Privacy Policy

Tomo is a calorie- and nutrition-tracking app operated by Tomo (“we”, “us”). This policy covers the Tomo iOS app and the tomitomo.app website. Questions, requests or complaints: privacy@tomitomo.app.

Things you give us:

• Account details — your name and email from Sign in with Apple or Google. Tomo does not offer email-and-password accounts.
• Health and goal inputs — height, weight, target weight, goal and pace, activity level, dietary preferences and restrictions, eating-window preferences, and water goal. You give these during onboarding, every question is skippable, and we ask for your explicit consent before using any of them (see section 05).
• Food logs — meal photos you take, barcodes you scan, meals you type or dictate, portions you edit, and your water, weight and exercise entries.
• Coach conversations — the messages you exchange with Tomo in chat.

Things collected automatically:

• Device and usage data— device model, OS version, app language, and pseudonymous product events tied to an opaque account ID after sign-in (for example “a meal was logged from a photo”). Our analytics events are structurally barred from containing health values: no calories, no weights, no macros, no food names — this rule is enforced in the app’s code, not just in this policy. You can turn product analytics off in Settings.
• Crash and performance diagnostics — kept for up to 90 days.
• Push token — only if you enable notifications.

Things we receive from others:

• Purchase status — whether your subscription is active, from Apple via RevenueCat. Apple processes the payment itself; we never see your card.
• Sign-in details — name and email from Apple or Google if you sign in with them.

We do not collect precise location, contacts, browsing history, or photos other than the ones you deliberately point at food.

Tomo’s core features are powered by third-party AI models. We disclose them by name, and the app asks your permission before your data is first sent to them:

• Google LLC (USA)— meal-photo recognition, the optional personalized plan narrative, and coach conversations that include an image. When you snap a meal, the photo and your request are sent to Google’s Gemini API, which returns a food identification result. Plan generation may send your goals and preferences. Relevant plan targets and recent meal context may be included so the coach can answer your question.
• Hangzhou DeepSeek Artificial Intelligence Co., Ltd. (China)— text-only Tomo coach conversations. Your message, relevant recent meal context and plan targets are sent to DeepSeek’s API so the coach can answer about your day. Photos are not sent to DeepSeek.

We use a billing-enabled Gemini project. Under Google’s paid-service terms, prompts, files and responses are not used to improve Google products, although they may be retained briefly for abuse monitoring. DeepSeek’s published policy permits processing prompts to operate, improve and train its technology. We therefore route only text to DeepSeek, never attach a meal photo, and never send your email, name or Tomo account identifier to either provider. The app asks for your consent before the first AI transmission.

Barcode scans are looked up against Open Food Facts (a public food database); the only thing transmitted is the barcode number.

• Run the product: count your meals, keep your diary, calculate your plan and targets, track streaks and missions, and answer you in chat (performance of our contract with you).
• Health inputs are processed only with your explicit consent (see 05).
• Keep the service safe: rate limiting, abuse prevention, and diagnosing crashes (legitimate interests).
• Improve the app through pseudonymous, health-value-free analytics (consent — you can opt out in Settings).
• Send notifications you asked for, like meal reminders (consent — controlled in Settings).

We never use your health data for advertising, and we never sell personal data — health or otherwise — to anyone.

Weight, dietary and eating-pattern data is sensitive (“special category” data under GDPR Article 9). Tomo processes it only with your explicit consent, which the app requests during onboarding before anything is stored. You can withdraw consent at any time in Settings; because the app cannot work without it, withdrawal deletes your account and its data (section 08). Your health data is never used for marketing or advertising and is never shared with data brokers.

Only service providers who process data on our instructions, under data processing agreements:

• Supabase — database, authentication and storage hosting.
• Google LLC — meal recognition and image-based coach chat (section 03).
• DeepSeek — text-only coach chat, including service improvement under its published policy (section 03).
• RevenueCat — subscription management.
• OneSignal — push notification delivery.
• PostHog (EU hosting) — opt-out product analytics whose events contain no food names or health values.
• Sentry — scrubbed crash and performance diagnostics.
• Apple — payments and App Store distribution.

Beyond these: only if the law requires it, or as part of a company transaction in which this policy continues to apply. No advertising networks. No data brokers. No “partners”.

Our providers process data in the United States and other countries. DeepSeek states that its service data may be processed and stored in the People’s Republic of China. Where data leaves the EEA/UK, we use the transfer mechanism required for the relevant provider and destination, such as adequacy decisions or Standard Contractual Clauses where available. You are shown the AI providers and asked for consent before an AI feature sends your content.

• Your account data, logs and chats are kept while your account exists.
• Delete your account (Settings → Delete account) and everything — meals, photos, weights, chats, streaks, coins, mascots — is permanently erased within 30 days.
• Crash diagnostics are kept up to 90 days.
• Pseudonymous analytics events may remain after account deletion but contain no food names or health values and cannot reconstruct your food diary.

Data is encrypted in transit; access is controlled with row-level security so your records are readable only by your authenticated account; sessions are stored in your device’s secure keychain. No system is perfect, but the boring parts are done properly.

You do not need to email anyone to exercise the big ones:

• Export — Settings → Export my data hands you your entire history as one JSON file.
• Correct — every meal, weight and setting is editable in the app.
• Delete — Settings → Delete account, in the app, no questions asked.
• Withdraw consent — Settings → Health-data consent.

Depending on where you live you may also have rights of access, restriction, objection and portability, and the right to complain to your data-protection authority. For any of these: privacy@tomitomo.app. We answer within 30 days.

Tomo is not for children under 13 — the app checks age during onboarding and stops there. If your country sets a higher age of digital consent, that age applies. For users under 18, the app deliberately applies gentler, more conservative plan targets.

If we change this policy in a way that matters, the app will tell you and, where required, ask you to agree again before your data is used under the new version. The date at the top always reflects the current text.