Privacy Policy

Tucol is built by ManulCoo LLC ("we," "us," or "our"), a Texas limited liability company. This Privacy Policy describes what data we collect, why we collect it, who processes it, and how long we keep it.

The core principle: your primary account data lives in your personal iCloud account and never touches our servers. When you send an invoice — on any tier — a copy of that invoice is temporarily hosted on our infrastructure so the recipient can view and pay it through a link, and it is automatically and permanently deleted after a fixed window.

Tucol uses Apple CloudKit to store your account data on your personal iCloud account. This includes group names, member names and contact details you enter, bill amounts, billing cycles, and payment history.

This data is governed by Apple's Privacy Policy at apple.com/legal/privacy. We do not have access to your iCloud data, and deleting the app removes it from your device.

When you send an invoice — on any tier, free or paid — we create a hosted invoice page so the recipient can view and pay it from a link without installing the app. To do this we temporarily store the following on our servers:

· Member name, phone number, and/or email address · Invoice line items, amounts, and due date · Payment status and (Pro) follow-up delivery flag · Invoice expiration date

This data is hosted on:

· Supabase (supabase.com) — PostgreSQL database that stores invoice records, plus file storage for any supporting documents a Pro user attaches · Cloudflare (cloudflare.com) — edge compute that serves invoice pages and runs a daily scheduled job to permanently delete expired records and their files

How the link reaches the recipient depends on your tier: free-tier admins send the link themselves using their own device's Messages or Mail (we do not transmit it); Pro-tier admins can have us deliver it automatically via SMS and email (see Section 4).

Invoice data is automatically and permanently deleted 30 days after the invoice due date for Pro invoices, and 7 days after the due date for free-tier invoices. After deletion, the invoice link becomes inactive. We retain the minimum data for the minimum time necessary.

When you add members to a group, you enter their name, phone number, and/or email address. You are responsible for ensuring you have authorization to use this contact information to send billing messages.

Free-tier admins deliver the invoice link themselves using their own device's Messages or Mail — we do not transmit those messages, and no third-party delivery processor is involved.

For Pro users, we engage the following processors to deliver invoices automatically on the admin's behalf:

· Twilio (twilio.com) — delivers invoice notifications via SMS · Resend (resend.com) — delivers invoice notifications via email (also used to send the admin a payment-confirmation email when a member self-reports payment)

These services act as data processors on our behalf. They receive only the information required for delivery (name, contact detail, invoice content, and a link). They are contractually prohibited from using this data for their own purposes.

By entering member contact information in Tucol, admins confirm that members have agreed to receive billing notifications via those channels. Members may opt out at any time by replying STOP to any SMS, or by contacting contact@manulcoo.com.

We may receive anonymized, aggregate crash reports and usage statistics through Apple's built-in diagnostics. This is opt-in and controlled by your iOS device settings under Privacy & Security → Analytics & Improvements.

We do not use any third-party analytics SDKs, ad networks, or tracking pixels.

All in-app purchases are processed by Apple through the App Store. We never receive or store payment card information. Apple's handling of payment data is governed by their own privacy policy and terms.

Tucol is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided personal information through Tucol, please contact us at contact@manulcoo.com and we will delete it promptly.

You have the following rights with respect to your data:

· iCloud data: delete it at any time by removing the app or clearing iCloud data in your device Settings · Server-side invoice data: automatically deleted after the retention window (30 days after the due date for Pro invoices, 7 days for free-tier invoices), including any uploaded supporting documents; request immediate deletion by emailing contact@manulcoo.com with the invoice details · Members (invoice recipients): contact the admin who sent the invoice, or email contact@manulcoo.com to request removal of your information from our servers · Data portability: Pro users can export billing history to CSV from within the app

All data in transit is encrypted via HTTPS/TLS. Data at rest is encrypted by our infrastructure providers. Cloudflare and Supabase each maintain SOC 2 and industry-standard security certifications.

Access to invoice data on our servers is limited to the automated service role used by the Cloudflare Worker. No human at ManulCoo has routine access to production invoice records.

For reference, here is a complete list of services that may process user data on our behalf:

· Apple CloudKit — primary data store for all users · Apple App Store — in-app purchase processing · Supabase — invoice record + supporting-document storage (all users who send invoices) · Cloudflare — edge compute, invoice page hosting, scheduled cleanup (all users who send invoices) · Twilio — automated SMS invoice delivery (Pro users) · Resend — automated email invoice delivery + payment-confirmation emails (Pro users)

We may update this Privacy Policy as the app evolves. Material changes will be communicated through the app. The current version is always available at manulcoo.com/privacy.

Questions about this policy or requests regarding your data:

Email: contact@manulcoo.com ManulCoo LLC · Fulshear, TX