Toucan

Last updated September 11, 2026

Privacy Policy

Toucan is built for one private connection between two partners. Supported private content is encrypted on your device and stored as unreadable ciphertext, so Toucan cannot read it. This policy explains what other information the service handles and the choices you have.

Who this policy covers

This policy applies to the Toucan website, iPhone and iPad apps, and related services. In this policy, “Toucan,” “we,” and “us” refer to the Toucan service. Questions or privacy requests can be sent through the in-app help form or the contact options on our Support page.

What Toucan can and cannot see

Toucan cannot read your protected private content. Supported partner chat, private dare text and proof, poll responses, and private reward media are encrypted on your device before upload. Toucan stores and transmits that content only as ciphertext and does not receive the keys required to decrypt it. Only approved devices in your pairing can open it.

Toucan can access the operational information needed to run the service, including account and pairing identifiers, content type, status, timing, delivery information, and encrypted-object metadata. Toucan can also read content that is not covered by end-to-end encryption, such as reward titles and details, reactions, and anything you choose to send to support or include in a safety report.

A GIF selection is stored in partner chat as an encrypted GIPHY reference that Toucan cannot read. When you search for, preview, send, or view a GIF, your device contacts GIPHY directly to load that public provider content. Those direct requests are not hidden from GIPHY.

Information we collect

  • Account information. Your name, email address, Toucan user ID, sign-in information managed by Clerk, profile choices, and account settings.
  • Your connection and game activity. Pairing status, partner relationship, dares, timers, mangos, rewards, redemptions, Spark activity, approvals, and related timestamps and history. This operational information is not end-to-end encrypted, but protected content within it remains unreadable to Toucan.
  • Protected private content. Supported partner chat, private dare text and proof, poll responses, and private reward media. This content is encrypted on your device before upload. Toucan stores it as ciphertext and does not receive the keys required to decrypt it.
  • Other content you choose to add. Reward titles and details, reactions, profile choices, and content you send to support, feedback, or safety. This content is not covered by end-to-end encryption and may be readable to Toucan as needed to operate or support those features.
  • Subscription information. Product, entitlement, renewal, expiration, customer, and transaction identifiers needed to provide Premium. Apple handles App Store purchases through StoreKit. Stripe handles web checkout and billing.
  • Notification information. Notification preferences, categories, device tokens, delivery status, and the data needed to route a push through Apple Push Notification service (APNs). If you turn on previews, private details may appear on your device’s lock screen based on your device and Toucan settings.
  • Location information. Precise coordinates you choose to share with your partner or submit to finish a pinned dare, the dare’s map pin and radius, and the time your location was last updated. Toucan does not request location during account setup. Turning location sharing off deletes your saved coordinate.
  • Support and feedback. The message you send, its category, your account name and email, platform, app version, and the time it was sent.
  • Unpairing feedback. If you choose a reason for unpairing, Toucan keeps it with the sealed pair for up to 30 days. A separate minimized signal contains no account or pairing ID, uses a coarse relationship-age bucket and calendar-day timing, and expires after 180 days. Low-volume analytics results are hidden or bucketed.
  • Safety reports. The reason, details, and any encrypted content you voluntarily copy into a report, together with the account and technical information listed above. Toucan does not automatically decrypt or attach your private chat.
  • Technical information. Internet Protocol (IP) address, network and app or browser requests, device and app version information, security events, diagnostics, and service activity used to keep Toucan reliable and secure.
  • GIF requests. Toucan does not receive your GIF searches or proxy GIF media. When you open the GIF picker or view a GIF, GIPHY may receive your search words, IP address, device or browser information, and interactions such as viewing or sending a result under its privacy policy.

Where information comes from

  • From you. Account details, profile choices, content, preference answers, settings, purchases, and messages you choose to send to support or safety.
  • From your partner. Pairing activity and content or shared-game actions they direct to you.
  • Automatically. Requests, IP address, device or browser information, feature interactions, delivery records, security events, and diagnostics created as you use Toucan.
  • From providers. Clerk supplies authenticated identity information; Apple and Stripe supply purchase and entitlement status. GIPHY supplies GIF search results and media directly to your device. Toucan does not receive your full payment-card number.

How we use information

  • App functionality. Create and secure your account, connect your chosen partner, synchronize the shared game, deliver content and notifications, process safety and support reports, and verify Premium access.
  • Personalization. Use your content-level choice, game activity, and preference responses to choose suggested dares, Sparks, and rewards for your pairing.
  • Product analytics. Evaluate aggregated feature use, timing, reliability, and data integrity so we can understand whether Toucan works and improve it. The app records first launch, paywall views, and purchase attempts with a one-way installation hash and, after sign-in, the account ID; it never records purchase-error text. These lifecycle records are removed after 90 days. Our public website measures campaign labels, section exposure, active viewing time, scroll depth, and App Store clicks using temporary page-visit IDs. Website records are not linked to Toucan accounts and are removed after 90 days by our retention worker. Campaign reports are aggregated; App Store clicks are not counted as downloads.
  • Safety and security. Prevent abuse, rate-limit requests, investigate reports, protect users and the service, diagnose failures, and comply with legal obligations.

