Lokale und datenschutzfreundliche Terrarienverwaltung
Effective date: September 27, 2026 Application: TerraManager Developer: Codefrog Privacy and support contact: See the TerraManager project repository for the current contact and support channels.
This policy covers both standalone Android/Web use and the optional, operator-hosted Shared Care Web mode. The developer does not operate the Shared Care server. Its operator controls access, storage and backups.
TerraManager is a local-first application for managing terrarium animals and their enclosures.
Privacy is a core design principle of TerraManager.
The current version does not provide or require:
Animal and collection data is intended to remain under the user’s control.
TerraManager stores information that the user enters or creates while managing a collection.
Depending on how the application is used, this may include:
This information is application data and is not transmitted to a TerraManager-operated server.
On Android, TerraManager stores its collection database, application settings and internally managed files locally on the user’s device.
The Android production release does not request the Android INTERNET permission.
As a result, the Android production application cannot use ordinary network connections to transmit TerraManager application data to TerraManager, the developer, advertising services or analytics services.
TerraManager does not require an Internet connection for its normal collection-management functionality.
Optional project, guide, Shared Care and rating links open an external browser or the Google Play app only when selected in Settings. TerraManager does not send collection records, account information or device identifiers with the rating link; it passes only the public app-listing address. The external service may process the connection under its own privacy terms. TerraManager does not automatically request, submit or monitor a review and adds no analytics or network permission.
When TerraManager is used as a Web application, application data is stored locally within the active browser environment where supported.
Browser storage is controlled by the browser and the operating system.
Clearing browser data, using private browsing modes, resetting browser storage or other browser-management actions may remove locally stored TerraManager data.
The website or hosting provider used to deliver the TerraManager Web application may process technical connection information, such as IP addresses, request timestamps or browser information, as part of normal web hosting.
Such hosting-level processing is separate from TerraManager’s collection-management functionality and is subject to the privacy terms of the respective hosting provider.
When a collection operator deploys Shared Care on a Raspberry Pi or another LAN host, the browser signs in to that operator’s server over HTTPS. Box, Animal, feeding, history and picture data is sent to and stored in the operator-owned SQLite database. Local account names, password hashes and sessions and per-account appearance, language and sorting preferences are stored in a separate server database. The browser loads its signed-in account settings; it does not hold a separate Shared Care collection database. The operator is responsible for account access, host security, certificate trust, retention and backups. The Android app remains standalone; its Settings link opens Shared Care in a browser and does not synchronize its local database.
Shared Care also stores a local audit log of authenticated collection and
account changes. Entries contain UTC time, a stable actor identifier, the
account name and role at the time, an operation name, affected record identifiers
and the outcome. Audit entries do not copy notes, images, uploaded archives,
passwords or session tokens. Collection events are stored in the collection
database and account events in the account database, on the operator’s server.
They are not included in portable .tmbackup archives and are not replaced by
a portable restore. Protected host-volume backups include them.
The server prunes audit entries older than 365 days on startup and when new entries are written. Deactivating or removing an account does not remove its existing audit attribution within that period. Older protected backup copies may retain earlier entries until the operator deletes those copies. The operator controls access to these records and is responsible for informing caregivers about this local processing and protecting or deleting backups. No audit data is sent to the developer or an external analytics service.
The developer does not operate a server or backend that receives users’ animal or collection data. An optional Shared Care server is operated by the collection owner.
In standalone modes, Animal, Box, FeedingEvent, picture and application-setting data is processed locally by TerraManager. In Shared Care, collection changes and media are sent to the operator’s LAN server; personal presentation preferences are stored per account on the operator server.
TerraManager does not:
In standalone modes, data leaves the local application only when the user explicitly initiates a transfer or export. In Shared Care, normal record and picture operations also transfer data between the browser and the operator’s server.
Examples include:
Once data is deliberately transferred to another application, storage provider, operating-system component or other third-party destination, that service may process the data according to its own privacy terms.
TerraManager does not control third-party applications or services selected by the user.
