Last updated: 31 August 2026
Truffy stores your records on your phone, and nowhere else. There is no account, no sign-up, no advertising and no advertising identifier. Here is everything that leaves the device, each case detailed below: a technical report if the app crashes, a measurement of your use of the app — the screens you visit and the actions you take, enabled by default and which you can turn off in the settings —, the map area you are looking at in the Walks tab, the place name you type into the search there, the name of the country of the region set on your phone, sent once to frame the map when it has nothing to show yet, the coordinates of a walk you pin, sent once to look up its address, your approximate location in order to estimate a travel time, and what you type into the search bar of the food list, so as to know which foods are missing from it. On top of that there are outputs you trigger yourself: tapping "Search here" sends OpenStreetMap the visible map frame to find named green spaces, asking for directions to a walk hands its location to your phone's maps app, and saving a backup or a sheet for your sitter writes the contents of your records wherever you point it. Usage measurement goes out with deliberate exceptions to the "nothing from a record leaves" rule: the amount of a rate noted on a record goes out exactly as entered, an animal's breed goes out when you open its record, and the length of a note goes out without ever its text. Those exceptions are detailed below.
Everything you enter is saved in a local database, in the app's private storage:
This data is never transmitted, neither to us nor to a third party, except that the coordinates of a walk are sent to MapTiler once, to look up its address, to OpenRouteService every time a travel time is calculated, and to your phone's maps app when you ask for directions to that walk (see "The location of walks" below). The place name you type into the search goes to MapTiler in the same way, without being recorded or kept, as does the name of the country of the region set on your phone, sent once to frame the map when the tab opens. We do not back it up to any server: uninstalling the app deletes it permanently, unless you made a backup yourself or Android's automatic backup is enabled (see the next section).
The app lets you save a backup file yourself, containing your records, their photos, the owners, your sitters and your walk locations — including those locations' coordinates — wherever you choose: the phone's memory, an SD card, or a storage service you may have installed. The app writes that file where you tell it to and transmits it to no one.
The sheet for your sitter is a PDF you produce and whose destination you choose: saving it on the device, sharing it with the app of your choice, or printing it. It contains what you have noted about the animal. The app sends it nowhere of its own accord and has no visibility over what you do with it afterwards.
What you then do with a backup file or a sheet is up to you. If you place it in an online storage service or send it by messaging, it is that service's terms which apply to its contents, not these.
Android also backs app data up automatically to the device's Google account, if you have enabled that feature in the system settings. This automatic backup covers your records, your sitters, your walk locations and your preferences, but not the photos, which are deliberately excluded. It is managed by Android and not by the app; you can disable it in your phone's settings.
The app sends your animals' and your sitters' records to no server: no name, no photo, no note, no owner. There is no account, no synchronisation, and no server hosting them. What does come out only comes out if you ask for it — a backup, a sheet for your sitter — and to the destination you designate, as described above.
Everything that leaves the device is limited to the Walks tab, to crash reporting and to usage measurement, and never carries the name of an animal or an owner, a coordinate or the text of a note — with the deliberate exceptions detailed below alongside usage measurement: the amount of a rate noted on a record goes out exactly as entered, an animal's breed goes out when you open its record, and the length of a note goes out without ever its contents:
The crash report contains no data from your records: no animal name, no owner name, no note, no photo, no location. That is a constraint written into the app's code.
These reports are used solely to fix defects in the app. They are neither sold, nor used for advertising purposes, nor shared with third parties other than Google, which acts here as a technical subprocessor.
Google keeps crash reports for 90 days, then deletes them. See Google's privacy policy.
Usage measurement (Firebase Analytics) follows the same rules as the crash report: it serves solely to know which screens and which actions are useful, it is neither sold, nor used for advertising purposes, nor shared with third parties other than Google, which acts here too as a technical subprocessor. Google sets its retention period, documented in its own privacy policy above.
Crash reports are queued locally and sent on the next connection. Usage measurement follows the same principle: nothing is lost if the device is offline at the time of the action, the event going out on the next available connection. The map background and the travel time calculation, on the other hand, need a connection directly: without one, the Walks tab shows your walks with no map background, the place search returns nothing, and travel times are estimated as the crow flies rather than calculated by OpenRouteService.
The rest of the app — the records, the list, compatibility, the settings — remains fully usable offline.
The walks you pin are places you choose — parks, woods, paths. They are saved on the device along with the rest of your data, and their coordinates are sent to MapTiler once, to look up their address, and to OpenRouteService every time a travel time is calculated. Do not pin your home if you would rather its coordinates were not used in that way.
Finally, the directions button on a walk passes its coordinates to your phone's maps app — the one you chose in the system settings — so that it can take you there. What is passed is the location, and nothing else: not the name you gave the walk, not its address, not the note you wrote on it. This only happens if you tap that button, and what the maps app then does with that location is governed by its own privacy policy, not by this one.
A single permission is requested: approximate location, only when you open the Walks tab to estimate a travel time. Refusing it has no consequence for the rest of the app — you only lose the estimated travel times in that tab.
To add a photo, the app opens either your phone's camera or the system photo picker: in both cases it is the system app that runs and handles its own permissions, and it returns only the image you chose.
Internet access appears on the Play listing: it is used by crash reporting, by usage measurement, by the Walks tab's map background, place search and reverse geocoding, by the "Search here" green-space search (OpenStreetMap), by the travel time calculation, and by the check for an app update.
That last one goes through your phone's Play Store app, which the app asks whether a version newer than itself exists. Nothing from your records is sent: the question is only about the installed version number. If an update exists, the settings announce it on the version line and send you to the Play Store listing — the app does not download anything itself.
Every record, every photo and every walk can be deleted from within the app. Uninstalling deletes all local data. Since your location is never stored, there is nothing to delete. Because crash reports are anonymous and carry no personal identifier, they cannot be traced back individually in order to be deleted on request; they disappear automatically after 90 days. Usage measurement, for its part, is under your control upstream: the switch in the settings stops it at any time, which prevents any new event from going out, but does not withdraw those already sent — being anonymous like the crash reports, they cannot be traced back individually either.
The app is not directed at children and does not knowingly collect any data concerning them.
Any change to this policy will be published on this page, with the update date shown above.
Asue — tiny99@free.fr