archives its record at that point, and we ask Privy to delete it. The photos you sent to Tucu Support and your phone’s notification address are deleted at once. Your Tucu Support conversations are kept two years after their case closes. We keep your payment and deposit records and your passport details for five years after closing, then erase them. Your wallet address and its past transfers stay on the public blockchain.

The website and the waiting list

When you join early access, we collect your email address. You can also choose to share a destination and approximate travel timing. We record the signup source: a campaign label or the referring website’s hostname when available, the page on this website where your visit started, and the last article you read before joining. The page holds this in memory while you browse and sends it only when you join. It is not stored in cookies or browser storage, and we do not record full referring addresses. You do not need an identity document, bank details or payment information to join.

We use these details to send early-access invitations and launch updates, understand where prospective users are travelling, and learn which sources bring people to Tucu. Joining gives us permission to email you about Tucu. We do not sell your waiting-list information.

Your signup is stored in our database, hosted by Convex. Resend holds a copy of your contact details and sends our emails, including the confirmation when you join. Hosting providers may process technical request information, such as IP addresses and browser details, to deliver and protect the website. To stop automated signups, we limit how many signups one connection can make each hour. For this, our database receives a one-way code derived from your IP address, never the address itself, and deletes it within two hours. The website does not use advertising cookies or session replay.

We use Vercel Web Analytics to count page views. It records the page address, the referring website, approximate location, and your device, browser and operating system type. It recognises a visit from a value derived from the request, not from cookies, and discards it after 24 hours. We see only aggregated statistics, which do not identify you or follow you across other websites.

We also use PostHog, hosted in the European Union, to count page views and see how visits move between pages. It records the page address, the referring website, approximate location, and your device, browser and operating system type. PostHog uses your IP address to work out the approximate location and does not store the address. On this website it keeps nothing in cookies or browser storage, so it does not recognise you on a later visit, and it does not record what you type or click. Neither PostHog nor Vercel Web Analytics runs on Tucu Support, the wallet export page or invite links.

We keep waiting-list details while running early access and sending the updates you asked for, and remove them when they are no longer needed or when you ask. Every update includes a way to unsubscribe.

Your rights

Depending on where you live, you can ask to access, correct, delete or port your information, restrict how we use it, or object to its use. Write to hello@tucu.app. We answer within one month. If you are in the European Economic Area or the UK, you can also complain to your data protection authority.

Some information cannot be deleted on request, because the law requires us or our providers to keep it, or because it is on a public blockchain.

Security and age

Your wallet key stays under your control through Privy’s infrastructure. Tucu cannot access it. Information travels encrypted, and access to our production systems is limited to the people who operate Tucu.

Tucu is for people aged 18 and over. We do not knowingly collect information from children.

Changes and contact

When this notice changes, we publish the new version here with a new date.

Questions about privacy: hello@tucu.app.