Privacy policy

In short

Tomoe keeps what you record so it can show it on every phone you sign in on. It uses your records only to run Tomoe for you.
Your records are stored in Germany, in the European Union.
Health data, such as your workouts, supplements and measurements, is processed only with your explicit consent.
Tomoe shows no advertising, collects no usage analytics and never sells your data.
During the free launch, nothing you record is sent to an AI service.
Crash reports are off until you turn them on.
You can export your data or clear your history in the app, and delete your account in the app or on the web, at any time.

Who is responsible

The controller of your personal data is Dawid Tomczyk, Tomoe's developer, an individual based in Poland, called "we" in this policy. Write to privacy@tomoe.health about anything in this policy.

What Tomoe collects and why

Your account

Email address, and your name and profile picture if you sign in with Google — held by Google Firebase Authentication to sign you in, verify your address and reset your password. We also use it to tell you by email about a change to the terms or this policy, a change that makes your plan worse, or Tomoe stopping. Tomoe's servers know you by the account id Firebase gives you. They use your email address to send the sign-in link that proves an account is yours when you delete it on the web, to find your account when you ask by email for it to be deleted, and for the notices above.
Password, if you sign up with email — Firebase keeps it only in a form that cannot be read back. Tomoe never sees it.

Your profile

Display name — shown in the app.
Profile picture, if you choose one — an emoji, or a photo you pick, which the app crops square and shrinks on your phone before sending it. Tomoe's servers keep it to show it on each of your phones, and only you can see it. Removing it or deleting your account deletes it, and your export includes it.
Language, first day of the week, quiet hours and the notification kinds you turned off — to show the app in your language and remind you only when you want.
About you, if you give it — your birth date, sex, height, how much you have trained, what you want to work on, what Tomoe should go easy on (body parts and a note in your own words), when you usually wake up and go to bed and when your day ends, and the units and clock you want. Each is optional, and each is asked with its reason: what you want to work on orders Home's figures and, with your AI consent, guides the Assistant and insights; your daily rhythm sets quiet hours, when your day ends and the app's light through the day; your height is kept on your profile beside your bodyweight; and your birth date, sex, how much you have trained and what to go easy on are only for the Assistant and insights, with your AI consent.
When your account was created, to count your history from it.
Your settings — whether built-in Library objects and Insights are shown, how new exercises start (rest time, sets, the weight step and the bar's weight), reminder defaults and the exercises you follow on your progress, to set up the app the way you use it.
Your consents — each consent you give or withdraw, with the version of the document it refers to and the time, as the record of what you agreed to.

Your plan

Your plan — Free, Plus or Pro, where it comes from (the free launch, a purchase, or a plan we grant by hand, for example to a tester) and when it ends, to give you what your plan includes.
Google Play purchases, if you buy Plus or Pro — the purchase token Google Play gives the app, which product it is, and the purchase's state and expiry, which Tomoe's servers read from Google Play to keep your plan. Your payment details stay with Google Play; Tomoe never receives them.
The launch notice — that we told you, once, that the free launch is ending, so you are not told twice.

What you record

Your Library — the exercises, workouts, Focus presets, tasks, routines, supplements (name, form, strength, dose and instructions) and check-ins you create, to plan and record them.
Plans and schedules — when you mean to do each thing, to show your day and remind you.
Sessions and their results — workouts with sets, weights, repetitions, holds, times, distances and the effort you rate; supplement doses taken or skipped, with the reason if you give one; tasks checked off; Focus time. These make up your history and statistics. Tomoe also keeps the reminders you snooze, to bring them back on time.
Check-in answers — for example mood, energy, sleep, stress or soreness after training, body measurements (waist, hips, chest, neck, arm, thigh and body fat) and vitals (resting heart rate and blood pressure) — to show how they change over time.
Notes — anything you write on a session or an exercise.
Goals and milestones — to count your progress.
What you have seen — the notices in your inbox, and the milestones, suggestions and notifications you have seen, answered or dismissed, so they are not shown again; and how you arrange Home.

Some of this is health data: your workouts and their results, your supplements and the doses you take, check-in answers about your body and wellbeing (your bodyweight, body measurements and vitals included), readings from Health Connect, your height and what Tomoe should go easy on, and notes about them. Tomoe processes health data only with your explicit consent, which you give before you start. This consent is needed to use Tomoe, since keeping your records is what Tomoe does; you can withdraw it at any time in Profile, under Privacy and data, and because Tomoe cannot keep your records without it, withdrawing it deletes your account. Your email address is likewise needed to have an account; everything else about you is optional.

