Privacy notice

Tuffo is a pool-care app: you log water tests, it shows what the weather did to your water and suggests what to add. This notice lists what Tuffo keeps about you, who else handles it, how long it stays, and how to take it with you or delete it. Questions go to privacy@tuffo.app.

Who runs Tuffo

Tuffo is an independent project run by its developer in St. Petersburg, Florida, in the United States. For anything about your data, write to privacy@tuffo.app.

What Tuffo keeps

Your account

Your email address, which is how you sign in: Tuffo emails you a code or a link, and there is no password. If you choose “Continue with Google”, Google confirms your address instead; the sign-in system also keeps the name and profile-picture link Google sends with it, which Tuffo does not use or show. Your choice of US or metric units. When the account was created and last signed in to. If you came through a link with a label (for example the name of a forum), that label, to see which places bring people to Tuffo.

Your pools

For each pool, the name you give it, its volume, surface and sanitizer, whether it has a cover, any screen enclosure over it and the share of sun you set for it, and optional numbers such as your fill water's calcium or your salt cell's model and output, whether its control is set in percent or levels, and the salt level it asks for. For a salt pool, also the pump schedules you enter (run times, speeds, whether the cell runs) and the dates they started. If you enter the rain that fell at your pool on a day, that amount and date. The equipment you add (pump, chlorine feeder, filter, heater): its kind, make and model, setting, and the dates it was in use, and the day the salt cell was installed if you enter it. For maintenance: the days you mark a task done (such as cleaning the cell or backwashing), the filter pressure readings you log and their dates, and how often you want each task. The location is stored as a weather cell about 3 km (2 miles) across (5 km for pools set up before September 30, 2026, until their location is picked again), plus the town name you picked and the time zone. If you pick the square on the map, only the square is sent to Tuffo, not the point you tap. Tuffo never stores a street address or a GPS position.

What you log

Water tests (the numbers, when and how you tested, and any note), the chemicals you added, and events such as topping up, backwashing, covering the pool or changing the salt cell setting.

What Tuffo works out

From your tests, what you added and the weather at your pool, Tuffo works out how fast each pool uses chlorine and keeps those figures with the pool. From them and the weather forecast for your pool's area it makes a 7-day plan (what to add each day, days to watch), updated nightly and after each test. Both are deleted with the pool or your account.

Photo scans

When you scan a printout, a test strip, a tester screen or a screenshot of your pump's schedule, the image goes to Anthropic's AI model, which reads the numbers and sends them back into the form for you to check. Tuffo does not store the photo. It keeps one log line per scan: the time, whether it worked, the kind of test, how sure the model was and how much processing it used. That log is what counts your monthly scans.

Reporting a misread

After a scan you can report numbers it read wrong. Tuffo then keeps what the scan read, the corrections you made, your note if you write one, when you sent it and which version of the reader was used. The photo is kept only if you tick the box to share it, for that report; you can crop it on your device first, and only the cropped part is sent. Reports are used only to improve photo reading. Only Tuffo's developer sees them; they are stored with Supabase in the United States, and are never published or sold. To test a fix, a shared photo may be sent to Anthropic's AI model again. Shared photos are deleted 12 months after you share them; the text of a report is kept until you delete it or your account. Delete a photo any time on your Account page, under Shared scan photos, or write to privacy@tuffo.app.

Feedback

When you send feedback from the app, Tuffo keeps your message, the kind you picked (idea, problem, question or other), when you sent it, the app page you sent it from (with pool identifiers removed), the app version, whether you said it is OK to email you about it, and the status the developer gives it. It is linked to your account so you can see your own feedback and its status. Only the developer reads it. To sort and group suggestions, the messages may be summarized with the help of Anthropic's AI model; that step sees the message, kind, page, app version, status and time, never your email address or account.

Email alerts

Alerts are off unless you switch them on for a pool. If you do, Tuffo keeps your choices for that pool (algae-risk warning, test reminder and after how many days, weekly summary, maintenance reminders) and, for 90 days, a record of each alert it sent (the date and the kind), so it does not repeat itself or email you more than once a day. The emails go to your sign-in address. Every one has a link that switches them off, and you can change them on your account page.

The waitlist

If you join the waitlist on the home page, Tuffo keeps your email address, when you joined and the label of the link that brought you (for example the name of a forum), only to invite you to the beta. It is deleted when you are invited or when you ask; if you are invited, the link label stays with your account, as described above. To slow down automated sign-ups, the server briefly counts requests per network address in memory; the address is not stored.

Link visits

When you open Tuffo from a link with a label (for example tuffo.app/?ref=pools), the server adds one to that label's count for the day. Only the label, the date and the count are kept: no address, cookie or browser details, nothing that identifies you or tells two visits apart.

The public forecast

The forecast page (tuffo.app/forecast) works without an account. The town or ZIP code you type goes to Open-Meteo to find the town, and the forecast is fetched for its weather area (about 3 km, 2 miles, across). Tuffo keeps nothing from it: no search, no address, nothing about you. The page's link holds the town name, the weather area and the pool numbers you entered, never a precise location. Each forecast shown adds one to a daily count, as with link visits above. To slow down automated use, the server briefly counts requests per network address in memory; the address is not stored. The page shows a map only if you choose to pick your square on it; the OpenStreetMap Foundation then serves the map images to your browser (see processors below), and the link keeps only the weather area you pick, never the point you tap.

Technical logs

The hosting and database providers record IP addresses and browser details in their server and security logs. They keep them for a short time, to run the service and to stop abuse. Tuffo does not combine them with anything else.

