Privacy policy

Last updated 4 October 2026

Who we are

Truncly is run by an individual, Mahmoud Shayeb (Tulkarm, Palestine), who is the controller for personal data processed on truncly.app and app.truncly.app ("we"). Contact: hello@truncly.app.

What we process and why

• Text you check. Sent to our servers to measure it and returned immediately. Checks aren’t stored unless you save them. (Art. 6(1)(b) GDPR: providing the service you ask for.)
• Longest name check. When you paste a list or pick a column from a CSV or Excel file, the file is read in your browser. Only the longest 20 or so values per tag are sent to work out the answer, they are not stored or logged, and they are gone once the answer is sent. (Art. 6(1)(b).)
• SMS money saver. The text you check is sent to our server to count its parts, and to an AI service only when you ask for a rewrite. The countries and prices you enter stay in your browser. If you are signed in, each rewrite you use keeps only the country, the number of parts before and after, the number of people and the amount saved. (Art. 6(1)(b).)
• One offer, every channel. The copy you paste for each channel is sent to our server to be measured and compared. It is not stored or logged, and no AI is used. (Art. 6(1)(b).)
• Account data. Email, name, password hash, plan, usage counts and whether you asked for product tips, plus the browser and device name of each signed-in session so you can review and end sessions in Settings. (Art. 6(1)(b).)
• Saved content. Saved copy, share links, your own screens and uploaded files, stored until you delete them or your account. (Art. 6(1)(b).) Anyone with a share link can see it; links made without an account expire after 90 days.
• Teams (Agency plan). To invite someone, the team owner gives us their email address and we send one invitation. It expires after 7 days and is deleted 30 days after it’s used or expires. Everyone on a team sees the others’ names and email addresses, and members’ usage counts toward the owner’s plan. Leaving or being removed ends this. (Art. 6(1)(b); for invitees, Art. 6(1)(f): delivering an invitation someone asked us to send.)
• Payments. Paddle.com is our reseller and merchant of record: it sells you the subscription, processes payments, issues invoices and handles sales tax as its own controller, under Paddle’s privacy notice. We never see card numbers; we keep your Paddle customer id and subscription status, and we get an email when a subscription starts, changes, fails to renew or ends. If you cancel, Paddle may ask why and offer a pause, a lower plan or a discount (Paddle Retain). (Art. 6(1)(b) and (c): tax records.)
• Local prices. To show prices in your currency with tax, we use the country Cloudflare detects for your connection and ask Paddle for that country’s prices; Paddle gets only the country, not your IP address. The country isn’t stored with anything about you. (Art. 6(1)(f): showing the price you’ll actually pay.)
• Service emails. Sign-up confirmation, password resets, usage alerts at 80% and 100% of your plan, “your file is ready” notices and team invitations. (Art. 6(1)(b).)
• Product tips. Only if you tick the box at sign-up or turn them on in Settings: a few emails with ways to use Truncly, and a Monday summary of your own week (saved copy that no longer fits, how many checks you ran and what your SMS rewrites saved), sent only when there is something to report. We keep a daily count of your checks for 60 days to write it. Every one has a one-click unsubscribe link, and you can turn them off in Settings. No other newsletters or marketing emails. (Art. 6(1)(a): consent.)
• Product usage. Which features a signed-in account uses (for example that a fix ran, a file was uploaded or a link was shared, or that the pricing table was shown or a checkout window was opened or closed), with your account id, never the text itself. It shows us what helps people and what to fix. Anonymous use is counted as daily totals, and in the tool notes described below. Kept for up to 400 days, deleted with your account. (Art. 6(1)(f): improving the service.)
• Reports about share pages. What you tell us and, if you give it, your email so we can reply. Kept for 180 days. (Art. 6(1)(c) and (f): handling notices about content on our domain.)
• Client feedback (Agency plan). When someone approves or comments on a share link, we store the name, the optional email and the comment they type, for the person who shared the link. Only that person sees the email address. It’s deleted with the link, when the owner deletes a comment, and with the owner’s account. (Art. 6(1)(f): passing on feedback a visitor chose to send.)
• Security. Your IP address is held briefly in the server’s memory to rate-limit requests and block abuse. It isn’t written to our database or logs. Server logs record the time, the page or API route and the result (no IP addresses or full email addresses), and are capped in size and overwritten automatically. (Art. 6(1)(f): keeping the service safe.)
• Visit statistics. Cloudflare Web Analytics counts page views, referrers, countries and browser types without cookies, local storage or fingerprinting, and doesn’t follow you across sites. (Art. 6(1)(f): learning which pages help people.)
• How our tools are used. Our own server notes which page you opened, which tool you used (for example the checker, and which screens you picked), whether it worked, the site that sent you, campaign tags in the link and your country. To count people rather than clicks, it makes a short code from your IP address, your browser name and a random value that changes every day. The IP address itself isn’t stored, and the old daily value is deleted, so the code can’t follow you from one day to the next. If you’re signed in, the note is linked to your account and deleted with it. Kept for 400 days and never shared. (Art. 6(1)(f): learning which tools help people.)

AI features

When you use AI rewrites or translations, only the text being processed (plus your must-keep phrases and brand) is sent to our AI provider, Anthropic. It is not used to train models, and Anthropic keeps API inputs and outputs for a limited time under its commercial terms. AI-written text is labelled in the app, in the API (aiUsed) and in exported files (truncly_ai_generated); always review it before you publish. No decision with legal or similarly significant effects is made about you by automated means.

Cookies and browser storage

• tr_session: one essential cookie that keeps you signed in on truncly.app and app.truncly.app. It lasts 30 days or until you sign out.
• Local storage: the checker keeps your unsent draft and settings in your browser, and the app remembers which usage notice you dismissed. It never leaves your device.
• Security: Cloudflare, which protects the site, may set a strictly necessary security cookie.
• Checkout and billing: when you open checkout, and on Plan & billing if you’re a paying customer, Paddle’s script may set its own cookies, needed for payment, fraud prevention and payment reminders. See Paddle’s privacy notice.

We use no advertising or tracking cookies, so there is no cookie banner. Product usage is measured on our own server, without cookies.

Processors

Where your data lives

Your data is stored in the EU (Frankfurt). We run the service remotely from Palestine. Transfers to processors outside the EU rely on the EU Standard Contractual Clauses. If you upload files that contain other people’s personal data, we process it only on your instructions, to provide the service; email us for a data processing agreement.

Retention

Account data is kept while your account exists. Deleting your account (Settings → Delete account) permanently removes it and everything linked to it; it disappears from our backups within 14 days, when they roll over. Invoices are kept by Paddle as long as tax law requires.

Children

Truncly is a work tool and isn’t meant for anyone under 16. If you think a child has given us personal data, email us and we’ll delete it.

Your rights

You can access, correct, export or delete your data, restrict or object to processing, withdraw consent at any time, and complain to your data protection authority. Email us and we’ll respond within one month. You can also contact us by post.