How strangers actually reach children online

The doors that open by default

Open apps are built to grow, and growth means connecting people who don't yet know one another. That goal shows up as a set of ordinary features. Individually each one sounds helpful. Together they form the ways an adult who has never met your child can still reach them.

• Username and profile search. If a child can be looked up by a name or handle, then anyone who learns or guesses that handle can find them.
• "People you may know" and friend-of-friend suggestions. The app studies who is connected to whom and proposes new links. A stranger two hops away is offered up as a familiar face.
• Phone-number lookup. Upload a contact list, and accounts get matched to numbers — which means a number is enough to surface a child.
• Public profiles. A visible account can be viewed, and often messaged, by people the child has never approved.
• Invite and join links. A single shared link lets anyone who holds it walk straight into a chat or group.
• Unsolicited direct messages. Message requests from people your child has no connection to at all.

Why settings alone don't fix it

The standard advice is to lock these features down one by one: turn off discoverability, set the profile to private, disable contact syncing, restrict who can send message requests. That advice isn't wrong, but it asks a lot. There are many switches, they live in different corners of the app, their names change, and an app update can quietly reset them or introduce a new pathway you didn't know to close.

The deeper issue is that you are fighting the grain of the product. An app whose purpose is to connect people will keep finding new ways to connect people. Every open door you shut is one the app had a reason to build, and often a reason to reopen. You can win that fight on any given day, but you have to keep winning it, forever, on someone else's terms.

One decision that closes every door

Now imagine the opposite starting point. Instead of an app that connects people by default and asks you to restrict it, imagine one that connects no one by default — and can only add a person your child has physically met, with a parent's approval on each side.

Look back at that list of doors. Username search needs a directory to search; remove the directory and the door isn't locked, it simply isn't there. Friend-of-friend suggestions need an algorithm mining connections to make them; don't build one and there is nothing to suggest. Phone-number lookup needs a way to match numbers to accounts. Invite links need a link. Unsolicited messages need a way for an unknown account to reach a known one. Take away the machinery, and each of these stops being a risk you manage and becomes a thing that cannot happen.

How Tuck is built around this

This is the single idea Tuck is built on. A child can only message someone they have met in person: two devices held together, one shows a QR code, the other scans it. A parent from each family approves the connection, or connects the children in person themselves. There is no search, no "people you may know", no phone-number lookup, no public profile, no invite link, and no way for a stranger to send a request from afar. Nobody can be added remotely, because there is no remote path to add them by.

The rest follows from the same instinct to keep things narrow: text, emoji, and little drawings kids make in the app, but no photos or video; links and bad language blocked before a message sends; one-to-one chats between friends, plus a single family thread. Parents can read every conversation, freeze any chat, delete a message, or remove a contact entirely. We describe Tuck as limited on purpose, and this is what we mean. We didn't set out to give you more switches to manage. We set out to build an app where the doors a stranger would use were never there to begin with.