Error reports

When something breaks, Tuffo sends a report to Sentry: the error, the page it happened on, the app version and your browser type. Before a report leaves, Tuffo removes email addresses, cookies, anything you typed into a form and the parts of links that can carry sign-in codes. Reports do not say which account hit the error.

What Tuffo does not collect

No name, phone number, payment details, precise location or contacts. There is no advertising and no analytics tracking. The only cookies are the ones that keep you signed in.

So the app works without signal, your device keeps copies of the app pages you open and any test, dose or event you log while offline, until it is sent. These stay on your device and are not shared. Signing out removes the page copies; entries still waiting are sent the next time you sign in on that device. When you remove a dose or event, the browser tab keeps a copy for Undo until the tab is closed.

Why Tuffo uses it

• To run the service you signed up for: signing you in, keeping your pool history, working out doses and matching your tests with the weather at your pool. For readers in the EU and UK, the legal basis is the contract between you and Tuffo.
• To improve Tuffo from the feedback you send, and to reply when you said it is OK to email you. Legal basis: legitimate interest.
• To send the alert emails you switched on. Legal basis: your consent, which you can withdraw at any time with the link in each email or on your account page.
• To improve photo reading from the misread reports you send. Legal basis: your consent for a shared photo, which you can withdraw by deleting it; legitimate interest for the text of the report.
• To keep the service secure and affordable, for example by limiting photo scans. Legal basis: legitimate interest.
• To make the advice better. Tuffo may study de-identified, aggregated data, such as how fast chlorine drops in strong sun across many pools, to tune its dosing models. Aggregated data cannot identify you or your pool. Legal basis: legitimate interest, and you can object at privacy@tuffo.app.

Tuffo emails you sign-in codes and, rarely, messages about your account or about changes to this notice or the terms, and the alert emails you switched on. It sends no marketing email unless you ask for it.

Who else handles your data

These providers run parts of Tuffo. Each handles your data only to provide its service to Tuffo, under its own data-processing terms.

• Supabase runs the database, the sign-in system and the storage for files you choose to share (photos sent with a misread report). Data is stored in the United States (US East).
• Vercel hosts the website and the app, in the United States.
• Resend sends the sign-in emails and, if you switch them on, alert emails, from the United States.
• Anthropic reads the numbers in photos you choose to scan, in the United States. Under Anthropic's commercial terms, the photo is not used to train its models and is deleted within 30 days. A photo you share with a misread report may be read again to test a fix, under the same terms. Its AI model may also help summarize feedback messages, as described above, without your email address or account.
• Open-Meteo provides the weather and the town search. It receives the coordinates of your weather cell and, when you look up a town, the text you type. It never receives your email or anything else that identifies you.
• OpenStreetMap Foundation serves the map tiles when you pick your weather square on a map. Your browser loads them directly, so the Foundation receives your IP address and the map area shown, stored in the United Kingdom and the Netherlands under its own privacy policy. Tuffo never sends it your account or the point you tap.
• Google confirms who you are if you sign in with your Google account. Google then knows you signed in to Tuffo; Tuffo receives only your address, name and picture link from it, never your password.
• Sentry receives the error reports described above, in the United States.
• ImprovMX forwards email sent to tuffo.app addresses to the developer's inbox.

Tuffo does not sell your personal information and does not share it for advertising. It would disclose data only when the law requires it, such as under a valid court order, and would tell you first unless that is forbidden. If Tuffo moves into a company or is sold, your data would move with it under this notice, and you would be told beforehand.

Where your data is

In the United States. If you use Tuffo from the EU, the UK or anywhere else, your data is transferred to the US. Those transfers rely on the providers' data-processing terms, including the European Commission's standard contractual clauses where they apply.

How long it is kept

• Your account, pools and logs: until you delete them or your account. An account unused for two years may be deleted, after an email warning you first.
• Feedback: until you delete your account.
• Alert choices: until you change them or delete the pool; the record of alerts sent: 90 days.
• The photo-scan log: 12 months.
• Photos you share with a misread report: 12 months, or until you delete them.
• The text of misread reports: until you delete it or your account.
• Error reports: 90 days at most.
• Waitlist emails: until you are invited, or until you ask to be removed.
• The providers' technical logs: their own short periods, usually days to weeks.

Deleting your account removes it from the live database at once, with every pool, test, dose, event, plan, feedback message, scan log line, misread report and shared photo. Copies in the database provider's backups expire on the provider's own schedule.

Your rights

• Download everything: Account, then Download my data, gives you one JSON file.
• Correct it: change your units, or remove any test, dose or event and log it again.
• Delete it: Account, then Delete account, removes everything in one step.
• Anything else, such as objecting to a use of your data: write to privacy@tuffo.app. You will get an answer within 30 days.

In the EU and the UK you can also ask Tuffo to restrict how it uses your data, and you can complain to your data protection authority. In California and other US states with privacy laws, you have the rights those laws give you, such as to know, correct and delete, and using them will not change how Tuffo treats you. There is nothing to opt out of: Tuffo does not sell or share personal information.

Security

Everything travels over HTTPS. The database keeps each account's pools and tests apart with row-level security, so one account cannot read another's, and the provider encrypts the data at rest. The keys that can reach all data exist only on Tuffo's server. If a breach ever affects your data, Tuffo will tell you, and the authorities where the law requires, without undue delay.

Children

Tuffo is for adults, 18 and over, and is not aimed at children. If Tuffo learns that a child has signed up, it deletes the account.

Changes

When this notice changes, so does the date at the top. Before a change that matters to you takes effect, such as a new kind of data or a new provider that sees personal data, Tuffo will tell you in the app or by email.

Contact

privacy@tuffo.app