Privacy notice

This is a translation for convenience. Truffle’s provider is based in Germany, and the German version is the binding one. Where the two differ, the German text applies.

This notice describes what actually happens — on this website and inside the program. It is uncomfortably specific in places: where data leaves your device, this page says where it goes.

1. Controller

Marian Moritz Hildebrand
Scheinerstr. 29
81679 München, Germany
E-mail: mail@truffle-app.com

No data protection officer has been appointed; the conditions of Section 38 of the German Federal Data Protection Act are not met.

2. This website

Server log files

This website is served through Cloudflare Pages. When you open it your browser transmits technical data, which the host processes in log files: IP address, date and time of the request, the file requested, the amount of data transferred, whether the request succeeded, browser type and version, operating system and the page previously visited. We ourselves see no individual requests, only visitor counts without personal reference.

Purpose
Delivering the website and operational security — detecting and defending against attacks and malfunctions.
Legal basis
Article 6(1)(f) GDPR. The legitimate interest is the technically sound and secure operation of the web server.
Retention
The log files arise at the host, which by its own account keeps them only as long as operation and the defence against attacks require; we have no access to them and store none of it.
Recipients
Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, as a processor under Article 28 GDPR on the basis of a data processing agreement. For the transfer to the United States we rely on the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR); Cloudflare, Inc. is certified under that framework. In the alternative, the standard contractual clauses that Cloudflare incorporates into its data processing agreement apply (Art. 46 (2) (c) GDPR).

Through the response headers Report-To and NEL, Cloudflare also asks your browser to report failed connections to this website to a.nel.cloudflare.com (Network Error Logging). Only failures are reported, no successful requests, and without an identifier; the report goes to Cloudflare as processor, for the same purpose and on the same legal basis as the log files.

Storage on your device

This website sets no cookies, embeds no fonts, maps, videos or scripts from third-party servers, and measures no visits. There is no analytics tool.

Three values are stored in your browser's local storage, and only once you have chosen them yourself:

Until you choose something, nothing is stored. The page then appears in the language your browser announces, without that inference being recorded. This makes the storage strictly necessary to provide a service you have expressly requested, and it is therefore exempt from consent under Section 25(2) no. 2 TDDDG. That is why there is no consent banner. None of the three values contains an identifier or allows any conclusion about you; you can delete them at any time in your browser settings.

Contacting us

If you send us an e-mail, we process your address and your message in order to answer it. The legal basis is Article 6(1)(b) GDPR where a contract is involved, otherwise Article 6(1)(f) GDPR. We delete the correspondence once it is settled and no statutory retention periods apply.

Our mailboxes mail@truffle-app.com and security@truffle-app.com are hosted on Microsoft 365; the provider is Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, as a processor under Article 28 GDPR. The mailboxes are stored in the European Union; for access from the United States the standard contractual clauses in Microsoft’s data processing terms apply (Art. 46 (2) (c) GDPR), and in the alternative the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR).

Our YouTube channel

We publish short videos about Truffle on our YouTube channel @truffle-app. They are uploaded by our internal tool “Truffle Hub” through the YouTube API Services by Google. The tool only uploads our own videos to our own channel and does not access any data of other users; it processes nothing about you.

The only thing stored is the access key to our own channel, at Cloudflare (see above) in a data centre in Western Europe. We delete it as soon as we end the connection. You can revoke an app’s access to a Google account in your Google account at security.google.com/settings/security/permissions.

YouTube is subject to the YouTube Terms of Service. When you visit our channel, Google processes your data under the Google Privacy Policy; the provider in the European Union is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

Direct messages to our Instagram account

If you send a direct message to our Instagram account @truffle_musictageditor_app, we also read and answer it in our internal tool “Truffle Hub”, which retrieves the messages through Meta’s Instagram API. It processes your username, the identifier Instagram gives our account for you, the text of your messages and when they were sent. The tool only sees conversations with our own account, no others.

Purpose
Reading and answering your message.
Legal basis
Art. 6(1)(b) GDPR where a contract is concerned, otherwise Art. 6(1)(f) GDPR. Our legitimate interest is answering enquiries addressed to us.
Retention
The tool stores the messages at Cloudflare (see above) in a data centre in Western Europe and deletes them no later than six months after the last message in the conversation. In the Instagram app itself the conversation remains until you or we delete it there.

AI-assisted reply drafts. For some replies we have a draft written for us. For this, the text of the conversation and your username are sent to Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland, as a processor under Art. 28 GDPR on the basis of its data processing addendum. Processing also takes place on servers in the United States; the standard contractual clauses incorporated in that addendum apply (Art. 46(2)(c) GDPR). Anthropic may not use the content to train its models and deletes it after 30 days at the latest. A person reads every draft, edits it where needed and sends it themselves. There is no automated decision-making within the meaning of Art. 22 GDPR.

If you would like us to delete your messages from Truffle Hub sooner, write to mail@truffle-app.com. We will delete them within 30 days and confirm this to you.

Instagram is operated by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland. What Meta itself does with your messages is governed by the Instagram Privacy Policy.

When we write to you

We introduce Truffle to editors, blogs, podcasts, creators and people who make music by e-mail, and offer some of them the full version to try for free. To do so we look for suitable pages and use the e-mail address published there, for example on a contact page, in a legal notice, in a podcast feed or on a YouTube channel. Our first e-mail tells you where we found your address.

