Privacy Policy

Effective September 28, 2026 · DosSantos Systems LLC

Tucked In hands your sitter what they need for one visit and lets you follow along. This page explains exactly what that takes, who can see it, and how to delete it.

1. Who we are
2. What stays on your iPhone
3. What our server keeps, and why
4. How codes and links are protected
5. Who can see what
6. The sitter page and this website
7. How long we keep it
8. Deleting your data
9. Children
10. Your rights
11. Security
12. Changes and contact

1. Who we are

Tucked In is made by DosSantos Systems LLC, 488 Pleasant St, Unit 1A, New Bedford, MA 02740, United States ("we", "us"). This policy covers the Tucked In app for iPhone, its widgets, Live Activities, and Apple Watch app, Sitter Mode, the sitter pages at tuckedin.cloud, and this website.

Our company privacy policy covers everything we publish. For Tucked In, this page is the detailed account, and if the two ever differ, whichever one protects you more applies.

2. What stays on your iPhone

The free parts of Tucked In work entirely on your iPhone: your family library (kids, pets, contacts, the house, Where Is It), the visits you plan, and the printable PDF and fridge sheet. We cannot see any of it. If your iPhone uses iCloud, Apple stores that copy under its own privacy policy, and we cannot read it either.

3. What our server keeps, and why

Live features need a server to pass information between you, your co-parent, and your sitter. That is what Tucked In Plus pays for. Here is everything the server stores:

What	Why
A device key. A random ID and a secret your iPhone creates, a device name (the app fills in your first name from your household's contacts, and you can change it), whether it is used as a parent or sitter, your notification settings, and the push notification tokens Apple gives the app. We store only a one-way hash of the secret.	So the server knows which household a request comes from, and can send you notifications. This replaces an account.
Your household. Its name and which devices belong to it. Invite codes are stored as a one-way hash and stop working after 7 days or one use.	So both parents see the same visits and share one subscription.
Library sync. The cards you sync with your co-parent, and their photos. Anything marked sensitive is encrypted.	To keep two parents' iPhones in step.
Each visit you share. The times, the sitter's name and phone number, tonight's notes, the task list, and the parts of your library you chose to include. The optional PIN is stored only as a salted hash.	So the sitter's page and Sitter Mode can show the visit.
What happens during a visit. Check-in and check-out times, tasks checked off (with any note or photo), messages and quick replies, and Emergency screen actions (who was called, EpiPen use, and status updates), each with its time.	To show you the visit live, alert you, and keep a history you can look back on.
Requests and messages. Visit requests and the sitter's answers, suggested times, cancellation notes and any cancellation pay you record, and message threads with your sitters, including photos and read receipts.	For booking and talking with your sitters.
Sitter details. A sitter who uses Sitter Mode enters a first name and phone number. A sitter may also save how they like to be paid (for example a Venmo or Zelle handle).	So families see the right requests and know how to pay. We never process payments.
Your subscription. The signed purchase record Apple provides: product, dates, trial and renewal status, refunds, a transaction number, and the household ID the app attaches.	To unlock Tucked In Plus for your whole household. We never see your card or your Apple ID.
Support messages. Your email address, the topic, your message, and the device and app version if you add them. They are encrypted the moment they arrive.	To answer you.
Web server logs. IP address, time, the page requested (with link codes removed), and browser type.	Security and fixing problems.

We do not use the information for advertising, we do not build profiles, and we do not use it to train AI models.

4. How codes and links are protected

• Codes are encrypted. Wi-Fi passwords, door and alarm codes, and anything else you mark sensitive are encrypted on our server (AES-256-GCM) and are never written to logs.
• Codes show up only during the visit. The sitter's page opens an hour before the visit so they can read the plan, but codes are sent only from the start of the visit until the link expires, and only the ones you included. Once the link expires, our server deletes them.
• Links expire. A sitter link is a long random code that stops working 12 hours after the visit ends. You can end it sooner at any time, and it stops at once. You can add a 4-digit PIN. Too many wrong guesses lock the link, for longer each time, and we tell you when it happens.
• Photos are cleaned. Every photo is re-encoded on our server and loses all its metadata, including location, before it is stored. Photos are only served through links that expire after an hour.
• Everything travels over HTTPS.

