Privacy Policy
1. Who we are
TukTuk is a mobile app for fast and secure messaging. We respect your right to privacy and process personal data in line with international information-protection standards.
2. What data we collect
To operate the messenger, we collect only the minimum data necessary. Below is detailed information about exactly what data we receive, what it is used for, and whether it is required.
| Category | What exactly | Why | Required? |
|---|---|---|---|
| Personal info | Username + password (a hash, not the password itself) | Signing in to your account | Yes |
| Personal info | Recovery email | Password reset | No |
| Personal info | Name, avatar | Shown to your contacts | No |
| Personal info | Phone number (optional) | Shown in your profile / to contacts, if you choose to add it | No |
| Messages | Message content | Delivery — the server stores and relays only encrypted data and cannot read the content | Yes (technically, in encrypted form) |
| Photos and videos | Chat attachments | Delivery; stored encrypted for up to 7 days or until the recipient receives them | Only if you send them |
| Device or other IDs | Push token (FCM), device identifier | Push notifications; preventing block evasion through re-registration | Yes |
| App activity | Public encryption key, contacts / block list | Message delivery and communication-control features | Yes |
We do not collect location data or payment data, and we do not use third-party advertising trackers.
Calls and device access
- The microphone and camera are used only during calls and when recording the voice and video messages you send.
- Call audio and video are transmitted in encrypted form, either directly between participants or through our relay server. Calls are not recorded or stored on the server.
- Call history is stored only on your phone.
- Device permissions (Android): so that Android recognizes TukTuk calls as phone calls, the app requests the
READ_PHONE_NUMBERSpermission. This is a technical requirement of the CallKeep library. The app does not read, store or transmit your SIM card number. - The app accesses your gallery only for files you have selected yourself.
3. Encryption and data protection
Private and group messages, their attachments and calls are encrypted on your device (end-to-end), so we cannot read or listen to their content. Channel posts are not encrypted: channels are public.
- We have no technical access to your private messages and calls.
- We do not sell data to third parties or use it for ad targeting.
4. Data retention and deletion
You can delete your account at any time from the app — this irreversibly deletes your profile, keys, contacts and related data. Media files are deleted automatically within 7 days, even without any action on your part. A detailed list of what is deleted, and how to do it without access to the app, is on the account deletion page.
5. Service providers we share data with
The service relies on infrastructure providers: storage of encrypted media files (Cloudflare R2), push notification delivery (Firebase) and delivery of password recovery emails. These providers process data solely to provide technical infrastructure. Because media files and messages are end-to-end encrypted, the providers have no access to their content.
6. International data transfers
Our servers are located in Germany (European Union). Data is transferred and stored in accordance with high security standards and applicable law, including requirements for cross-border data transfers.
7. Legal basis for processing and consent
We process data on the basis of the consent you give when registering (by accepting this policy), and to the extent necessary to provide the service (message delivery, authentication, security). You can withdraw your consent at any time by deleting your account — see the account deletion page; this does not affect the lawfulness of processing carried out before the withdrawal.
If you are in the European Economic Area (EEA) or the United Kingdom and the General Data Protection Regulation (GDPR / UK GDPR) applies to you, processing is also governed by those standards. You can learn more about your rights under the GDPR in Section 8 ("Your rights").
8. Your rights
Wherever you are, you have the right to:
- request a copy of the personal data we hold about you;
- have inaccurate data corrected;
- have your data deleted — see the account deletion page;
- withdraw your consent to processing at any time;
- receive your data in a machine-readable format (data portability);
- object to processing if you believe it infringes your rights.
To make a request, email info@tuktukme.com
9. Contact
If you have any questions about this Privacy Policy, please contact us:
Email: info@tuktukme.com
Attn: Sokol Co.
56 Smagulov St., Atyrau, Kazakhstan
Effective date: October 15, 2026