Tomely: privacy and terms of use

Tomely is a medication reminder for Android. To remind you of a dose it has to know what you take and when, and that is health data. This page says what the app stores, who else touches it and how you erase all of it.

I, Tiago Danin, am the developer and the controller of this data under the LGPD (Lei 13.709/2018). If you are in the EU, the GDPR gives you the same rights and I answer them the same way. Write to TiagoDanin@outlook.com about any of it.

What you give the app

Your account

Tomely asks you to sign in, with an email and password or with Google. The account holds your name, your email and, if you use Google, your profile photo. It exists so your medications survive a new phone.

Your medications and doses

Each medication you add stores its name, colour, icon, type, schedule, dose and unit, instructions, start date, stock count and when to warn you about stock. Each dose you confirm, skip or postpone stores the time it was due, the time you acted and what you chose. Your streak and your notification, sound and vibration preferences are stored with your profile.

Medication and dose records count as sensitive personal data under the LGPD. They are processed with your consent, which you give when you create the account and add a medication, and which you withdraw by deleting the account.

What the app collects on its own

Usage statistics

Google Analytics for Firebase records which screens you open and a few events: signing up or in, adding, editing or deleting a medication, confirming a dose, seeing a stock alert and finishing or skipping onboarding. Those events carry the kind of medication and the number of schedules. They never carry a medication name, and the app deliberately does not send your account ID to Analytics, so these statistics are not linked to your account. Analytics also sees your device model, operating system, app version and approximate location, and it may read the device's advertising ID. Tomely shows no ads and does not use that ID for advertising.

Crash reports

Firebase Crashlytics receives a report when the app crashes: the error, the device model, the Android version and the state of the app at that moment. Before anything is logged, the app removes email addresses and account paths from the text, and it leaves the user identifier blank.

What stays on your phone

Reminders are scheduled on the device, so they ring even without a connection. The app keeps your preferences, your language, a draft of a medication you have not finished adding and any dose actions waiting to sync. Firestore also keeps a local copy of your data so the app works offline. Android's automatic backup is turned off for Tomely.

Reminder notifications show the medication name, including on the lock screen. If other people handle your phone, you can hide notification content in Android's settings.

Who else receives it

Tomely has no server of its own. Everything above goes to Google, which processes it on my behalf:

• Firebase Authentication and Cloud Firestore hold your account, medications and doses. Security rules let only your signed-in account read or write your records.
• Google Analytics for Firebase and Firebase Crashlytics receive the statistics and crash reports described above.
• Google Sign-In, if you choose it, confirms your identity with your Google account.
• Firebase Cloud Messaging is part of the app and may register a token for your device. Tomely sends no push messages today.

Their terms: Firebase privacy and Google Privacy Policy.

I do not sell your data, rent it, share it with advertisers, or hand it to a data broker. I would only disclose it if a Brazilian court or authority legally required it.

Why it is used

To run the service you asked for: keep your account, schedule reminders, record doses, compute your history, streaks and stock forecast. The usage statistics and crash reports are used to find bugs and understand which features people use, on the basis of my legitimate interest in keeping the app working. Nothing is used to profile you or to show you advertising.

Where it is stored

Firebase stores data on Google servers, which may be outside Brazil, including in the United States. Google applies the safeguards described in its data processing terms to those transfers.

How long it is kept

Your account, medications and dose history exist for as long as the account does. When you delete the account, the app deletes the dose history, the medications and the profile, then the account itself. Analytics statistics and crash reports are not linked to your account and are kept for the retention period configured in Firebase, after which Google deletes them.

Deleting your data and your other rights

Inside the app: Profile, Account, Delete account. You confirm by typing DELETE, and everything listed above is removed from Firestore and from Firebase Authentication. The app also cancels your reminders and clears its local data.

If you can no longer open the app, write to TiagoDanin@outlook.com from the email on the account and I delete it for you. You can also ask me what data exists about you, to correct it, to receive a copy, or to withdraw consent. I answer within 15 days, the period the LGPD sets. You may also complain to the ANPD, Brazil's data protection authority.

Security

Traffic to Firebase is encrypted, and access to your records is limited to your account by security rules. No system is completely secure, and I cannot promise that nobody will ever break in, but I will tell you and the ANPD if an incident puts your data at risk.

Children

Tomely is meant for adults. It is not directed at children, and I do not knowingly collect data from anyone under 18. If you believe a child has created an account, write to me and I delete it.

Changes

If this policy changes, the date at the top changes with it. For a change that affects what is collected or who receives it, the app shows a notice before the change takes effect.

Contact

Tiago Danin, TiagoDanin@outlook.com.

These terms apply to anyone who installs or uses Tomely. By creating an account you accept them. If you do not, uninstall the app; nothing else is needed.

Who provides the app

Tiago Danin, a private individual in Brazil, who develops and publishes Tomely on Google Play. "I" and "me" below mean him. "You" means the person using the app.

What Tomely is, and is not

Tomely reminds you to take the medications you enter, records the doses you confirm, and estimates when a medication will run out.

It is not a medical device and it gives no medical advice. It does not check doses, interactions or prescriptions. What you enter is what it reminds you of, so check each schedule against your prescription. Decisions about your treatment belong to you and your doctor or pharmacist. In an emergency, call SAMU (192) or your local emergency number.

Price

Tomely is free to download and use. It has no ads, no subscription and no paid tier. If a paid feature is ever added, it will be sold through Google Play, with its price shown before you buy, and these terms will say how it works before it goes live.

Your account

You need an account, with an email and password or with Google. Keep your password to yourself, and use an email that is yours. You answer for what happens in your account. You can delete it at any time from Profile, Account, Delete account.

Reminders depend on your phone

Reminders are scheduled on the device. Battery savers, Do Not Disturb, a denied notification or alarm permission, a phone that is off or a manufacturer that kills background apps can delay or block them. The app asks for the permissions it needs, but I cannot guarantee that every reminder will ring on time. Do not rely on Tomely as the only safeguard for a dose that cannot be missed.

The stock forecast is a calculation from the numbers you enter. It is only as accurate as those numbers.

What you may do with it

I give you a personal, free, non-exclusive and revocable licence to use Tomely on your devices. You may not copy, resell or redistribute the app, get around its security, access other people's data, or use it to break the law. The name, the icon and the design remain mine.

Availability

I work on Tomely in my own time. It may change, lose features, be unavailable for a while or be discontinued. If I discontinue it, I will say so in the app with enough notice for you to export or note what you need, and the data will then be deleted.

Liability

Tomely is provided as it is. To the extent Brazilian law allows, I am not liable for missed or late doses, for health consequences of how you use the app, or for losses caused by the phone, the network or Google's services. Nothing here removes a right that the law gives you and that a contract cannot take away, such as those in the Código de Defesa do Consumidor.

Ending

You can stop at any time by deleting your account. I may suspend an account that breaks these terms, telling you why at the account's email.

Privacy

What the app collects is described in the privacy policy on this same page.

Changes

I may update these terms. The date at the top changes when I do, and a change that affects you is announced in the app before it takes effect. Continuing to use Tomely after that means you accept the new version.

Law

Brazilian law governs these terms. Anything an email cannot settle goes to the courts of Belém, Pará, without prejudice to your right as a consumer to sue where you live.

Contact

Tiago Danin, TiagoDanin@outlook.com.