Privacy
Last updated 2 September 2026.
toru is a place for the memories that matter. Nothing leaves your phone. Every memory lives on this device. No cloud, no account. No feed. No ads. No tracking.
This page says what that means in practice. It covers the app, and it covers this website.
In the app
The archive stays on the phone that kept it. That includes:
- the photograph on each print
- the words on the back
- the date and, if one was added, the place
- the film stock
- settings
There is no toru account and no toru server. Memories are not uploaded. There is no analytics kit in the app.
A photograph is copied into the app when it is kept. After that the print does not depend on the camera roll. Deleting the original from Photos does not delete the memory.
What the app asks the phone for
None of this is required to install toru. Each one is asked for when it is needed, and each one stays on the device.
- Camera. To take a photo for a memory.
- Photos. To pick a photo for a memory, and to put a print in the library when one is exported.
- Location. Optional. A place can come from the photo, from the phone, or from a pin on the map. Prints that know where they were taken gather onto the map.
- Notifications. Local only. toru can tell you when a memory from this day returns.
On iPhone the map and a suggested place name come from Apple. On Android they come from Google. A coordinate may be sent there so the map can draw. The archive itself stays on the device.
Sharing and backups
A print leaves the phone only when you send it. Export writes a picture to Photos, to the share sheet, or as a story card.
A backup is one file, with a .toru extension, encrypted with a passphrase only you know. Nothing is uploaded and no account is involved. The file can go wherever files go: Files, a computer, a drive. Anyone who has the file and the passphrase can open the archive.
If this phone is backed up through iCloud or a computer, that backup may include the archive. That copy lives in the backup of the phone. It is not a toru server.
If the app is deleted, or the phone is gone
Deleting the app deletes the archive on that device. Offloading the app on iOS keeps the data. A new phone can bring the archive along if the phone itself was moved or restored.
If the phone is lost and there is no backup file and no device backup, the archive is gone. Settings can erase the archive on this device. That erase names what will go, and asks first.
On this website
The app does not collect an email. This site does, if one is typed into the waitlist.
That address goes to Loops, which holds the list and sends the mail. It is used for the release notification. Nothing else is asked for. There is no tracking on this page.
A mail from the list will have a way to stop further ones. Or write to Daniel and the address will be taken off.
Children
toru is not directed at children under 13. The app does not knowingly collect personal information from a child.
Changes
If this page changes, the new date will be at the top. The day the app starts an account, a cloud, analytics, or sharing that leaves the phone, this page changes in the same step.
Contact
toru is built by Daniel, independently.