5. Who can see what

• Your co-parent. Everyone in your household sees your household's visits, messages, and synced library.
• Your sitter. Only what you include in a visit, only through the link you send them, and only while the link is open. Sitters see your messages to them and their own actions.
• Apple. Apple delivers push notifications and Live Activity updates, so their content passes through Apple's push service, and Apple handles App Store purchases.
• Twilio SendGrid delivers support messages to our inbox.
• Nobody else. We run our own servers in the United States. We share information with authorities only when the law requires it, and we would tell you unless the law forbids it.

6. The sitter page and this website

tuckedin.cloud sets no cookies, runs no analytics, and loads nothing from other companies. Even the fonts are ours. So it keeps working with a weak signal, the sitter page stores a few things in the browser on the sitter's phone: the latest copy of the visit (with the codes you included, once the visit starts), check-offs waiting to send, the PIN session, and choices made on a request page. The page deletes the visit copy and the PIN session once the link expires or you end it. It keeps the first names of the family and the sitter for a week after that, so it can say the visit is over. The sitter can clear all of it from their browser settings.

7. How long we keep it

What	How long
Visit photos	Deleted 90 days after the visit ends.
Photos in message threads	Deleted 90 days after they are sent.
Library photos	Until you delete them or your household.
Door and alarm codes, Wi-Fi passwords, and other details you mark sensitive	Deleted from our server when the link expires, 12 hours after the visit ends.
Visits and their history	Until you delete your household, or 90 days or 1 year after each visit if you choose that under Keep visit history in Settings. The sitter loses access 12 hours after each visit.
Requests and messages	Until you delete your household.
Device keys and settings	Until you remove the device or delete your household.
Support messages	As long as we need them to help you.
Web server logs	Up to 60 days.
Backups	Nightly copies are encrypted and kept for 14 days, so anything deleted is gone from backups within 14 days.

8. Deleting your data

• Your whole household. In the app, go to Settings and choose Delete household. That erases your household from your iPhone and from our server: visits, messages, photos, requests, the synced library, and invites, and it closes every sitter link. It affects your co-parent's iPhone too.
• A co-parent's iPhone. Any parent can remove another parent's iPhone from the household, or leave it, in Settings. The household's data stays with the parents who remain.
• Sitters. Sitter Mode can remove its device and saved details from our server, and a phone that is also a parent's can remove just its Sitter Mode data. A sitter who only used the web page can ask us to remove their name and number.
• Anyone can ask us to delete their information through our support form. We will do it within 30 days and confirm.
• You can also end any sitter link at any time, and the app can export your household for your own records.

9. Children

Tucked In is for parents and caregivers, not for children. Parents enter details about their children, such as names, ages, allergies, medicines, routines, and photos, so a sitter can care for them. The parent decides what to include and can delete it. We do not knowingly collect personal information directly from children under 13. Sitter pages and Sitter Mode are meant for sitters aged 13 and older. If you believe a child under 13 has given us information, contact us and we will delete it.

10. Your rights

Wherever you live, you can ask us to show you, correct, or delete the information we hold about you, or to give you a copy. Use the support form and choose "Privacy or deleting data". We will answer within 30 days and will never treat you differently for asking. We do not sell or share personal information for targeted advertising, so there is nothing to opt out of. Residents of California, other US states with privacy laws, and the EU or UK have these rights under their laws as well.

11. Security

We encrypt sensitive fields at rest, store secrets, PINs, and link codes only as hashes, keep link codes out of our logs, and limit access to our servers to the people who run Tucked In. No system is perfect. If a breach ever affects your information, we will tell you as the law requires.

12. Changes and contact

If we change this policy, we will update the date at the top. If a change matters, we will also tell you in the app before it takes effect.

Questions or requests: use our support form, or write to DosSantos Systems LLC, 488 Pleasant St, Unit 1A, New Bedford, MA 02740, United States.