1. Who receives the consent
Data controller: individual entrepreneur Maksim Zelenskiy, state registration number (OGRNIP) 326237500396730, Russian taxpayer ID (INN) 234807956734 (the “Operator”, “Tomyo”). Contact for personal data requests: sendmail@tomyo.app.
2. What the user confirms
I, a user of tomyo.app and the Tomyo mobile apps, freely, of my own will and in my own interest, give the Operator my consent to process my personal data on the terms set out below. Consent is given by ticking the box “I give my consent to personal data processing” when creating an account or on the consent screen after signing in. The Operator records the date, time, IP address, device and the version of this document at the moment the box is ticked.
3. Data being processed
- email address and an encrypted password;
- name and avatar, if received from Apple, Google or Yandex when signing in with those services;
- display name, interface language, level and learning goals that I set myself;
- learning data: vocabulary, progress, session history, journal, AI dialogues, personal translations;
- texts I type into the AI chat, exercises and conversations with other learners;
- support requests and feedback;
- technical data: IP address, device and browser type, device and push notification identifiers, app version, cookies;
- usage data: pages visited, learning events, referral source;
- subscription payment details: amount, date, payment identifier (no card details).
No special categories of personal data and no biometric data are processed.
4. Purposes
- creating and maintaining the account, signing in;
- providing learning features: word selection, review, dialogues, writing checks;
- saving and displaying my progress;
- answering support requests;
- setting up and renewing the subscription, sending receipts;
- service messages: email confirmation, sign-in codes, subscription notices;
- usage analytics and session recordings to fix errors and improve the product;
- security: protection against password guessing and abuse, incident investigation.
Marketing and informational emails are not covered by this consent; they require a separate consent that can be withdrawn in Settings.
5. Processing operations
Collection, recording, systematisation, accumulation, storage, updating, retrieval, use, transfer (provision, access), anonymisation, blocking, deletion and destruction, using automated means.
6. Recipients
The main database and files are stored on servers in the Russian Federation. For certain features the Operator engages third-party processors or transfers data to them:
- hosting and storage: Timeweb (Russia);
- email delivery: Unisender (Russia);
- payments: Robokassa (Russia) — email address and payment details;
- analytics and session recordings: Yandex Metrica, AppMetrica, Mail.ru counter (Russia);
- third-party sign-in: Yandex (Russia), Apple and Google (USA) — when that sign-in method is chosen;
- push notification delivery: AppMetrica (Russia), Apple and Google (USA);
- app error reporting: Rollbar (USA) — technical error data without email or name;
- AI generation of learning materials and text checks: DeepSeek (China) — the texts I enter, without name or email;
- text-to-speech: Google Cloud (USA) — learning text only, no data about me.
7. Cross-border transfer
I am informed and agree that when I use the features listed in section 6, part of the data is transferred to foreign countries: the People’s Republic of China and the United States of America. The Operator transfers the minimum necessary data and, wherever possible, without information that could identify me.
8. Duration and withdrawal
Consent is valid from the moment it is given until it is withdrawn or the account is deleted. Data is kept while the account is active; sign-in, error and visit logs are kept for the limited period stated in the Privacy Policy; payment records are kept for the period required by tax law.
I may withdraw consent at any time by deleting my account in the website or app settings, or by emailing sendmail@tomyo.app. After withdrawal the Operator stops processing and destroys the data, except where the law requires retention. Withdrawal makes further use of the service impossible, because it cannot operate without this data.
9. User rights
I have the right to obtain information about the processing of my data, to request its correction, blocking or destruction, and to appeal the Operator’s actions to Roskomnadzor or a court. The Operator answers requests within the statutory period of 10 business days.