Unlock on your Mac
Your password derives a protection key locally to unlock the vault’s master key.
A little space for privacy
Your files in the cloud.
Your privacy with you.
An extra layer of protection for the cloud you already use. TuckCloud encrypts files and their directory on your Mac, then downloads and decrypts them when you need them.
macOS 14+ · Apple silicon & Intel · Beta in development
LOCAL ENCRYPTION
ON YOUR MAC
Travel memories.mov
Private document.pdf
IN YOUR CLOUD
Encrypted before uploadIllustration, not a live transfer8f23b0e1…c7a4.c9ra4d801c3…f06b.c9rEncrypted content & directoryContent encrypted firstDirectory protected tooSpace used on demand
YOUR CLOUD, A MORE PRIVATE WAY
Files within reach.
Space when you need it.
Browse in Finder and download files when needed. When you’re done, verify the remote copy before freeing local space. Keep everyday files available locally.
Explore the mechanismsYour filesInterface illustration
Kyoto memories.movCloud only
A weekend by the lake.movCloud only
Personal notes.txtCloud only
Familiar filenames, shown on your unlocked device.
FROM DEVICE TO CLOUD
Protection starts before upload.
Encrypt, then upload
Content is encrypted in chunks. Original filenames and paths stay in an encrypted directory.
Download, verify, use
Ciphertext and decrypted content are verified before a file is handed to another app.
SECURITY IS MORE THAN AN ICON
A mechanism behind
every layer of protection.
Understandable design for irreplaceable files.
AES-256-GCM
Confidential content. Verified integrity.
Authenticated encryption protects file contents. Altered or corrupted encrypted data fails authentication, stopping decryption.
scrypt + AES Key Wrap
A password protects a random master key
A randomly generated master key is wrapped with a password-derived key before storage. The password itself is not uploaded; a strong password still matters.
macOS Keychain
On-demand access, guarded by the OS
Connecting Finder stores the unlock key in this Mac’s Keychain for the app and extension in the same access group. On-demand access means the device retains the ability to unlock.
SHA-256
Verify the remote copy before freeing space
The remote directory, key file and content digests are checked before eviction. A mismatch stops the operation. Decrypted downloads are checked too.
Cloud access is not your decryption key.
Baidu connects through browser OAuth. The handoff uses a one-time credential, state validation and a bound verifier. Server-side authorization records use AES-GCM encryption. Files travel directly between the client and your cloud; the authorization service does not decrypt them.
The production Baidu authorization flow is being configured and tested. Public access is not yet available.CLEAR ABOUT THE BOUNDARIES
Who can see what?
Encryption protects your content. It does not make all metadata disappear.
| Location | Visible information | Protection boundary |
|---|---|---|
| Your Mac | Unlocked files, original filenames and local copies. | Downloaded files are editable plaintext. Protect your device and login; editors may create additional copies. |
| Your cloud provider | Ciphertext, the encrypted directory, wrapped master key, object sizes, counts, times and account information. | The normal flow uploads no plaintext content or original filenames. Traffic, object metadata and the existence of a vault remain visible. |
| TuckCloud authorization service | Baidu authorization tokens and required account identifiers, to establish and renew a connection. | It receives no vault password or decryption key. Authorization records are encrypted at rest; the running service must be able to use the tokens. |
TUCK AWAY. COME BACK ANYTIME.
Big files. A lighter local footprint.
Encrypt and upload in chunks to reduce the temporary space needed for a full ciphertext copy. Pause with progress saved; on resume, the source and existing chunks are checked. Keep the source file and working space for the current chunk available.
Chunked encryptionPause & resumeIntegrity checks
FAQ
Good questions deserve clear answers.
Do I need another encryption app?
No. Encryption is built into TuckCloud, and files are encrypted on your device before upload. Create or open a TuckCloud vault to encrypt, decrypt and download files on demand within the app.
Can you recover a forgotten password?
TuckCloud has no hosted vault-password recovery flow. If the password and all usable unlock keys are lost, encrypted content cannot be recovered. Store your password carefully and keep independent backups of important files.
Can my cloud provider see what I upload?
In the normal flow, the provider stores ciphertext rather than plaintext content. Original names and paths are in the encrypted directory. Account information, object counts, sizes, timestamps and access activity remain visible.
Does encryption prevent all data loss?
No. Encryption and integrity checks are not backups. They cannot prevent deletion by a provider, malware taking control of your device, or all data being rolled back to an older version. The current version does not guarantee cross-device rollback detection.
Has TuckCloud been independently audited?
An independent security audit of the complete TuckCloud product has not yet been completed. Using established cryptographic components does not make the whole app audited. This page describes mechanisms and limits, not a promise of absolute security.
MADE WITH CARE, STILL IN PROGRESS
Protection first.
Then, ready for you.
TuckCloud is preparing a small macOS beta. Builds include Apple silicon and Intel. Baidu integration, distribution signing and broader device validation are still in progress. A public installer is not yet available.
Beta preparation