Privacy policy
Terpoir collects nothing. There is no account, no Terpoir server, no analytics, no advertising and no advertising ID. Your journal is encrypted on your phone, and only you hold the key.
The developer never receives your journal, your location, your scans or anything about how you use the app. The app never contacts terpoir.app.
A few optional features use Google components, which collect some technical data for Google. Each one is off until you turn it on, and each is described below.
Who we are
Terpoir is an open-source personal journal for adults, made by the developer “Terpoir”. Contact: terpoirapp@gmail.com. Website: https://terpoir.app. The source code is public at github.com/nolsen311/Terpoir, so anyone can check what this page says.
What stays on your phone
- Your journal. Sessions, products, notes, photos, voice notes, spots and everything else you record are stored in an encrypted database on your phone. The key is protected by Android’s secure hardware and your screen lock, and a recovery key that only you have.
- On-device processing. Text recognition (receipts and labels), barcode reading, speech-to-text, tag suggestions and insights all run on your phone. Photos and audio are processed in memory; audio is never kept, and nothing you scan or say is sent to the developer.
- No phone backups. Terpoir excludes its data from Android’s cloud backups and device-to-device transfers, so your journal is never copied to a backup service.
- Nothing about you in logs. Terpoir writes nothing about your journal to Android’s system log.
Sync, export and sharing: only where you choose
- Sync through a folder (optional): Terpoir writes encrypted files to a folder you pick, for example a Syncthing folder or a cloud drive through its own app. Only your journal’s keys can open them. Whoever stores the folder can see that encrypted files exist, their sizes and when they change, but not their contents. The folder also holds your journal’s key locked by your recovery key, so a new phone can restore from it.
- Export: an encrypted file (opened only with your recovery key) or a readable copy, saved wherever you choose. Nothing is exported unless you ask.
- Share cards: an image you choose to share, through Android’s share menu. Only what the card shows leaves the app.
Permissions
- Camera: for scanning labels, receipts and codes, only when you open a scanner. Photos stay in memory and are not saved to your gallery.
- Microphone: for voice notes, transcribed by your phone’s on-device speech recognizer. Terpoir never receives or keeps the audio.
- Location (approximate by default, precise only if you ask): to save a spot’s location and, with “Show me” on, to notice you are at a saved spot while the app is open. Locations are stored only inside your encrypted journal.
- Location “all the time”: the Google Play version does not request it. The F-Droid version and the foss APK on GitHub ask for it only if you turn on “Notify me” or purchase reminders; Android’s location service then watches your saved spots, so it holds their coordinates.
- Notifications: for reminders you turn on. By default they say nothing about your spots, and the lock screen never shows more than a discreet version.
- Internet: only for the optional online map and, on Google Play, the Google features below. With the default settings, Terpoir opens no network connection.
Optional online map
Off by default. When you turn it on, the map’s provider receives map-tile requests from your phone, which include your IP address and the area you are looking at:
- OpenFreeMap (the default provider), under OpenFreeMap’s privacy policy. It says it keeps no IP addresses in its access logs by default.
- MapTiler, only with your own MapTiler key, under MapTiler’s privacy policy.
- Google Maps (Google Play version only, if you choose it): see below.
Google components (Google Play version)
The Google Play version can use these Google components. Except for Play Age Signals, each is used only when you turn its feature on or agree to a download. What they collect goes to Google, under the Google Privacy Policy, not to the developer. The F-Droid version and the foss APK on GitHub contain none of them.
Google Maps SDK for Android
Used only while the online map is on with Google Maps chosen as its provider. According to Google’s data disclosure for the Maps SDK, it collects request metadata (such as your device’s OS version, name, model and brand, and the SDK version), stack traces and crash metrics from crashes in its own code, your IP address, a pseudonymous Maps SDK identifier, and map interaction events such as panning and zooming, to maintain and improve Google services. Your spots and journal are never sent to Google; the map only shows a location you move it to.
Google text recognition (ML Kit)
Off by default (“Google text recognition” in the Privacy Center). Your photos are read on your phone, and the scanned text and images are never sent anywhere. According to Google’s data disclosure for ML Kit, it sends Google usage metrics for diagnostics and usage analytics: device information (manufacturer, model, OS version), the app’s package name and version, a device identifier and per-installation identifiers, performance metrics, settings such as image format and size, input and output sizes, event types and error codes. These are sent over HTTPS and not shared with third parties.
Google Play Age Signals
When you first open the app, Terpoir asks Google Play on your phone whether your account belongs to a minor, to keep Terpoir away from people under 18. Terpoir reads only that answer, never stores or sends it, and never asks you to share your age. According to Google’s data safety notes for Play Age Signals, the client library collects no data; the Play Store handles the request under the Google Play Terms of Service.
Google Play Feature and Asset Delivery
If you agree to download the open text-recognition engine, the Google Play Store delivers it. According to Google’s notes for Feature Delivery and Asset Delivery, the Play Store receives device metadata and the app version to deliver the right files, encrypted, not shared with third parties and deleted after a fixed period.
Google Play services location
Included for geofencing, which the Google Play version does not offer in this release, so it is not used. Saved-spot locations come from Android’s own location service, only while the app is open.
Crash reports
Terpoir contains no crash reporter. If you have allowed your phone to share usage and diagnostics with Google, Android itself may send Google a report when an app crashes, and Google shows developers aggregated crash statistics in the Play Console. That is a setting of your phone, not of Terpoir; you can change it in Android’s settings.
Age
Terpoir is for adults of legal age to use cannabis where they live. It asks you to confirm this on first launch (one local yes/no, no date of birth) and is not directed at children.
Your choices and deleting your data
- Every optional feature is a switch in the app’s Privacy Center, with a card saying what it does and what leaves the phone. Turning one off also cleans up what it created.
- Because the developer holds none of your data, there is nothing to request or delete on our side. To delete your journal, uninstall Terpoir or clear its storage in Android’s settings. Files you synced or exported stay where you put them until you delete them.
Changes
Changes to this policy are published on this page, with a new effective date, and in the source history. Questions: terpoirapp@gmail.com.
This website
terpoir.app has no analytics, cookies or scripts. It is served through Cloudflare, which can see visits (such as IP addresses), under Cloudflare’s privacy policy.