Privacy notice

This is a translation for convenience. Truffle is sold from Germany, and the German version is the binding one. Where the two differ, the German text applies.

This notice describes what actually happens — on this website and inside the program. It is uncomfortably specific in places: where data leaves your device, this page says where it goes.

1. Controller

[FIRST NAME LAST NAME]
[STREET AND NUMBER]
[POSTCODE CITY], Germany
E-mail: mail@truffle-app.com

No data protection officer has been appointed; the conditions of Section 38 of the German Federal Data Protection Act are not met.

2. This website

Server log files

This website is served through Cloudflare Pages. When you open it your browser transmits technical data, which the host processes in log files: IP address, date and time of the request, the file requested, the amount of data transferred, whether the request succeeded, browser type and version, operating system and the page previously visited. We ourselves see no individual requests, only visitor counts without personal reference.

Purpose
Delivering the website and operational security — detecting and defending against attacks and malfunctions.
Legal basis
Article 6(1)(f) GDPR. The legitimate interest is the technically sound and secure operation of the web server.
Retention
The log files arise at the host, which by its own account keeps them only as long as operation and the defence against attacks require; we have no access to them and store none of it.
Recipients
Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, as a processor under Article 28 GDPR on the basis of a data processing agreement. For the transfer to the United States see section 4, “Recipients” — the same basis applies here.

Storage on your device

This website sets no cookies, embeds no fonts, maps, videos or scripts from third-party servers, and measures no visits. There is no analytics tool.

Three values are stored in your browser's local storage, and only once you have chosen them yourself:

Until you choose something, nothing is stored. The page then appears in the language your browser announces, without that inference being recorded. This makes the storage strictly necessary to provide a service you have expressly requested, and it is therefore exempt from consent under Section 25(2) no. 2 TDDDG. That is why there is no consent banner. Neither value contains an identifier or allows any conclusion about you; you can delete both at any time in your browser settings.

Contacting us

If you send us an e-mail, we process your address and your message in order to answer it. The legal basis is Article 6(1)(b) GDPR where a contract is involved, otherwise Article 6(1)(f) GDPR. We delete the correspondence once it is settled and no statutory retention periods apply.

Our mailboxes mail@truffle-app.com and security@truffle-app.com are hosted on Microsoft 365; the provider is Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland, as a processor under Article 28 GDPR. The mailboxes are stored in the European Union; for access from the United States the standard contractual clauses in Microsoft’s data processing terms apply (Art. 46 (2) (c) GDPR), and in the alternative the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR).

3. The Truffle application

Truffle runs on your Mac. There is no user account and no login. The program contains no code for usage statistics, analytics or crash reporting, and it downloads no code that you have not expressly confirmed. The program talks to us in exactly two places: our licence server, once you have activated it with a licence key (section 4), and the check whether a new version is available (section 5). We thereby learn that an installation is running and which version it is — not what is in your library. The demo version makes no contact with the licence server.

All the catalogue requests described below go from your device directly to the providers named. We are not technically involved in them and receive nothing from them.

What never leaves your Mac

What goes out during an analysis

When you have tracks analysed, artist, title and album go out as search terms to the sources you have switched on in the settings. For audio recognition an acoustic signature is computed on your Mac from three short excerpts, and only that signature is handed to Apple's ShazamKit — not the recording. Artwork that is found is downloaded.

The requests carry no identifier and no account. They contain your IP address, as every internet connection does, and the user agent truffle/1.0.

Which parties Truffle talks to

This list was compiled from the program's source code and is complete, with one explicit exception stated below:

The exception we are not hiding: if Truffle finds a track in no catalogue at all, the web research asks DuckDuckGo as a last resort and then loads the first page in the results to read creator and product names from its page metadata. Which website that is is not fixed in advance — it can be any domain the search engine puts first. That website receives your IP address and the page request. If you would rather it did not, switch off web research under “Sources” in the settings; every other source keeps working.

Every source can be switched off individually. The hosts are listed in the settings underneath each switch, so you do not have to look them up here.

Where Truffle stores things

By far the largest part sits in one folder: ~/Library/Application Support/Truffle. Outside it, as with any Mac application, are your settings in the application's preferences file, along with short-lived working files in the system's temporary folder and a hidden working copy next to whichever music file is being edited; Truffle clears both away itself. No cache of network requests is written to disk at all.

4. Purchase and licence server

Payment processing

The purchase is handled by Lemon Squeezy, LLC (United States). That provider acts as the seller, collects and processes the data needed for purchase, invoicing and tax under its own responsibility and is itself a controller within the meaning of the GDPR. We therefore do not describe that processing but refer you to its privacy notice: lemonsqueezy.com/privacy. The provider is based outside the EU; which safeguard under Articles 44 et seq. GDPR it relies on for the transfer — standard contractual clauses or the EU-US Data Privacy Framework — is stated in its privacy notice.

