1. About This Policy
This Privacy Policy explains how The GFF Co. Ltd, trading as Tucki and Tucki AI, collects, uses, stores, and protects personal data when you use the Service. We are committed to protecting your privacy and complying with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and the Privacy and Electronic Communications Regulations (PECR). Where these regulations are updated, replaced, or extended, we will adapt our practices and this policy to remain compliant.
2. Who We Are
The GFF Co. Ltd is the data controller responsible for your personal data.
- Company number: 15047548
- Registered office: 124 City Road, London, EC1V 2NX
- ICO registration reference: ZB672005
For any questions about this policy or how we handle your data, please contact support@tucki.ai.
3. Information We Collect
3.1 Information You Provide
- Account details: your name, email address and how you sign in (email code, Apple or Google). We never see your Apple or Google password.
- Household details: family members' first names or nicknames, ages or dates of birth, sex, height and weight, and their goals.
- Health and dietary information you choose to give us: allergies, intolerances, diet type, medical conditions and pregnancy.
- Your meal plans, meal logs, recipes you add, shopping lists, notes and progress entries.
- Photos you take or choose in the app: meals, supermarket receipts, recipes and profile pictures.
- Shopping and budget information: your weekly budget, your supermarket, and the items and prices on receipts you scan.
- Messages: your chats with Tucki, messages in your family chat, and messages to our support team.
- Voice: if you talk to Tucki, your phone's own speech service (from Apple or Google) turns what you say into text. We receive the text, not a recording.
- Codes, invitations and referrals you use or send.
3.2 Information We Collect Automatically
- Device information (device type, operating system, app version, language) and app identifiers, such as the identifier your phone gives the Tucki app and your push notification token
- Your approximate location, only if you allow it, used to set your region for supermarket prices. We do not track your location.
- Usage analytics: which screens and features you use. For a small sample of sessions we also record how the app's screens are used (session replay) so we can find and fix problems.
- Your IP address, used for security and to estimate your country
- Subscription and purchase information, through RevenueCat and the App Store or Google Play
- Crash and performance reports that Apple or Google share with us, if you have allowed this on your device
3.3 Information About Children
Parents and guardians may create and manage profiles for children within their household. These profiles may include the child's first name or nickname, age, dietary preferences, and allergens. We process this information only on the instructions of the parent or guardian responsible for the account.
3.4 Health Information
Some details you can give us are health information, such as allergies, intolerances, medical conditions and pregnancy. We use them only to tailor meals, recipes and nutrition targets for your household. We never use health information for advertising and never share it with advertising partners. You can change or remove it at any time in the app.
4. How We Use Your Information
We process personal data to:
- Deliver, personalise, and improve the Service
- Generate AI-driven recommendations and household insights
- Manage subscriptions, payments, and account functionality
- Communicate service updates, security notices, and, where applicable, marketing
- Detect, prevent, and respond to fraud, misuse, or security incidents
- Comply with our legal and regulatory obligations
- Check photos and shared content automatically to keep Tucki safe
- Measure how well our own adverts work (see section 6)
We never sell your personal data to third parties.
5. Legal Bases for Processing
We process personal data under one or more of the following lawful bases under the UK GDPR:
- Performance of a contract: to deliver the Service you have subscribed to and to manage your account.
- Legitimate interests: to analyse usage, improve the Service, protect our systems, and communicate with existing customers about similar features.
- Consent: for optional features, where required by law, and for the processing of children's data by the responsible parent or guardian.
- Explicit consent: for health information (section 3.4). You can withdraw it at any time by removing it in the app or by contacting us.
- Legal obligation: to meet financial, tax, regulatory, or law enforcement requirements.
6. Data Sharing
We share personal data only with trusted service providers acting on our behalf, under contractual safeguards that comply with the UK GDPR. These include:
- Amazon Web Services: hosting, sign in (Cognito), file storage and automatic photo checks (Rekognition), mainly in the EU (eu-west-1)
- OpenAI and Anthropic: artificial intelligence that reads meal photos, receipts and recipes and answers your chats with Tucki. Under their business terms they do not use your data to train their models.
- RevenueCat: subscription management
- Apple and Google: app distribution, sign in, payments, push notifications and speech to text
- Amplitude: product analytics and session replay
- Google Firebase: app analytics and push notifications
- Customer.io: emails, push notifications and in-app messages
- Branch: links that open the app, and invitations
- Meta (Facebook): a small number of app events, such as an account being created or a subscription starting, so we can measure our own adverts on Facebook and Instagram. We do not collect your device's advertising identifier, and we never share health information, photos or messages with Meta.
- Contentful: hosts our recipes and guides (no personal data)
People in your household can see what you share with the household, such as the family chat, the meal plan and household recipes. Recipes you choose to publish to the Tucki community can be seen by other Tucki users. We do not use your data to track you across other companies' apps or websites, and we do not sell it or share it with data brokers.
We may also share personal data where required by law, regulation, court order, or other legal process, or in connection with a corporate transaction such as a merger, acquisition, or sale of assets.
7. International Data Transfers
Most personal data is stored on servers within the European Economic Area. Some of our providers, including OpenAI, Anthropic, Amplitude, Customer.io, Meta, Branch and Google, may process data in the United States.
