Privacy policy

Draft as of 2026-10-13. The German version is binding. TODO(legal): review before publishing.

1. Controller

Kolmira UG (haftungsbeschränkt)
Weißenfelser Ring 8
70806 Kornwestheim
Deutschland
Email: support@tomli.app

2. Scope

Tomli is a shopping list app for households. This policy covers the app and the website.

3. This website

• Data: IP address, time, page requested and browser identifier (access data).
• Purpose: delivering the site securely (Art. 6(1)(f) GDPR).
• Recipient: Cloudflare, Inc., our hosting provider.
• Retention: Cloudflare, Inc. publishes no fixed retention period. We do not analyse the access data.

The site consists of static pages and sets no cookies. We serve the font ourselves.

4. The app

Device and sign-in

• Data: On first launch the app creates a random device id and a secret device key. The server stores the id, a hash of the key, a session token (also hashed) and the display name entered. With Sign in with Apple, Apple’s user identifier and an access token are added.
• Purpose: assigning devices to a household and revoking the Apple sign-in when the account is deleted (Art. 6(1)(b) GDPR).
• Recipients: Fly.io; with Sign in with Apple also Apple. Household members see the display name.
• Retention: until the account is deleted (section 6).

List and household

• Data: items, quantities, notes, prices, stores added (name, chain, location) and who added or checked off items.
• Purpose: all devices in a household show the same list (Art. 6(1)(b) GDPR).
• Recipients: Fly.io; the household members.
• Retention: until the household is deleted.

Location

• Data: The app reads the location only while it is open and iOS location permission has been granted. The permission is voluntary and can be withdrawn at any time in iOS settings; without it the app still works, just without store recognition. Recognising a store visit happens on the device. When a store is added, its location is saved with the household data. To look up aisle orders and prices, the app sends the store location to the server, which immediately coarsens it to a grid of about 1 km.
• Purpose: Tomli recognises stores and finds matching aisle orders and prices when the location feature is used (Art. 6(1)(b) GDPR).
• Recipient: Fly.io.
• Retention: a store’s location stays stored until the household is deleted.

Shared aisle orders and prices

The setting “Share layouts and prices” is on by default.

• Data: the order in which categories were checked off, hand-sorted orders and prices entered, per store chain and 1 km cell, with a household identifier. What Tomli reads from aisle signs (label, categories) is stored, while sharing is on, without a household identifier. Because of the household identifier the contributions are pseudonymised, not anonymous.
• Purpose: better sorting and typical prices for everyone (legitimate interest, Art. 6(1)(f) GDPR).
• Recipient: Fly.io. Other households only see aggregated results. These are available without contributing.
• Retention: checked-off trips are deleted after 270 days, prices after 400 days. Hand-sorted orders stay until the household is deleted.

Objection (Art. 21 GDPR): Sharing can be switched off in Settings. After that, no new contributions from this account enter the shared pool, even if sharing is switched back on later. The setting applies to the account, not to other household members. We delete earlier contributions on request to support@tomli.app.

Scanning photos

The scan feature processes recipes, dishes, receipts (as photo or PDF) and aisle signs.

• Data: the photo or PDF. A receipt shows everything printed on it, such as store, date and payment method.
• Purpose: Tomli reads ingredients, prices and aisles. Processing happens when the feature is used (Art. 6(1)(b) GDPR).
• Recipients: The app sends the photo to our server, which passes it to Google’s Gemini API. Google is our processor (data processing addendum for the paid Gemini API). Under these terms Google does not train on inputs and outputs and logs them only briefly to detect abuse.
• Retention: The photo is processed only for reading it. The result (ingredients, prices, aisles) stays in the list.
• Consent: Before the first scan and the first voice input, the app asks whether it may send photos and text to Google. The choice can be changed in Settings under “Read photos and voice with Google AI”.

Voice input

• Data: the recognised or typed list text, including entries via Siri. iOS does the speech recognition, on the device or through Apple’s speech service.
• Purpose: Tomli splits the text into individual items (Art. 6(1)(b) GDPR).
• Recipients: our server and Google Gemini (as under “Scanning photos”); for speech recognition also Apple. Offline, the app splits the text on the device.
• Retention: only for splitting.
• Consent: as under “Scanning photos”; this also applies to Siri. Without consent the app splits the text on the device.

Barcodes

• Data: the barcode number.
• Purpose: the server looks up the product name.
• Recipient: Open Food Facts.
• Retention: the server remembers found products for 30 days, missing ones for 1 day.

Server logs

The server logs operational messages (errors, counters). They are viewable at Fly.io for 7 days.

5. Third countries

Some of the recipients named are in the USA. Fly.io and Cloudflare state a certification under the EU-US Data Privacy Framework. Apple relies on standard contractual clauses; for Google, the transfer terms of the data processing addendum apply.

6. Deletion

The account can be deleted in the app under Settings → “Delete account”. This removes the sign-in, devices, sessions and memberships and revokes Sign in with Apple. The display name then appears everywhere as “Former member”. When the last member deletes their account, the household with its list and its contributions to aisle orders and prices is deleted too. Otherwise the household stays for the remaining members. The identifier under which items were added or checked off stays in existing households so attribution keeps working for the other members.

7. Rights of data subjects

Data subjects have the right to access, rectification, erasure, restriction of processing, data portability and objection (Art. 15–21 GDPR). They may also lodge a complaint with a data protection authority. Ours is the State Commissioner for Data Protection and Freedom of Information of Baden-Württemberg. Requests can be sent to support@tomli.app.

8. Children

Sign in with Apple is available from age 16. Younger people join through a parent’s invite as a device without an account. Their device sends no location.