Privacy Policy

Last updated: July 2026

tomo is a reminder service that lives in chat — the tomo app in your browser, or Telegram. This policy explains what it stores, why, who touches it, and how to make it forget you. The short version: tomo stores the minimum it needs to send your reminders, never sells anything, and deletes on request.

What tomo stores

Data	Why
Your phone number	It is your account — no other account, email, or password exists.
The reminders, todos and habits you create	To deliver them. This is the product.
Messages you exchange with tomo	To understand your requests, resolve follow-ups like "actually 5pm", and audit delivery.
Your timezone	Inferred from your phone number's country code so reminders fire at the right local time; you can correct it anytime with `timezone <city>`.
Plan & payment status	Whether you're on Free, Pro or Lifetime, and a customer reference at our payment provider. tomo never sees or stores card or UPI details.
Google Calendar connection (optional)	Only if you text `connect calendar` and approve on Google's own consent screen. tomo stores an encrypted access credential and a rolling ~24-hour cache of your upcoming events (title and start time only) to send meeting nudges. It can create events you ask for and read upcoming ones — nothing else, and never your email or other Google data. `disconnect calendar` revokes the credential at Google and deletes everything immediately.

tomo does not collect your name, email, contacts, location, device data, or anything from your other chats. There are no ads and no trackers. The website sets no cookies; it may use Cloudflare Web Analytics, a cookieless, privacy-preserving page-view counter that identifies no one.

Who processes it

Telegram carries the messages when you use tomo there, as it does for any Telegram chat. Telegram's own privacy policy applies to transport.
Google Firebase delivers the one-time SMS code when you sign in to the tomo app, and sees your phone number for that purpose only. Firebase privacy applies.
Web push (your browser vendor's push service) carries app notifications; it sees an opaque endpoint, never message content in the clear.
Meta (WhatsApp Business Platform) carried messages while tomo operated on WhatsApp; that channel has been suspended since August 2026 and this clause applies only if it returns.
Cloudflare hosts tomo's server and database (encrypted at rest and in transit).
Google (Gemini API) may process the text of a message solely to understand a scheduling request when simple parsing isn't enough. Messages are not used to train models.
Google Calendar API is contacted only for users who connected their calendar, only to create the events they ask for and read their upcoming events for nudges. tomo's use of Google user data complies with the Google API Services User Data Policy, including the Limited Use requirements.
Dodo Payments processes payments as merchant of record if you upgrade. Your phone number is attached to the transaction so the upgrade reaches your account.

No other third parties. Your data is never sold, rented, shared for advertising, or used to train AI models.

Retention

Active data is kept for as long as you use tomo — that's what makes it work.
If you text stop or block tomo, all outbound messaging ceases immediately. Your items are kept for 90 days in case you return, then purged.
You can request immediate deletion of everything at any time — see data deletion.

Your rights

Wherever you live, we honor the spirit of GDPR-style rights: access (ask for a copy of what tomo holds about your number), correction (fix your timezone or items in the chat itself), deletion (see data deletion), and objection (text stop and everything stops). To exercise access requests, contact us from a channel that proves control of the phone number in question.

Children

tomo is not directed at children under 13 (or the higher minimum age for your chat platform in your country). Your platform's own age terms apply.

Changes

If this policy changes materially, tomo will tell you the same way it tells you everything — a message in the chat — before the change takes effect.

Contact

hello@tomomind.com

Bot protection

Our sign-in flow uses Cloudflare Turnstile to tell humans and bots apart without showing a CAPTCHA. Turnstile may process limited technical signals from your browser for this purpose, as described in Cloudflare's Turnstile Privacy Addendum. We never see or store these signals.