Where this happens, we rely on the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses, as appropriate. These mechanisms ensure that your personal data continues to receive a level of protection equivalent to that provided under the UK GDPR.
You may request more information about the specific safeguards in place by contacting support@tucki.ai.
8. Data Retention
We retain personal data for as long as your account is active and for as long as needed to provide the Service.
After account deletion, we may retain personal data for up to one month to meet legal or operational requirements, for example in backups. After this period, data is either permanently deleted or anonymised so that it can no longer be associated with you.
Certain records, such as financial and tax records, may be retained for longer where required by law (typically six years).
9. Data Security
We use industry-standard measures to protect personal data, including:
- AWS Cognito for secure authentication
- JWT-based authorisation
- Encryption of data in transit and at rest
- Anonymisation where appropriate
- Access controls and ongoing monitoring
If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify affected users and the Information Commissioner's Office (ICO) within 72 hours of becoming aware of it, as required by law.
10. Children's Privacy and the Children's Code
Tucki is designed with families in mind, and we take the protection of children's data seriously.
In line with the UK GDPR, we do not knowingly collect personal data directly from a child under the age of 13 without verified parental consent. Where the regulatory position on the digital age of consent changes in the UK, we will adapt our practices and this policy to remain compliant.
Only adults can create a household account. The account holder can invite family members aged 13 or over to sign in to the household with their own login. Children under 13 cannot have their own login; their profiles are created and managed by the parent or guardian.
We design our Service in line with the principles of the ICO's Age Appropriate Design Code (the "Children's Code"), which sets out 15 standards for online services likely to be accessed by children. These principles include consideration of the best interests of the child, age-appropriate application, transparency, data minimisation, and turning high-privacy settings on by default.
As Tucki introduces dedicated child-facing profile views and experiences, we will continue to update our processing activities, communications, and product design to remain compliant with the Children's Code and any equivalent successor framework.
Where a parent or guardian wishes to exercise any data protection right on behalf of a child, they may do so by contacting support@tucki.ai.
11. Automated Decision-Making and Profiling
Tucki uses automated processing and AI-driven personalisation to generate recommendations, nudges, and household insights. These outputs are designed to assist, not replace, your own decision-making.
We do not use automated processing to make decisions that produce legal or similarly significant effects on you. If you would like to understand how a particular recommendation has been generated, or wish to object to certain types of profiling, please contact support@tucki.ai.
12. Your Rights
Under the UK GDPR, you have the right to:
- Access the personal data we hold about you
- Request correction of inaccurate or incomplete data
- Request deletion of your personal data (the "right to be forgotten")
- Restrict or object to certain processing
- Request data portability
- Withdraw consent at any time where we rely on consent
- Lodge a complaint with the Information Commissioner's Office
To exercise any of these rights, contact support@tucki.ai. We will respond within one month of receiving your request, in line with the UK GDPR.
13. Deleting Your Account and Data
You can delete your Tucki account and the personal data linked to it at any time, in the Tucki app or by email. This applies to the Tucki app on Google Play and the App Store, provided by The GFF Co. Ltd.
In the Tucki app
- Open the Tucki app and sign in.
- On the Home screen, tap the menu icon at the top of the screen.
- Tap Account Settings.
- Scroll to the bottom and tap Delete account, below Log out.
- Tap Delete to confirm.
In short: Menu → Account Settings → Delete account → Delete.
This deletes your account, your sign-in and your household's data straight away.
By email
If you no longer have the app, email support@tucki.ai from the email address you use to sign in, with the subject line "Delete my Tucki account". We will confirm by email and delete your account, including your sign-in, within one month of your request.
Deleting some of your data
To delete specific data without deleting your account, such as photos, meal logs or a family member's profile, email support@tucki.ai and tell us what you would like removed.
What is deleted and what we keep
- Deleted: your account details, household setup and family member profiles, dietary preferences and allergens, goals, meal plans, meal logs, notes and progress entries, photos, recipes and messages.
- Kept: records of purchases and subscriptions, for up to six years where the law requires them for financial and tax purposes.
- Retention period: as set out in Data Retention, we may keep personal data for up to one month after account deletion. After that it is permanently deleted or anonymised.
Deleting your account does not cancel a subscription. Cancel it in Google Play (Payments & subscriptions → Subscriptions) or in your Apple ID settings (Settings → your name → Subscriptions).
14. Marketing & Communications
We may send you occasional in-app messages or emails about new features, product updates, and offers we think will be of interest to you.
You can opt out of marketing communications at any time by using the unsubscribe link in any marketing email, by turning off notifications for Tucki in your phone's settings, or by contacting support@tucki.ai. Opting out of marketing will not affect service-related communications you receive as part of using the Service.
16. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, our Service, or the law. Where changes are material, we will notify you by email or by in-app notice.
The "Last updated" date at the top of this policy indicates when it was most recently revised.
17. Contact & Complaints
The GFF Co. Ltd
124 City Road, London, EC1V 2NX
Email: support@tucki.ai
ICO Registration Reference: ZB672005
If you are not satisfied with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office at www.ico.org.uk, or by post at Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.