Health Connect

On Android, you can let Tomoe read from Health Connect, where your phone, scales, watch and other apps keep health data. Tomoe reads only the types you turn on in Settings, under Connected data, and Android asks your permission for each: weight, body fat, resting heart rate, blood pressure and steps. For each reading, its value, its unit, when it was measured and Health Connect's id for it are sent to Tomoe's servers and kept with your records, so they appear in your measurements, statistics and export beside what you type yourself. Steps are read as each day's total, as Health Connect counts it across your phone, watch and apps, and sent with that day's date instead of an id. If you allow it, Tomoe also reads these types while it is closed, so new readings appear without opening it. Tomoe never writes to Health Connect and reads nothing else from it.

Readings from Health Connect are health data and are treated like the rest of it. Turning a type off stops Tomoe reading it, and you can also withdraw Tomoe's access in Health Connect. Turning Health Connect off in Tomoe lets you remove every reading it brought, and deleting your account removes them too.

Tomoe's use of information received from Health Connect adheres to the Health Connect Permissions policy, including its Limited Use requirements. Tomoe uses these readings only to show and count your measurements and steps and, with your AI consent, for the Assistant and insights. It never uses them for advertising, never sells them, never uses them to decide on credit or insurance, and shares them only with the processors below, which run Tomoe for us. People read them only with your permission, to keep Tomoe secure, or where the law requires it.

The Assistant and insights

The Assistant and insights come with Pro; until they run for your plan, nothing in this section is collected. Once they run, if you use them, Tomoe keeps your conversation with the Assistant, the insight cards written for you and your feedback on them.

Tomoe also counts how much AI work you use, to keep the Assistant within its daily allowance and, as our legitimate interest, to know what running it costs: for each of your days, separately for the Assistant and for insights, how many tokens (the pieces AI services count text in) the AI read, how many of those it read from its cache, how many it wrote, and their total. The counts hold nothing you or the AI wrote.

Your phones

Each phone's Firebase installation id, platform, time zone and model name, when it was first registered and when it was last seen — Firebase Cloud Messaging delivers to the phone by that id; the rest delivers Tomoe's notices at your local time and outside quiet hours, keeps your phones in step and shows you which phones are signed in, so you can sign one out.
Each phone's Tomoe id — an id Tomoe makes on the phone for each account signed in on it, to tell your phones apart.
The phones you signed out — each one's id and when, so a phone you signed out cannot keep using your account.

Server logs

Each request to Tomoe's servers is logged with its time, the kind of request, its result, size and duration, an error's description if one happened, and a shortened one-way hash of your account id; when a Google Play order is voided, its order id is logged too. Logs never hold your name, email address, IP address or anything you wrote. Your IP address is used only in memory, to limit how many requests one address can send.

Crash reports

Only if you turn on crash reports: when the app crashes, Firebase Crashlytics receives what went wrong (the stack trace and the app's state at the moment), the phone's model, Android version and similar technical details, and an id Crashlytics gives the app's installation. A report never carries your account id, name, email address or anything you wrote, and the text of each error is removed before it is sent. Crash reports are off until you turn them on, when you first set up Tomoe or in Profile, under Privacy and data, where you can also turn them off; reports written while they were off are deleted, not sent.

Messages you send us

If you send feedback in the app, Tomoe's servers keep what you write with your account, together with the app's version, for us to read. If you write to support@tomoe.health by email instead, we receive your email address and what you write. We use a message only to answer it and to fix what it reports.

What Tomoe does not collect

Tomoe does not collect usage analytics and does not send product emails. If it starts to, each is off until you turn it on, and this policy will say what is sent and to whom. Tomoe shows no advertising and never sells your data.

Legal bases

Providing Tomoe (GDPR Article 6(1)(b)) — your account, profile, plan, records and phones, counting AI usage, and telling you by email about changes to the terms or this policy, to your plan or to Tomoe's availability.
Your explicit consent (Article 9(2)(a)) — health data.
Your consent (Article 6(1)(a)) — crash reports and, once the Assistant and insights run, letting AI read your data. You can withdraw a consent at any time; this does not affect processing that happened before.
Legitimate interests (Article 6(1)(f)) — server logs and request limits, to keep Tomoe secure and available, knowing what running the Assistant costs, and answering the messages you send us. You can object to this processing; write to us and we stop unless we have compelling reasons to keep it.
Legitimate interests (Article 6(1)(f)) — keeping the record of your consents, to be able to show what you agreed to.

AI

During the free launch, Tomoe sends none of your data to an AI service. Before the Assistant and insights run, a new version of this policy will name the AI service that writes them and what is sent to it, and Tomoe will ask for your AI consent again at that version; nothing will be sent without it, and you can withdraw it at any time in Settings, under Assistant and Insights.