End-to-end encryption

Supported private content is encrypted on your device before upload. Toucan stores and transmits only its ciphertext, not readable text, photos, videos, or audio, and does not receive the decryption keys. Toucan cannot read or proactively inspect this protected content unless you choose to copy it into a support message or safety report. Encryption does not hide account, pairing, transaction, delivery, timing, or other operational metadata. Anyone with an exported recovery code may be able to open protected content, so keep it private. If keys and recovery access are lost, Toucan may be unable to restore encrypted content.

When information is shared

  • Your partner. Toucan shares the content and game state that the service is designed for the two of you to use together, including your last shared location only while you have location sharing turned on. Unpairing disconnects both accounts immediately, deletes saved shared coordinates, seals the former shared game for up to 30 days, and then deletes it.
  • Clerk. Clerk provides production authentication and account identity services.
  • Railway. Toucan’s production app, PostgreSQL database, and private encrypted-media storage run on Railway infrastructure.
  • Apple. Apple provides maps in the iOS app, StoreKit purchasing, App Store subscription management, and APNs delivery for Apple devices.
  • OpenStreetMap. OpenStreetMap provides maps on the web. Loading a map sends the displayed area or pin and standard connection information, such as your IP address, to OpenStreetMap.
  • Stripe. Stripe processes web Premium checkout and billing.
  • GIPHY. GIPHY provides GIF search results and media directly to your device. Searching, previewing, sending, or viewing a GIF makes a direct request to GIPHY, which handles that request under its Privacy Policy.
  • Legal and safety reasons. We may preserve or disclose information if reasonably necessary to follow applicable law, protect people, investigate misuse, or defend the service and its users.

We require service providers that process personal information on Toucan’s behalf to provide the same or equivalent privacy protection described in this policy, use it only for authorized services, and apply appropriate security and confidentiality safeguards. Apple, Stripe, and GIPHY may also process information from your direct use of their services for their own platform, payment, analytics, fraud-prevention, security, and legal-compliance purposes under their published terms.

Website measurement and your choices

Toucan does not sell or rent personal information or show targeted ads inside the app. On our public website, Do Not Track and Global Privacy Control signals disable optional measurement. The public website does not load advertising measurement cookies or the OpenAI advertising pixel. Apple campaign links let Apple report aggregate downloads under its own privacy protections.

Cookies and local storage

The web app and Clerk use cookies, local storage, session storage, and IndexedDB only for sign-in, security, encryption and device approval, realtime synchronization, preferences, and other requested functionality. The Apple app uses system storage such as UserDefaults and Keychain for comparable app functionality. The optional OpenAI website measurement tool may use a first-party cookie after you allow it. Your measurement preference is stored locally. Blocking necessary storage may prevent sign-in, private-content recovery, or reliable synchronization.

Retention and deletion

We keep account and shared-game information while your account is active and as needed to operate the service. If you unpair, sharing stops immediately and the former shared game is sealed for up to 30 days so either former partner can download the data available to them. Toucan then deletes that shared history from active systems. If either person deletes their account first, archives involving that account are erased sooner. Some delivery, typing, draft, security, and recommendation records expire sooner. Safety reports, payment records, security records, and records needed for legal obligations may be retained after account deletion when reasonably necessary for those purposes. You can delete your account in Settings → Delete account. Deletion removes your Toucan profile and active shared game from Toucan’s live service, unpairs your partner, and starts deletion of device tokens, encryption records, stored media, and other account data. Provider systems and backups may take additional time to cycle out, and providers may retain limited records under their own legal obligations. Deletion cannot recall information already shown on or saved to another person’s device.

Your choices and rights

You can update your name and preferences, turn notifications or location sharing off, change suggested content from Include explicit to Up through intimate, stop answering Sparks, unpair, download a machine-readable copy of your data, or delete your account from Settings. You choose whether to upload media or copy encrypted content into a safety report. To withdraw consent for future optional processing, use the relevant Settings control or contact Support. Some processing is necessary to provide a feature; if it cannot be disabled separately, you can stop using that feature or delete your account. You may also ask to access, correct, or delete personal information through Support. Depending on where you live, you may have additional privacy rights. We may need to verify that a request belongs to you before acting on it.

Age requirement

Toucan is intended only for adults age 18 or older. We do not knowingly collect personal information from children. If you believe a child has used Toucan, contact us so we can investigate and remove the account.

International processing

Toucan and its providers may process information in the United States and other countries, which may have different data-protection rules from your country. Where required, information is transferred using protections recognized by applicable law.

Security

We use technical and organizational measures intended to protect information, including transport security, access controls, private storage, and end-to-end encryption for supported content. No service can guarantee absolute security. Protect your device, sign-in credentials, pairing code, and recovery code.

Changes to this policy

We may update this policy as Toucan changes. We will post the revised policy here and change the date above. If a change materially affects how we use personal information, we will provide additional notice when required.

Contact

Send privacy questions or requests to hello@toucan.to, or use Settings → Get help while signed in.