Tukko Privacy Policy
Version: v1.9, updated 2026-09-08 — the operator status in §1 has been clarified: the stage is now described as open testing, and the promise to state the details of a legal entity is made conditional on the app leaving the testing stage. The earlier wording committed us to publishing those details before public release — a commitment that would have been broken at the moment of release itself.
The previous version v1.6 (2026-08-28) corrected a retention statement. Earlier revisions said that the seven-year retention of consent records is "required by COPPA §312.8". That is inaccurate: §312.8 obliges an operator to protect retained data with reasonable security and to be able to confirm that consent was obtained, but it names no specific number of years. Seven years is a period we chose ourselves and consider reasonable for that confirmation; the text now says so. Additionally, the public address of the sub-processor registry (tukko.eu/sub-processors) is now stated — it is already live. Effective date: 2026-06-04 Last updated: 2026-09-08
1. Who we are
⚠️ Status: open testing. Tukko is at the testing stage. At this stage the operator is a private individual; no legal entity has been incorporated. You can contact the operator at privacy@tukko.eu — this is a working channel for any question about data, including the exercise of your rights. If the app leaves the testing stage, the operator will become a legal entity. We will announce this in advance and state its full details here (name, jurisdiction, postal address).
Tukko is a children's daily-schedule app. This policy explains what data we collect, why, and how to exercise your rights under COPPA (United States), GDPR / GDPR-K (European Union), and other applicable laws.
If you have questions, contact us at privacy@tukko.eu.
Formal risk assessment: We maintain a Data Protection Impact Assessment (DPIA) under GDPR Article 35 — required because Tukko processes children's data. The full DPIA is available on request at the address in §14. It enumerates every processing category, the legal basis for each, the risks to data subjects, and the concrete mitigations we have in place. It is the same document we file with EU data protection authorities on request.
2. Who this policy applies to
- Parents and legal guardians ("parents") who create an account and consent to processing on behalf of their child.
- Children under 13 (US) or under the applicable digital-consent age in your jurisdiction (13–16 in the EU). Children use Tukko only after a parent has provided verifiable consent.
- Co-parents invited to share a family account.
3. What data we collect
| Category | Source | Purpose | Legal basis |
|---|---|---|---|
| Email address | Parent provides at sign-up | Account auth, parental consent confirmation, account-recovery email | Contract (Art 6(1)(b) GDPR), consent (Art 6(1)(a) for COPPA) |
| Display name | Parent provides | Personalisation | Contract |
| Child first name / display nickname | Parent provides | Schedule display | Consent (Art 6(1)(a) + COPPA §312.5) |
| Child age in years (optional) | Parent provides | Jurisdictional digital-consent-age tracking (FR-071) | Legitimate interest (Art 6(1)(f)) |
| Schedule data (daily blocks, todos, rewards, points) | Parent + child enter | Core product function | Contract |
| Chat messages (parent ↔ child, parent ↔ co-parent) | Users send | Family communication | Contract |
| Avatar image (optional) | Parent uploads | Profile personalisation | Consent (Art 6(1)(a)) |
| Authentication logs (sign-in events, hashed user_id, IP-prefix) | Auto-collected | Fraud detection, COPPA §312.8 record-keeping | Legitimate interest (LIA available on request) |
| Crash reports (parent sessions ONLY) | Sentry SDK | Diagnose crashes | Consent (Art 6(1)(a)) — OFF by default; opt-in via Privacy panel |
| Product analytics events (parent sessions ONLY) | PostHog SDK | Understand feature usage to improve the product | Consent (Art 6(1)(a)) — OFF by default; opt-in via Privacy panel |
We do NOT collect:
- Tracking advertising identifiers (Apple IDFA / Google AAID)
- Behavioural analytics from third parties for ad-targeting purposes
- Health data (parents are instructed not to enter health information in free-text fields)
- Biometric data
3.1 Crash reports (crash_reports scope)
When this scope is enabled, Tukko's Sentry SDK captures crash and error reports from parent sessions only. A typical report contains: stack traces, OS version, app version, anonymous install ID, and the screen route where the crash occurred. A built-in PII scrubber removes sensitive keys (emails, child names, schedule content, chat messages) before the event leaves the device.
