Home/Privacy policy

Triply Privacy Policy

Last updated: 2026-08-28

Have questions? Email us at support@triply.africa.

Triply ("the App") is a trip logging application. This policy explains what data we collect, how we use it, and the choices you have. If you have questions, contact us at: support@triply.africa

Summary

  • Camera access is used only to scan barcodes (e.g., vehicle license discs) or capture optional photos you explicitly take. Live camera images are processed on-device and are not sent to our servers unless you explicitly save or upload them.
  • Location is used to record trips you start in the app. You control when trips start/stop.
  • Account information (email) is used for authentication.
  • Data is stored locally on your device and, if you sign in and enable cloud features, securely in our backend. We do not sell your data.
  • A cloud backup contains the full GPS route of every trip you have recorded, not just distances. See What a cloud backup actually contains.
  • Cloud backups are encrypted on your phone before they are uploaded. We hold the encrypted file and none of the keys, so we cannot read your trips. See How your cloud backup is protected.
  • You can save a complete copy of your own data as a file, free on any plan, and you can delete your cloud backups yourself at any time.

Data we collect and why

1) Camera

  • Purpose: Scan barcodes (e.g., to pre-fill vehicle information) and optionally attach photos to records if you choose.
  • Data processed: Live camera frames are processed on-device for barcode detection. We do not store or transmit camera frames to our servers unless you choose to save a photo in the app.
  • Your control: You can deny camera permission. Scanning features will be disabled if denied.

2) Location

  • Purpose: Calculate and record trip distance and routes while a trip is active.
  • Data processed: GPS location points during active trips. The app does not continuously track your location unless you start a trip.
  • Your control: You can disable location permissions at any time in your device settings. If disabled, trip tracking will not function.

3) Account & Authentication

  • Purpose: Sign-in (email and/or Google), sync data across devices (if enabled), and secure your account.
  • Data stored: Email address, basic profile identifiers from your chosen provider.

4) Purchases (Google Play Billing)

  • Purpose: Process subscriptions (e.g., Premium).
  • Data processed: Purchase tokens and subscription status from Google Play. We use these only to verify and manage your subscription status.

Storage & retention

  • Local device storage: Trips, settings, and optional attachments can be stored on your device. Each account signed in on the phone gets its own database file, so one account never reads another's trips.
  • Cloud storage: If you sign in and turn on cloud backup (a Premium feature), your data is stored in our backend under your account. With backup encryption on, what is stored there is a file we cannot open.
  • Retention: We retain synced data while your account remains active. You can delete your account and its data at any time — see Deleting your account.
  • After deletion: we keep one record that a deletion happened — the date and a one-way hash of your email address, never the address itself. It exists so we can answer billing questions and so the free trial cannot be reset endlessly by deleting and signing up again. It cannot be used to contact you.

What a cloud backup actually contains

A backup is a complete copy of your logbook, not a summary. Specifically it holds:

  • every trip, including its start and end times, odometer readings, distance, purpose, business/private classification, start and end addresses, and the full GPS route recorded for that trip — every location point, not just the total distance;
  • every vehicle, including archived ones: registration number, licence number, VIN, make, model, nickname, odometer and licence-expiry date;
  • any Bluetooth devices you have linked to a vehicle, by name and device identifier;
  • your app settings — theme, notification times, and tracking preferences.

We say this plainly because "your data is stored in our backend" does not tell you that every drive you have recorded, as a map trace, is part of it.

  • We keep up to five backups per account, so that a bad backup — taken from a phone that had just been reinstalled, say — does not replace the only good copy you have. Older ones are deleted automatically.
  • You can delete every cloud backup yourself, at any time, from Account → Danger zone → Delete cloud backup. That removes the stored files as well as the records of them, and it does not touch the trips on your phone.
  • Encrypted before it leaves your phone. See the next section.

How your cloud backup is protected

Backup encryption is end-to-end. Your logbook is encrypted on your phone, with a key we never see, before anything is uploaded. What sits on our servers is a file we cannot open — not because we promise not to, but because we do not hold what would open it.