TerraManager allows users to create backups of standalone local data or, as a Shared Care administrator, of the operator-hosted collection.
Backups are created only as a result of a user-initiated action.
TerraManager does not automatically upload backups to a TerraManager server or cloud service.
In Shared Care, administrators can explicitly download or restore a portable collection backup. The operator should also back up the server volume to protect both the collection and account databases. Portable backups exclude accounts, sessions and personal account preferences. Portable exports can optionally be encrypted with a user-chosen password in the browser. Backups of the server volume are separate and remain the operator’s responsibility.
The user chooses where an exported backup is stored or transferred.
Unprotected portable exports are readable ZIP archives. An optional password-protected export encrypts the complete archive on the device with Argon2id and AES-256-GCM. TerraManager does not store or recover the password and does not write backup passwords to application or Shared Care server logs. Anyone who obtains an unprotected export may be able to read its collection data and media. A lost password prevents recovery of a protected export.
For Shared Care, the browser encrypts a downloaded backup locally. During a restore, the browser decrypts the selected file and sends the ordinary portable ZIP to the operator’s server over the authenticated connection. The server can therefore read the restored collection; password protection of the exported file does not encrypt the server database or its volume backups.
Users should therefore store and transfer backup files using appropriately protected storage and communication methods.
Users are responsible for protecting backup files that they create, including any copies stored outside TerraManager.
A backup may contain collection information stored in TerraManager and should therefore be treated according to the sensitivity of the information entered by the user.
TerraManager allows pictures and local picture histories to be associated with Animal and Box records.
In standalone mode, pictures selected or created for TerraManager are processed and stored as part of the user’s locally managed data.
TerraManager does not automatically upload Animal or Box pictures to a TerraManager server.
In Shared Care, pictures selected for a record are uploaded to the operator’s LAN server as part of that user-initiated record action.
If the user exports, shares or backs up data containing pictures, those files may be processed by the destination selected by the user.
TerraManager uses QR codes to associate physical enclosures with Box records in the application.
On Android, TerraManager requests camera access for QR-code scanning and for user-initiated camera functionality where applicable.
QR-code recognition is performed on the device.
Individual QR images, ZIP archives and A4 PDF sheets are generated entirely on the device. TerraManager does not upload QR identifiers or Box labels while creating these files.
ZIP and PDF exports are saved only after the user chooses a destination through the operating-system save dialog. This user-selected file access does not require TerraManager to request an additional broad storage, media or network permission.
TerraManager does not transmit camera images or decoded TerraManager QR contents to a TerraManager-operated server.
In Shared Care, the browser recognizes Box QR codes locally. For a valid TerraManager Box code, it sends only the decoded QR identifier to the operator’s same-origin server to find the Box. Camera frames are not uploaded. The Shared Care scanner uses the browser’s built-in QR reader and does not download a decoder from a public CDN. Browser camera permission is requested only when the scanner is opened. An HTTPS origin trusted by the device is required for camera access on another LAN device.
Camera access is requested only when functionality requiring the camera is used or when the operating system requires permission for that functionality.
The camera permission can be managed through the Android system settings.
The Android production release is designed to request only permissions required for application functionality.
The current production package may declare the following permissions:
android.permission.CAMERA
Used for QR-code scanning and user-initiated camera functionality.
android.permission.WRITE_EXTERNAL_STORAGE
This permission is declared with:
maxSdkVersion="28"
It therefore applies only to Android 9 / API level 28 and older.
It exists for compatibility with file-export functionality on older supported Android versions.
It does not apply to Android 10 or newer.
Android or AndroidX libraries may add application-specific internal permissions used to securely manage Android components.
For example, the production package may contain an application-specific DYNAMIC_RECEIVER_NOT_EXPORTED_PERMISSION.
Such permissions do not provide TerraManager with access to personal user information.
The current Android production release does not request:
Some Android system components, file pickers or media pickers selected by the user may provide temporary access to individual files without granting TerraManager broad storage permissions.
TerraManager uses third-party open-source software components to provide QR-code scanning and other application functionality.
