Privacy policy

Last updated: 20 September 2026

This is a translation, for reading. The Portuguese text is the one that binds: the company is Brazilian and the law that applies is the LGPD.

This policy explains what Tucan keeps about you, why, who it is shared with, and what you can demand. It is written to be read, not to be accepted unread.

The controller of your data is CAIO MARCOS ALVES DE MOURA CONSULTORIA EM TECNOLOGIA DA INFORMACAO LTDA, CNPJ 42.399.277/0001-89, at Rua Walenty Golas, 371, Campo Comprido, Curitiba, PR, CEP 81200-520. For anything in this policy, including exercising the rights below, write to privacy@usetucan.com.

What we keep

Your account. Name, email address and picture, as Google hands them to us when you sign in. We keep no password: Tucan does not have one — Google is what authenticates you.

What you plan. The posts, scripts, captions, dates, comments and files you and your team create in your workspaces. That is the product: without keeping it, there is no calendar.

Who did what. An activity log per workspace: who created, moved, edited or commented, and when. It exists so a team can answer "who changed this?", which is why it cannot be erased.

Technical use. Server access records — date, time, IP address and which operation was asked for — kept for up to 6 months for security and for investigating faults. Brazil's Marco Civil da Internet (art. 15) requires access records to be kept for at least 6 months.

What we do not keep: no advertising, no selling of data, no tracking you across other sites, and no third-party cookies.

Why we keep it (legal basis)

• Performing the contract (LGPD, art. 7, V) — your account and what you plan. Without it there is no service to provide.
• Legal obligation (art. 7, II) — the Marco Civil access records.
• Legitimate interest (art. 7, IX) — the security of the service and the activity log, which protects teams from changes with no author.

Who we share it with

Nobody who wants your data for themselves. Only those who run the infrastructure, and only as far as it needs:

• Google Cloud / Firebase — authentication, database and file storage.
• WorkOS — authorising assistants, when you connect one.

Your data sits in the United States. The database is in Google Cloud's nam5 region. That is an international transfer under art. 33 of the LGPD, made on the basis of the contractual clauses of the operators above.

We also hand over data when the law compels it — a court order, for instance. If that happens we tell you, unless the order itself forbids it.

For how long

As long as your account exists. When you delete your account:

• workspaces you are alone in are deleted, with their posts and files;
• shared workspaces remain: what you wrote in them is the team's record of its own work, and erasing it would tear out other people's conversations;
• the activity log stays, because a log that can be erased is not a log. In a deleted workspace it becomes unreachable along with it.

Access records are discarded within 6 months.

Connected assistants

If you connect an assistant (Claude, ChatGPT) to Tucan, it acts as you: it reaches the same workspaces you reach, with the same role, and nothing further. What it does appears in the activity log marked as done by an agent, with your name beside it. You can withdraw that authorisation at any time, in the assistant itself.

Your rights

Art. 18 of the LGPD gives you rights, and this app meets them like this:

• Access and portability — in Account → "Your data", you download everything we hold about you, as a JSON file, immediately, without asking anybody.
• Erasure — in Account → "Delete your account", with the effect described above.
• Correction — what you wrote, you edit in the app itself. Name and email come from your Google account and change there.
• Confirmation, information and objection — write to privacy@usetucan.com.

We answer within 15 days. If you believe we have handled your data improperly, you may complain to the ANPD, Brazil's data protection authority.

Security

Access is decided on the server, not on the screen: the database rules check, on every read and every write, whether you are in that workspace and what your role allows. Everything travels over HTTPS. This is not a promise of invulnerability — nobody can make that one — and if there is a relevant incident we will tell you and the ANPD, as art. 48 requires.

Children

Tucan is a tool for work and is not intended for anyone under 18. We do not knowingly collect data from children or adolescents.

Changes

If this policy changes in any relevant way, we will say so in the app before it takes effect. The date at the top tells you which version you are reading.