Who processes your data for us

Google Firebase (Google Ireland Limited and Google LLC) — sign-in with Firebase Authentication, notifications with Firebase Cloud Messaging and, only with your consent, crash reports with Firebase Crashlytics; it sees your phone's IP address. Reminders are set on your phone itself; what goes through Firebase Cloud Messaging are signals that your plans changed or that a reminder was answered on another phone, and notices from Tomoe, such as the free launch ending.
Hetzner (Hetzner Online GmbH) — the server Tomoe's API runs on, in Falkenstein, Germany.
PlanetScale (PlanetScale, Inc.) — the database your records are stored in, and its backups, on Amazon Web Services in Frankfurt, Germany.
Cloudflare (Cloudflare, Inc.) — carries traffic between the app and Tomoe's servers and protects them from attacks. It sees your IP address and the requests passing through.
Google Cloud Pub/Sub (Google Ireland Limited and Google LLC) — delivers Google Play's purchase notifications, with the purchase token and order id, to Tomoe's servers.
Zoho Mail (Zoho Corporation B.V.) — receives, keeps and sends the emails between you and privacy@tomoe.health or support@tomoe.health, such as replies and confirmations, in the European Union.

Each processes your data only on our instructions and under a data processing agreement.

Google Play handles purchases of plans as a controller of its own, under Google's privacy policy. To match a purchase to your account, the app gives Google Play a one-way hash of your account id; Tomoe receives only what it needs to confirm your plan, never your payment details.

Where your data is kept

Tomoe's servers are in the European Union. Its API runs on a Hetzner server in Falkenstein, Germany, and your records are stored in a PostgreSQL database that PlanetScale runs on Amazon Web Services in Frankfurt, Germany (the eu-central-1 region). Traffic between the app and the API passes through Cloudflare. PlanetScale is a company in the United States, Firebase and Google Play are Google services that may process data outside the European Economic Area, including in the United States, and Cloudflare's network is worldwide. These transfers rely on the EU–US Data Privacy Framework or the European Commission's standard contractual clauses; write to us for a copy of the safeguards.

How long it is kept

Your records, profile and Assistant conversation — until you delete them or your account. Clearing your history immediately deletes your past: every session you started, whatever its date, with its results and notes, and every plan before today, all Health Connect readings, every amount logged toward a goal and your inbox, and milestones start over; your Library, schedules and plans from today on, reminders you snoozed or answered, suggestions you dismissed, goals, Home, profile, consents, phones, the Assistant conversation and insight cards stay. Health Connect may bring today's and yesterday's steps back at its next reading. Clearing the Assistant conversation deletes it and your insight cards.
Your plan and purchase records, and the launch notice — until you delete your account. Clearing your history or the Assistant conversation keeps them.
Your account — until you delete it. Deleting it deletes your Firebase account and everything Tomoe's servers hold about you, except server logs, which are deleted within 30 days; see Delete your account.
Backups — deleted data can remain in the database's backups for up to 2 days.
A phone's details — until you sign out on it or remove it. The record of a phone you signed out stays until you delete your account.
AI usage counts — the counts of the latest day you used AI and of the 62 days before it; older days are deleted as a new day is counted. Clearing your history or the Assistant conversation keeps them, and deleting your account deletes them.
Server logs — at most 30 days.
Crash reports — 90 days in Firebase Crashlytics.
Feedback you send in the app — deleted a year after you send it, or sooner with your account if you delete that first. Clearing your history or the Assistant conversation keeps it.
Emails you send us — until we have answered them and fixed what they report, and at most one year.

Your rights

You have the right to access your data, correct it, delete it, restrict or object to its processing, receive it in a portable format, and withdraw any consent. You can see and correct your records in the app, export them or clear your history in Profile, under Privacy and data, and delete your account there or on the web. For anything else, write to privacy@tomoe.health; we answer within one month.

You can also complain to a data protection authority: in Poland, the President of the Personal Data Protection Office (uodo.gov.pl), or the authority where you live or work.

Automated decisions

Tomoe makes no decisions about you based solely on automated processing that have legal or similarly significant effects.

Children

Tomoe is not meant for anyone under 16, and we do not knowingly collect data about them.

Security

Traffic between the app and Tomoe's servers is encrypted. Each person's records are kept apart in the database, so one account can never read another's, and access to the servers is limited to the people who run them.

Changes to this policy

A change to this policy is published here as a new version, with its date shown at the top, at least 14 days before that date unless the law or security needs it sooner, and we tell you by email and in the app. Earlier versions stay available here. When the new version takes effect, Tomoe asks you to read it and to give your consent to health data again before you continue; if you don't, write to us and we send you a copy of your data and delete your account, or delete it yourself on the web.