- What we collect: stack traces, OS/app version, anonymous install ID, route name.
- What we do NOT collect: child sessions, personal content (names, messages, schedule items), advertising identifiers.
- Sub-processor: Sentry — Functional Software, Inc. (EU region).
- Legal basis: Consent (GDPR Art 6(1)(a)). OFF by default; the parent opts in via Settings → Privacy in the app. Consent may be withdrawn at any time with the same toggle (GDPR Art 7(3)).
- Tied to: an anonymous install ID (random UUID), not to the account email.
- Retention: 90 days at Sentry (default), then auto-purged.
- Apple Kids Category contingency: if Tukko ships under the Kids Category, this scope is hard-disabled on every session, parent included — see §13.
3.2 Product analytics (analytics scope)
When this scope is enabled, Tukko sends anonymous product-analytics events to PostHog from parent sessions only. We use these events to understand which features are used, where parents get stuck, and how to prioritise improvements. We do not use these events for advertising and we never sell them.
- What we collect: anonymous event names (e.g.
schedule_block_created), screen views, feature-usage flags, app/OS version. - What we do NOT collect: personal content (child names, schedule details, chat messages, avatars), email addresses, precise location, advertising identifiers, cross-app/cross-site tracking.
- Sub-processor: PostHog — PostHog Inc. (EU region).
- Legal basis: Consent (GDPR Art 6(1)(a)). OFF by default; the parent opts in via Settings → Privacy in the app. Consent may be withdrawn at any time with the same toggle (GDPR Art 7(3)).
- Tied to: a random device-level identifier (
device_idUUID), not to the account email. The identifier is regenerated on app reinstall. - Retention: per the PostHog project retention policy (operator-configured); withdrawing consent stops new captures immediately. The parent may additionally tick "Also delete data already collected" in the disable confirmation sheet — this calls PostHog's
/engageperson-profile delete endpoint server-side. - Opt-out asymmetry: when the parent turns this scope ON we record a one-time
analytics_toggledevent so we know the opt-in happened; when they turn it OFF the opt-out runs first, so no further events (including the toggle event) are sent.
4. How children's data is protected
- A parent must provide verifiable parental consent via the email-plus method (FTC COPPA FAQ H.5) before any child data is stored.
- The parent ticks an unchecked consent box in-app, then confirms via a link sent to their verified email. Only after both steps does the child account become usable.
- Crash reports are never sent from child sessions, regardless of any toggle state.
- Children's avatars are stored in a private bucket; only authenticated family members can fetch them.
- All consent records are append-only and retained 7 years. COPPA (§312.8) requires an operator to be able to confirm that consent was obtained, but sets no specific period: seven years is a retention period we chose as reasonable for that confirmation.
Parents may withdraw consent at any time via Settings → Privacy → Revoke and delete account, or via the link in the consent-followup email. Withdrawal deletes the child's data within 30 days.
5. Who we share data with (sub-processors)
The live, versioned registry of every Tukko sub-processor is published at tukko.eu/sub-processors and is also available in the app: "More → Settings → Privacy & data → Sub-processors". The table below is a snapshot at the time this policy version was published and may lag the live registry by up to one publish cycle. For GDPR Art 28(2) purposes — including the 30-day notice of any new sub-processor — refer to the live page. Parents can subscribe to email notifications about new sub-processors in Settings → Privacy → "Notify me about new sub-processors" (spec 042).
| Sub-processor | Role | Region | Sub-sub-processors | DPA |
|---|---|---|---|---|
| Supabase | Database, Auth, Storage, Edge Functions | EU (Frankfurt) | AWS, Cloudflare | No separate DPA signed — deferred until incorporation |
| Sign-In with Google | Global | — | No separate DPA signed — deferred until incorporation | |
| Apple | Sign in with Apple, APNs | Global | — | Apple Developer Program terms |
| Expo | Push notifications, OTA updates | US | FCM, APNs | No separate DPA signed — deferred until incorporation |
| Sentry — Functional Software, Inc. | Crash reporting (parent opt-in only — see §3.1) | EU region | — | No separate DPA signed — deferred until incorporation |
| PostHog — PostHog Inc. | Product analytics (parent opt-in only — see §3.2) | EU region | — | No separate DPA signed — deferred until incorporation |
| Resend | Transactional email (consent confirmation, data export delivery) | EU | — | DPA not signed — execution deferred until incorporation |
We do not sell personal data and do not share it for behavioural advertising.