It works like this:

  • A random encryption key is created on your phone the first time you turn encryption on. It never changes, and it is never stored anywhere in readable form.
  • That key is stored twice, both times locked: once with a key held in your phone's own secure hardware (Android Keystore, iOS Keychain), and once with a recovery code that we generate and show you to save. We hold both locked copies and neither of the things that unlock them.
  • On your own phone nothing is ever typed. On a new phone you enter the recovery code once, and that phone then unlocks itself from then on.
  • Changing your recovery code does not change the encryption key, so every backup you already have stays readable. You can see your current code again from Account → Cloud backup → Backup encryption, and you can see and remove the devices that are able to open your backups.

What this means if you lose the code. If you lose your phone and your recovery code, nobody — including us — can open that backup. That is the point of it, and it is the same reason we can never read your trips. It is also why the app pushes you to keep a copy of your data yourself (see below) before you turn encryption on: that copy is not affected by any of this.

You can turn encryption off, in which case new backups are stored so that we could read them. Backups made while it was on stay encrypted and still open with your recovery code.

Accounts that set up a backup password under an earlier version of Triply still work, and the app offers to move them to a recovery code. We have never held a copy of that password either.

Saving a copy yourself

Account → Your data → Save a copy writes a single .triply file containing everything listed above and hands it to your phone's share sheet, so you can keep it in your own cloud drive, on a computer, or anywhere else you choose. This is free on every plan, and "Restore from a file" reads it back.

That file never passes through Triply. Where you put it, and who can reach it there, is entirely up to you — and unless you choose to protect it with a password, anyone who opens the file can read your trips.

Android backup to your Google account

Android backs up installed apps to the device owner's own Google account. Triply takes part in this deliberately: it is what makes a replacement phone find your logbook already there. The backup includes your Triply database and app settings, and therefore the same GPS route data described above.

This copy goes to your Google account, not to Triply. We have no access to it and cannot read it. You can turn it off for all apps in Android's Settings → Google → Backup. On iOS, the equivalent is your iCloud device backup.

The keys your phone holds for backup encryption are deliberately excluded from this. They are protected by hardware that cannot be transferred between devices, so copying them would produce something unusable — which is why a new phone asks for your recovery code once.

Sharing & transfers

  • We do not sell your personal data.
  • Service providers: We use trusted providers to operate the App, including:
    • Supabase (authentication, database, and serverless functions)
    • Google Play (subscriptions/payments)
  • Data is processed in accordance with these providers' security and compliance standards.

Your choices & rights

  • Permissions: You can revoke Camera/Location permissions in device settings.
  • Access and export: Contact us to request access to, or an export of, your cloud-stored data. You can also export your logbook to CSV or PDF from inside the app at any time.
  • Deletion: You can delete your account yourself, in the app or from the web — see Deleting your account. If you use the app only offline, data remains on your device and is managed by you.

Deleting your account

You can delete your Triply account and everything stored with it, at any time, without asking us:

  • In the app: Account → Danger zone → Delete account. Type DELETE to confirm.
  • On the web, without the app installed: triply.africa/delete-account
  • By email: support@triply.africa, from the address on your account. We complete the deletion within 30 days, usually within a few working days.

Deleting your account removes your sign-in (including a linked Google identity), your cloud backup, its settings, the locked key copies described above, and your subscription record. Deleting from inside the app also erases that account's trips, vehicles and linked Bluetooth devices from the device you delete it on. App settings that belong to the phone rather than to the account — your theme, notification choices and tracking preferences — stay behind; clear the app's storage in your device settings to remove those too.

Deleting your account does not cancel your Google Play subscription. Only Google Play can do that, at play.google.com/store/account/subscriptions. Cancel it before deleting your account, or Google will keep charging you.

Security

We apply reasonable administrative, technical, and physical safeguards. No method of transmission or storage is 100% secure.

Cloud backups are encrypted with AES-256-GCM on your device. The key is protected by your phone's secure hardware and by a recovery code only you hold. We store neither.

Children

The App is not directed to children under the age of 13. If you believe we hold data about a child under 13, contact us to remove it.

Changes

We may update this policy. The latest version will always be available at the link you use in the Play Store listing and in-app. Material changes will be communicated in the App or by other appropriate means.

Contact