The licence server

Once you activate Truffle with a licence key, the program talks to our licence server at lizenz.truffle-app.com. It is the only place where we learn anything about an installation. The demo version without a key makes no contact with it. What the server means for your licence — three installations, one session, restricted mode after three days without confirmation — is set out in section 4 of the licence agreement. On activation you confirm this arrangement separately by ticking a box; it is thereby expressly agreed (§ 327h BGB).

When
On activation; afterwards in the background about every 30 minutes, at launch, when the Mac wakes, before larger operations and on quit; also when a device is deactivated and when the device list is shown. During an outage of the server Truffle additionally loads an emergency document signed by us from truffle-app.com.
What is transmitted and stored
On activation: your licence key (transmitted over the encrypted connection, stored only as a salted hash and encrypted), the public part of a device key generated by Truffle together with its checksum as the device identifier — it is generated by the program and says nothing about your hardware — and the name of your Mac as it appears in System Settings. On every confirmation: version, build and architecture of the program, the identifiers of the verification keys embedded in the program, whether the device key lives in the Secure Enclave, the checksum of the running program code, the result of the integrity check (ok, signature violated, code deviating, debugger attached), timestamps and the session state. The server keeps an event log per licence and device (activated, confirmed, deactivated, session taken over) — without IP address. Not transmitted are the contents of your library, file names, search terms, your e-mail address or any usage statistics. As with any network request, the operator of the infrastructure sees your IP address in transit; it is not stored in our database.
Purposes and legal bases
(1) Performance of the licence agreement — device limit, session management, revocation of the key after a refund, notice of new versions: Art. 6 (1) (b) GDPR. (2) Detection of tampering and key abuse based on the integrity status, the checksum of the program code and conspicuous patterns in the event log: Art. 6 (1) (f) GDPR; our legitimate interest is protecting the licence against unauthorised use. The consequence of an anomaly is at most a shorter confirmation validity or temporarily no activation of further devices, never an automatic withdrawal of the licence; a detected debugger session is merely noted. You may object to the processing under (2) pursuant to Art. 21 GDPR.
Retention
Licence data for the term of the licence agreement; device data until twelve months after the device’s last contact; the event log for 90 days; the short-lived random values against replay attacks for ten minutes. Database backups: 30 days in the database history plus a weekly export kept for 90 days — the exports contain device names and events. Should we ever permanently shut the licence server down, we will publish a signed document containing the hashes of all valid licence keys together with the salt used for them, so that Truffle can verify your licence without a server; neither a key nor a person can be derived from the hashes, and the document contains no device data.
Recipients
The server runs at Cloudflare, Inc., 101 Townsend Street, San Francisco, CA 94107, USA, as a processor under Art. 28 GDPR. Database and backups are located in Cloudflare’s Western Europe region. For the processor’s access from the United States we rely on the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR; Cloudflare is certified under it) and, in the alternative, on the standard contractual clauses in the data processing agreement (Art. 46 (2) (c) GDPR). The licence server also asks Lemon Squeezy whether a licence key is valid and receives notifications from there about newly issued, disabled or refunded keys; only the key and its status are exchanged. The program itself does not talk to Lemon Squeezy.

5. Updates

Truffle checks at launch and once a day thereafter whether a new version is available. For this it loads, via the Sparkle update module, a small description file from download.truffle-app.com. This check runs in every installation, the demo version included; an update is installed only after you have confirmed it in the program.

What is transmitted
The version of Truffle and of the update module plus your preferred language — as part of the standard request header that every request on the internet carries — and your IP address in transit. No system profile, no device identifier, no licence key, nothing about your library. We keep no statistics about it and store none of it.
Purpose and legal basis
Providing the security updates we owe under the licence agreement (section 6): Art. 6 (1) (b) GDPR.
Recipients
The description file and the updates are hosted at Cloudflare, Inc. (R2 storage, Western Europe region) — the same processor on the same basis as in section 4. Cloudflare sees the requests in transit and treats the log data as described in section 2.

6. Your rights

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). Any consent given can be withdrawn at any time with effect for the future.

In practice this concerns the server log files of this website, any e-mail correspondence and the data of the licence server (section 4) — we hold no other data; the update check (section 5) leaves nothing with us. For the program’s queries to the catalogues, the providers named above are your point of contact, because those requests go from your device to them.

You also have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your residence, place of work or the place of the alleged infringement (Art. 77 GDPR). The authority responsible for us is the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, Austria, dsb.gv.at.

Providing your data is neither required by law nor by contract. Without the technically necessary transmission of your IP address, however, the website cannot be delivered to you.

As of 29 August 2026