6. International data transfers
Tukko's primary data store is in the EU (Supabase Frankfurt region). Transfers to non-EU sub-processors rely on Standard Contractual Clauses (SCC Module 2) and the supplementary measures set out in our Transfer Impact Assessment (Schrems II / EDPB Recommendations 01/2020), available on request.
7. How long we keep data
| Data | Retention | Reason |
|---|---|---|
| Account + schedule + chat | Lifetime of account + 30 days after deletion request | Contract |
| Parental consent records | 7 years (our chosen period) | Proving consent was obtained; COPPA §312.8 requires that ability but names no period |
| Authentication audit log | 7 years (our chosen period) | Legitimate interest — fraud detection (LIA available on request) |
| Data export ciphertext | 7 days from generation | Single-use security model |
| Crash reports | 90 days at Sentry | Sentry default |
| Product analytics events | Per PostHog project retention (operator-configured) | PostHog default; deletable on demand via /engage (see §3.2) |
The full retention schedule is available on request at the address in §14.
8. Your rights
You have the right to:
- Access your data — Settings → Privacy → Download my data
- Rectify errors — edit profile / schedule directly in the app
- Erase your data — Settings → Privacy → Revoke and delete account (30-day cascade)
- Restrict processing — pause scopes via Settings → Privacy toggles
- Port your data — same as Access; we provide JSON
- Object — opt out of any scope without account closure (except
core) - Withdraw consent — same as Erase
- Complain to your supervisory authority (in the EU, the data protection authority of your member state)
To exercise these rights, use the in-app controls or email privacy@tukko.eu. We respond within 30 days.
9. Children's rights (COPPA + GDPR-K)
In addition to the rights above, parents may:
- Review what data Tukko has collected about their child
- Refuse further collection (toggle child off)
- Delete the child's data without deleting their own account
- Withdraw consent to any optional scope
10. Security measures
- Transport encryption (TLS 1.3) for all data in transit
- Database encryption at rest (Supabase default)
- Application-layer AES-256-GCM encryption for data exports
- Row-Level Security (RLS) on every table containing user data
- Parental-consent gate enforced at the database layer — client bypass is not possible
- Sentry PII scrubber removes sensitive keys before any event leaves the device
- The full Privacy by Design mapping is documented and available on request
11. Changes to this policy
When we materially change this policy, we will:
- Publish a new version on this page with a new effective date
- Notify parents in-app and require re-consent before continuing
- Hash the new version (SHA-256) and log it to an audit trail for tamper-evidence
For non-material changes (typo fixes, contact updates), we may publish without re-consent but will still log the new hash.
12. Tracking technology declaration
Tukko does NOT use:
- Apple App Tracking Transparency (ATT) tracking —
IDFAis not collected - Google Advertising ID (AAID) — not collected
- Behavioural ad networks
- Cross-app/cross-site tracking
- Pixels or third-party cookies
Tukko does use a first-party product-analytics SDK (PostHog) to understand feature usage — strictly opt-in, parent sessions only, tied to a random device identifier, and never used for advertising. See §3.2 for the full description.
This declaration maps to Apple App Privacy "Data Not Linked to You" / "No Tracking" and Google Play Data Safety "No data shared for advertising".
13. Apple Kids Category contingency
If Tukko is published under Apple's Kids Category (versus Productivity), additional restrictions apply: crash reporting and product analytics are disabled on all sessions (including parents), and certain external link flows are gated through a parental challenge.
14. Contact
For privacy questions or to exercise your rights:
- Email: privacy@tukko.eu
- Postal address: to be published if the app leaves the testing stage and the operator becomes a legal entity (at present the operator is a private individual)
Breach notifications: we notify affected users within 72 hours of becoming aware of a personal-data breach, per GDPR Art 33–34.
Version v1.9, 2026-09-08. The current text is always available at this address; we announce material changes in the app and ask for consent again.