QR recognition in the Android application is performed locally on the device.
The Android production release does not request Internet access, so TerraManager’s Android application process does not use ordinary network connections to transmit QR images, decoded QR contents or collection information during QR scanning.
Third-party components remain subject to their respective software licences.
TerraManager can display feeding-related reminder information within the application.
The current version does not require Android system-notification permission for this functionality.
In standalone mode, feeding reminder calculations use local data. In Shared Care, the operator’s server calculates reminder dates from the shared records; the browser displays those dates and marks reminders that are due. For a fixed weekday plan, the selected weekdays and time, together with the automatically detected time zone, are stored with the Animal record so the appointment stays at the chosen local time.
Standalone TerraManager does not require users to register an account.
Standalone use requires no TerraManager username, password or online user profile. Shared Care requires a local account created by the server operator.
The developer does not operate a user-account backend. Shared Care uses local accounts on the operator’s server; its account database is separate from the collection database.
TerraManager does not contain advertising.
It does not integrate advertising networks for the purpose of displaying targeted or untargeted advertisements.
Collection data is not used to create advertising profiles.
TerraManager does not operate an analytics or user-tracking system.
The developer does not receive usage histories describing how users navigate their collections, which animals they manage, when they record feedings or what information they enter into TerraManager.
The Android production release does not request Internet access.
Locally stored TerraManager data remains on the user’s device or within the relevant browser environment until it is removed by the user, by the operating system, by the browser or through application-management actions.
Shared Care collection data remains on the operator’s server until it is changed, deleted or restored by authorized users, or removed by the operator. Clearing one browser’s site data does not erase the server collection.
Depending on the platform, data may be removed by actions such as:
Uninstalling TerraManager does not necessarily delete backup files or other files that the user previously exported to locations outside the application’s private storage.
Those exported files must be removed separately by the user.
TerraManager supports transferring collection data between devices through its backup and restore functionality.
The transfer is initiated and controlled by the user.
TerraManager does not operate an intermediary synchronization server for this process.
Shared Care is a separate, operator-hosted mode in which signed-in browsers use one server database. It does not synchronize with a standalone Android or Web collection; moving data between modes requires an explicit backup import.
The user is responsible for selecting an appropriate and secure method for transferring the backup file between devices.
TerraManager is intended to manage animals and enclosures, not personal profiles.
However, free-text fields such as Animal and Box notes may technically allow a user to enter arbitrary information.
Users should avoid entering personal or sensitive information that is unnecessary for managing their collection.
Any such information entered voluntarily is treated like other collection data: it remains local in standalone mode and is stored on the operator’s server in Shared Care.
TerraManager uses third-party libraries and platform components to provide functionality such as:
The inclusion of a software library does not mean that TerraManager provides that library with users’ collection data over a network.
On Android, the production application does not request the INTERNET permission.
Software licences and acknowledgements for third-party components are available through the project’s dependency information and applicable open-source licence notices.
Some actions intentionally hand data to services controlled by the operating system or selected by the user.
Examples may include:
These applications and services operate independently of TerraManager.
Their handling of files or other information is governed by their own privacy policies and settings.
Standalone TerraManager is designed around local data storage. Shared Care keeps the collection on the operator’s LAN server and requires the operator to protect that host, its HTTPS keys and backups.
However, local storage does not remove all security risks.
Anyone with sufficient access to an unlocked device, exported backup or other exported TerraManager files may potentially access information contained in those files.
Users should therefore protect their devices and exported backups using appropriate operating-system security measures.
This Privacy Policy may be updated when TerraManager’s functionality, supported platforms or data-processing behaviour changes.
Material changes affecting data collection, data sharing, networking, accounts, analytics, advertising or cloud functionality will be reflected in an updated version of this document.
The effective date at the top of this document indicates when the current version became effective.
Questions about TerraManager’s privacy behaviour can be submitted through the current support channels:
When TerraManager is distributed through an application store, the current developer or support contact provided on the applicable store listing may also be used.