Privacy Policy for Tomus

Individual Entrepreneur Konstantin Khalyushev, registered in Georgia, trading as Tomus (“we,” “our,” or “us”) values the privacy of users (“you” or “your”) of the Tomus mobile application (the “App”) and of the website at tomus.app, including the Tomus web learning app at tomus.app/app (the “Website”). This Privacy Policy explains how we collect, use, disclose, and safeguard your personal information when you use the App or the Website. It is a notice about how we handle personal information, not a contract; your use of the App and the Website is governed by our Terms & Conditions.

1. Information We Collect

1.1 Personal Information. We may collect certain personally identifiable information (“Personal Information”) that you provide directly to us when using the App. This may include, but is not limited to:

• Your name
• Contact information, such as email address and phone number
• User profile information
• Any other information you choose to provide to us through the App

1.2 Usage Data. When you use the App, we may automatically collect certain information about your device and usage patterns. This information is typically non-personal and may include:

• Device type
• Device ID
• IP address
• Usage statistics
• App activity and crash data

1.3 Your web learning app account. You sign in to the web learning app with Google or Apple. Through our authentication provider, Supabase, we receive from them your email address, an identifier for your Google or Apple account and, if the provider shares it, your name. If you use Apple’s “Hide My Email”, we receive the relay address Apple gives us. We do not receive your Google or Apple password.

1.4 Your learning data. To save your progress we store with your account the musical directions and level you choose, your onboarding and placement-test results, your game results (score, duration and when you played), which questions you have already been shown, your Daily Jam progress and your practice streak. Before you sign in, your onboarding answers are kept only in your browser and are added to your account when you sign in.

1.5 Purchases on the Website. Tomus Web Full Access is sold by our reseller Paddle (see section 3.3). Paddle collects your payment details, billing information and email address at checkout; we never receive your card details. To connect the purchase to your account, we send Paddle your account email address (to fill in the checkout), your account identifier and the price offered to you, and we store a record of each purchase: the Paddle transaction and price identifiers, the amount and currency, its status (for example paid, refunded or reversed) and the related dates, together with the Paddle notifications we received about it.

1.6 Product and website analytics. On the Website we use Amplitude (data stored in the United States) to understand how the Website and the web learning app are used: pages and screens viewed, onboarding steps, games started and finished, answers given, and purchase steps (prices shown, checkout started, cancelled, failed or completed, refunds), together with technical information such as browser, device and IP address. When you are signed in, these events are linked to your account email address and account identifier. We also use Google Analytics 4, Vercel Web Analytics and Vercel Speed Insights to measure visits and page performance on the Website.

1.7 Other information you send us. If you use “Was this helpful?” or “Report an error” on a page, we receive your rating, the comment you type and the page it is about. The chord progression analyzer computes its free analysis inside your browser. Its paid report is not currently available: if you press the button to buy it, the chords you entered are sent to our server, which replies that the report is unavailable and does not store them or pass them on. Tools that use the microphone process the sound inside your browser; no audio is recorded or sent to us.

1.8 Information stored in your browser. The Website keeps your sign-in session, unsaved onboarding answers and some settings in your browser’s storage, and the chord progression analyzer sets a cookie that remembers the price offered to you. You can remove them by signing out or clearing your browser’s data.

2. How We Use Your Information

2.1 Personal Information. We may use your Personal Information for the following purposes:

• To provide and maintain the App’s and the Website’s functionality, including your account and saved progress
• To process purchases, grant Tomus Web Full Access, and end it when a purchase is refunded or reversed
• To prevent fraud and abuse and to keep the Services secure
• To respond to your inquiries, comments, or feedback
• To send you administrative or promotional communications related to the App or the Website
• To meet our legal and accounting obligations

2.2 Usage Data. We use Usage Data and analytics to improve the App’s and the Website’s performance and enhance your experience. This data helps us identify any technical issues and optimize their features.

2.3 Price tests. We sometimes test different prices for the same product. Tomus Web Full Access is currently offered at either US$9.99 or US$14.99. The price offered to an account is assigned at random from the account’s identifier, so it stays the same on every device and in every session; it is not based on your behaviour, location, device, purchase history or any other personal characteristic. The price is always shown before you pay. We record which price you were offered so we can compare the results of the test.

3. How We Disclose Your Information

3.1 Third-Party Service Providers. We may share your information with third-party service providers to facilitate the operation of the App and the Website and perform services on our behalf. These providers may have access to your Personal Information only to the extent necessary to carry out their responsibilities. For the Website they are: Supabase (sign-in and database), Vercel (hosting, file storage and website analytics), Amplitude and Google (analytics) and Telegram (delivering page feedback to us). Some of them process data outside your country, including in the United States.

3.2 Sign-in providers. When you sign in with Google or Apple, they process your sign-in under their own privacy policies.

3.3 Paddle. Paddle.com is the Merchant of Record for Tomus Web Full Access. It processes your payment and billing information as an independent controller under its own privacy notice, for example to take payment, prevent fraud, calculate tax and issue receipts and refunds.

3.4 Legal Requirements. We may disclose your information if required to do so by law or in response to valid legal requests or orders from governmental authorities.

4. Retention and Deletion

4.1 We keep your web learning app account, learning data and purchase records for as long as your account exists. There is no automatic deletion of an account that is not being used, and we have not set fixed retention periods for this data.

4.2 You can ask us to delete your account by emailing info@tomus.app from the email address linked to it; our support team carries out the deletion. It removes from the Tomus database your account, your learning data, your purchase records and your Tomus Web Full Access (see our Terms & Conditions).

4.3 Deleting your account does not delete information held by other organisations:

• Paddle keeps its own records of your purchase under its privacy notice and legal obligations.
• Analytics data already sent to Amplitude, Google Analytics and Vercel stays with them under their retention settings. Where the provider allows it, we will ask Amplitude to delete the data linked to your account, but we cannot guarantee complete removal.
• Page feedback delivered to our Telegram chat stays there unless we delete it.
• Google and Apple keep their own records of your use of their sign-in.
• Our hosting and database providers may keep backups and logs for a limited period that we do not control.

4.4 Our log of Paddle notifications keeps only identifiers, event types and outcomes, without your name or email address, and is not deleted with an account.

4.5 You can also ask us for a copy of the personal information we hold about you, or ask us to correct it, by emailing info@tomus.app.

5. Security

We prioritize the security of your information and employ reasonable measures to protect it from unauthorized access, use, disclosure, alteration, or destruction. However, no method of data transmission over the internet or electronic storage is entirely secure. Therefore, we cannot guarantee absolute security.

6. Children’s Privacy

The App and the Website are not intended for children under the age of 13. We do not knowingly collect or solicit Personal Information from anyone under 13 years old. If you believe that we might have any information from or about a child under 13, please contact us at the address provided below.

7. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices or for other operational, legal, or regulatory reasons. We will notify you of any material changes by posting the updated Privacy Policy on the Website and within the App or by other reasonable means. The date at the top of this policy shows when it was last updated.

8. Contact Us

If you have any questions or concerns about this Privacy Policy or our data practices, please contact us at:

Individual Entrepreneur Konstantin Khalyushev
Apartment N2 b Iv. Javakhishvili Str 91
Chugureti district Tbilisi, 0162, Georgia
Email: info@tomus.app