Tackly Privacy Policy

Effective 12 October 2026 · Applies to Tackly for iPhone and iPad, Android, and Windows

1. Who is responsible

Tackly is published by Youlinker SIA, Latvia (the developer account shown on the App Store). Questions about this policy or your data: info@snipcode.io.

2. What stays on your device

Everything you create in Tackly is stored on the device you created it on: notes, checklists, pictures and files, loyalty cards, business cards, voice notes and their transcripts, reminders, tags and boards.

• Notes, attachments and backups are encrypted with AES-256-GCM. The encryption key never leaves the device unencrypted: on iPhone and Android it is protected by the system keychain or keystore; on Windows by your Windows account or Windows Hello.
• A personal code (recovery key) is shown once. It can unlock your notes on a new device. We never see it and cannot restore it.
• Home-screen widgets and the “Share to Tackly” extension exchange data with the app through a container on the device only.
• “Show in iPhone search” adds note titles (and, if you choose, text) to the on-device search index. You pick how much, or turn it off, in Settings.

3. Sync (Tackly Premium): a server that cannot read your notes

Sync is optional. When it is on, the app sends your notes to the Tackly sync server as encrypted records, each note and each picture separately, encrypted on your device. The server rejects anything that is not encrypted. If the server were ever compromised, only encrypted data would be exposed.

Every request is signed by the device’s own key, so there is nothing like a password or session token to steal. The server runs in Frankfurt, Germany (DigitalOcean), inside the European Union.

Removing a device in Settings revokes its key immediately and rotates the encryption key for the remaining devices. To delete all synced data, remove all devices or write to the address above; the records are then erased.

4. Apple Wallet cards

When you tap “Add to Apple Wallet” on a loyalty card, the card’s name, colour and number are sent to the sync server for that one request, because only the server holds the certificate that signs Wallet passes. The server builds the pass, returns it, and stores nothing. This is the only moment the server sees any content, and it happens only when you ask for it.

5. Sending a note to another Tackly user

If you choose a Tackly username, other people can send you a copy of a note, and you can send them one (sending is part of Tackly Premium; receiving is free). The note is encrypted on the sender’s phone for the recipient only, so the server relays it without being able to read it.

• What the server learns: who sent a note to whom and when, how big it was, and whether it was accepted, declined or left to expire. It never sees the note’s text, tasks, pictures, files or the message with it.
• Your username (and the display name you add, if any) is shown only to someone who types it exactly. There is no search, no list and no suggestions of other people, and lookups are limited. In Settings you choose who can send to you: anyone who knows your username, only your contacts, or nobody. When someone may not send to you, the app answers as if the username did not exist.
• Your contacts are the people you accepted a note from or sent one to. The server keeps this list so it can apply your setting; a name you give a contact is encrypted on your phone. You can remove or block anyone.
• Deleting: as soon as a note is accepted or declined, its encrypted content and attachments are deleted from the server. A note nobody answers is deleted after 30 days. The bare status (sent, accepted, declined, expired) is kept 30 more days so the sender can see it, then deleted too. A username you give up stays reserved for you for 30 days.

6. Permissions and what they are used for

• Camera and photo library: taking photos, scanning documents, barcodes and business cards into notes. Scanning runs on the device.
• Microphone and speech recognition: voice notes. Transcription uses the speech recognition built into your phone. On iPhone, Settings shows for each language whether it is recognised on the device or by Apple’s servers; Apple’s processing is covered by Apple’s privacy policy.
• Contacts: only when you tap “Save to Contacts” on a scanned business card.
• Location: “Card at the store” shows a loyalty card when you arrive at one of its stores. The store locations are watched by the phone itself; your location is never sent to us.
• Notifications: reminders you set, store arrivals, and one reminder the day before a free trial ends.

7. Tackly Premium and payments

Tackly Premium is a subscription bought through the App Store or Google Play. The store handles payment, renewal, refunds and cancellation; we never receive your card or bank details. To know whether the subscription is active, the app reads the store’s own purchase record on your device. Nothing about your purchase is sent to the Tackly server.

8. No analytics, no advertising, no sale of data

Tackly contains no analytics, advertising or tracking code and no third-party services that collect data. We do not sell or share personal data. If the app crashes, an error description without note content is written to a log file on your device, which you may send to us yourself.

9. Children

Tackly is not directed at children under 13 and does not knowingly collect data from them.

10. Your rights

Under the GDPR you can ask what we hold about you, have it corrected or deleted, and complain to a supervisory authority (in Latvia, the Data State Inspectorate). Because the server holds only encrypted records and device keys, the practical answer to “what do you hold about me” is: the encrypted data your devices sent, which we cannot read.

11. Changes

If this policy changes, the new version appears at this address with a new effective date, and the app will point to it.