Which data
Name and e-mail address, the name and address of your site or channel, the country, titles and dates of your latest public posts (so that the e-mail fits you), our e-mails and your replies, and, where applicable, a code for the full version that we sent you.
Source
Publicly accessible pages: your website, your podcast feed, your YouTube channel or a public directory (Art. 14(2)(f) GDPR).
Purpose
Making Truffle known and handling your replies.
Legal basis
Art. 6(1)(f) GDPR. Our legitimate interest is to introduce a new program to people who write about music or Mac software or who work with music collections (direct marketing, Recital 47 GDPR).
Retention
Until you object or we stop introducing Truffle this way. If you object, we delete your data. We then keep only your address and domain on a suppression list, so that we never write to you again, and the correspondence as a record (Art. 17(3)(e) GDPR).
Service providers
The data is kept in our internal tool “Truffle Hub” at Cloudflare (see above); the e-mails are sent through Microsoft 365 (see “Contacting us”). Claude by Anthropic helps us write the e-mails and read replies. For this, your name, your address, public content of your site and your reply go to Anthropic and may also be processed in the United States. There is no automated decision within the meaning of Art. 22 GDPR.

Objecting to these e-mails. You can object to the use of your data for such e-mails at any time, without giving reasons (Art. 21(2) and (3) GDPR). A short reply to our e-mail or a message to mail@truffle-app.com is enough; we will not write to you again.

3. The Truffle application

Truffle runs on your Mac. There is no user account with us and no login. The program contains no code for usage statistics, analytics or crash reporting, and it downloads no code. The program talks to us nowhere: purchase, purchase verification and updates run through the Mac App Store, which Apple operates (sections 4 and 5). We do not learn that you use Truffle, let alone what is in your library.

All the catalogue requests described below go from your device directly to the providers named. We are not technically involved in them and receive nothing from them.

What never leaves your Mac

What goes out during an analysis

When you have tracks analysed, artist, title and album go out as search terms to the sources you have switched on in the settings. For audio recognition an acoustic signature is computed on your Mac from three short excerpts, and only that signature is handed to Apple's ShazamKit — not the recording. Artwork that is found is downloaded. If a file name contains the number of a SoundCloud upload, that number goes to SoundCloud so that Truffle can find the upload's page.

The requests carry no identifier and no account. They contain your IP address, as every internet connection does, and the user agent truffle/1.0 ( https://truffle-app.com ).

Which parties Truffle talks to

This list was compiled from the program's source code and is complete, with one explicit exception stated below:

The exception we are not hiding: if Truffle finds a track in no catalogue at all, the web research asks DuckDuckGo as a last resort and then loads the first page in the results to read creator and product names from its page metadata. Which website that is is not fixed in advance — it can be any domain the search engine puts first. That website receives your IP address and the page request. If you would rather it did not, switch off web research under “Sources” in the settings; every other source keeps working.

Every source can be switched off individually. The hosts are listed in the settings underneath each switch, so you do not have to look them up here.

Where Truffle stores things

By far the largest part sits in one folder: ~/Library/Application Support/Truffle. Outside it, as with any Mac application, are your settings in the application's preferences file, along with short-lived working files in the system's temporary folder and a hidden working copy next to whichever music file is being edited; Truffle clears both away itself. No cache of network requests is written to disk at all.

4. Purchase through the Mac App Store

Truffle is obtained from the Mac App Store; the full version is an in-app purchase. The seller, and the controller for processing the purchase, is Apple Distribution International Ltd., Hollyhill Industrial Estate, Hollyhill, Cork, Ireland. Apple collects and processes the data needed for purchase, invoicing and tax under its own responsibility; details are in Apple’s privacy policy: apple.com/legal/privacy. We receive no personal data of buyers from Apple, only aggregated sales figures.

Whether the full version has been bought is checked on your Mac with Apple’s StoreKit against your Apple Account. We run no server for this and learn nothing about it. The demo version is the same app without that purchase.

5. Updates

Updates are delivered by the Mac App Store. Whether and when your Mac checks for updates and installs them is governed by your macOS settings; which data goes to Apple in the process is governed by Apple’s privacy policy. Truffle itself does not check for new versions and downloads nothing.

6. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20 GDPR). Any consent given can be withdrawn at any time with effect for the future.

In practice this concerns the server log files of this website, e-mail correspondence, messages to our Instagram account and, if we have written to you, the data described under “When we write to you”; we hold no other data. For the purchase, Apple is your point of contact (section 4); for the program’s queries to the catalogues, the providers named above are, because those requests go from your device to them.

Your right to object

You have the right to object at any time, on grounds relating to your particular situation, to processing of personal data concerning you that we base on a legitimate interest (Art. 21 (1) GDPR). This concerns every processing operation that this notice bases on Art. 6 (1) (f) GDPR. If you object, we will no longer process that data unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing serves to establish, exercise or defend legal claims. An informal message to mail@truffle-app.com is enough; reasons help us, but they need not be elaborate.

You also have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your residence, place of work or the place of the alleged infringement (Art. 77 GDPR). The authority responsible for us is the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA), Promenade 18, 91522 Ansbach, Germany, lda.bayern.de.

Providing your data is neither required by law nor by contract. Without the technically necessary transmission of your IP address, however, the website cannot be delivered to you.

As of 16 October 2026