1. Who we are
TuckTuck is published by PlayMinima, operating from Quebec, Canada. PlayMinima is the enterprise responsible for the personal information described here.
Privacy officer — person responsible for the protection of personal information: support@tucktuck.app. Postal address: 150 rue de la Maçonnerie, Châteauguay, Québec J6K 0K4, Canada.
2. Who the game is for
TuckTuck is intended for ages 16+ and is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe someone under 16 has created an account, contact us so we can investigate and delete an ineligible account. See also our child safety page.
3. What we collect
Account and identity
- A Firebase account identifier. Play begins as an anonymous guest account, which still has an identifier even though you have given us no personal details.
- If you link a permanent account: your email address, and — for Google sign-in — the basic Google account identifier Google returns to us.
- Profile information you choose: display name, handle, and avatar preset.
Content and activity you create
- Covers you publish, including the rendered image, composition, and caption.
- Comments and replies you post.
- Votes, likes, saves, and the accounts you follow.
- Reports you submit about other players’ content or profiles.
Game state
- Your coin and gem balances, inventory, equipped items, level, streak, and daily progress.
- Purchase records for in-game items, including records of store transactions and refunds.
Technical and product events
- A bounded stream of gameplay events (for example, that a screen was viewed, an item was purchased, or a cover was published), each tied to your account identifier and a session identifier.
- Device and app integrity signals used by Firebase App Check to confirm that requests come from the genuine TuckTuck app.
- Google Analytics for Firebase collects app-instance identifiers, Android Advertising ID when available, app sessions and screen activity, purchase events, and approximate location derived from the device's IP address. This does not use GPS or precise-location permission.
- Unity Diagnostics collects crash and error reports, app performance and device information, diagnostic logs, and an installation-specific identifier. The current Android build enables these diagnostics and Firebase Analytics automatically; there is no in-game switch to disable them.
We deliberately keep text out of our gameplay event stream. Captions, comment text, profile fields, report details, contact information, and other content you write are never included in product events.
4. What we do not collect
- We do not collect precise location.
- We do not read your device's address book, photo library, microphone, or files. We do store in-game follows and the cover images the game renders when you publish them.
- Unpublished drafts stay on your device and are not uploaded to our servers.
- We do not sell personal information. The current game does not display ads; this does not prevent its Analytics SDK from collecting Advertising ID as described above.
5. Why we use it
- To run the game — authenticate you, keep your wardrobe and balances, publish covers, run briefs, and count votes.
- To keep the community safe — receive reports and let a human moderator review them.
- To keep the service working — diagnose failures, prevent abuse and fraudulent requests, and understand which parts of the game are used.
- To meet legal obligations — principally, keeping the financial records Canadian law requires us to keep.
We rely on your consent, on the necessity of processing to provide a service you asked for, and — for the financial records described below — on a legal obligation.
6. Automated decisions and content scanning
We do not automatically scan, hide, or block your captions, comments, or covers, and no automated system decides whether your account is blocked. Moderation begins with a report from a player and is decided by a person. Reaching 3 distinct reports marks a case as urgent for a reviewer; it does not hide the content or sanction the account by itself.
7. Who else is involved
- Google (Firebase) — authentication, database, file storage, serverless functions, and App Check. Google processes this data on our behalf as our service provider.
- Google Play — distribution and in-app billing. Google Play is the seller of record for those purchases and handles payment details directly; we never receive your card number.
- Google Analytics for Firebase — measures app usage and purchase events using the technical information described above.
- Unity Diagnostics — processes crash, error, and performance information on our behalf to help investigate reliability problems.
We do not sell, rent, or trade personal information.
RevenueCat helps validate in-app purchases and report purchases and refunds to our backend. It receives your Firebase account identifier, store transaction and product identifiers, purchase status, and app/device technical information needed by its SDK. We do not send it your password or card details. Google Play handles payment details directly. RevenueCat and Google may process information outside Quebec and Canada. Purchases are currently available through the Google Play testing release; availability depends on your build.
8. Where your data is stored
Our Firebase database, file storage, and server functions run in Google’s us-central1 region, in Iowa, United States. Personal information is therefore stored and processed outside Quebec and outside Canada, and may be subject to access by authorities under the laws of that country. We use Google Cloud’s contractual data protection terms for this transfer. By using TuckTuck you acknowledge this storage location.
The Iowa location applies to our main Firebase backend, not every provider's processing. Google Analytics, Unity, and RevenueCat may process technical and purchase data in other countries, including outside Quebec and Canada.
9. What is public
Your handle, display name, avatar, published covers, captions, comments, and your follower and following counts are visible to other players. Your email address, saved covers, balances, inventory, votes, and any report you file are not shown to other players. Unpublished drafts remain only on your device.
10. How long we keep it
We keep your account data for as long as your account exists. When you ask us to delete your account, we wait 7 days so you can change your mind, and then erase it.
Erasure covers, at minimum:
- your Firebase authentication identity;
- your profile, handle, and avatar;
- your covers, captions, and comments;
- your follows, followers, likes, and saves;
- your inventory, equipment, wallet, and gameplay ledger;
- reports you filed and moderation evidence identifying you;
- your product-event records and notifications;
- the deletion request itself, and audit entries that identify you.
Device-only drafts are not part of the server account and therefore cannot be erased by a website request. Clear the app data or uninstall the app to remove them from that device.
We also request deletion of the RevenueCat customer associated with your account. RevenueCat queues deletion asynchronously. Failed requests are retried; we do not treat a failed provider request as successful erasure. Deleting TuckTuck does not delete your Google account or erase records Google Play must keep as the payment provider.
Financial records required by law are retained separately. Where a real-money purchase or refund has occurred, the minimum record needed as accounting evidence is kept for approximately 6 years after the end of the relevant tax year, separately from your gameplay data. We do not keep a fraud profile, a moderation history, a first-party gameplay-event archive, or a deletion receipt after erasure. Any statistics that remain in our gameplay database are aggregated and do not identify you.
Analytics and diagnostic records use separate app or installation identifiers. The in-game account-deletion workflow does not automatically erase those provider records. Unity's default diagnostic retention is 90 days. Google Analytics is configured to retain event-level data for 2 months and user-level data for 14 months, with the user retention period reset by new activity. These limits do not cover standard aggregate reports. Contact our privacy officer for an access or deletion request concerning these records. We may need installation details to identify them and will explain any limitation; do not send a password. Provider processing and aggregate-report retention are separate from deletion of your gameplay account.
You may also delete individual content without deleting your account. The deletion page explains the controls, support request route, and information that remains while you keep playing.
11. Your rights
Subject to Quebec and Canadian law, you may:
- ask what personal information we hold about you and get a copy;
- ask us to correct information that is inaccurate or incomplete;
- ask us to delete your account and content — see Account & Data Deletion;
- ask for your information in a structured, commonly used technological format;
- withdraw consent, understanding that the game cannot run without an account;
- complain to the Commission d’accès à l’information du Québec if you are not satisfied with our response.
Send requests to support@tucktuck.app. We will respond within the timeframe Quebec law requires.
12. Security
Data is encrypted in transit and at rest by Google Cloud. Valuable actions — balances, inventory, publishing, voting, and moderation — are performed by our server, never trusted from the app. App Check rejects requests that do not come from a genuine build. Access to production data and to our internal dashboard is limited to named accounts with explicit roles, and administrative actions are logged.
13. Changes
If we change this policy in a way that materially affects you, we will update the date at the top of this page and, where appropriate, notify you in the game before the change takes effect.
14. Contact
support@tucktuck.app · 150 rue de la Maçonnerie, Châteauguay, Québec J6K 0K4, Canada