TomyLabs Privacy Policy

Version 5.0, effective 2026.10.22

Policy changes

  • 2026.10.22: Rewritten for GDPR and UK GDPR compliance. Added legal bases, your rights, international transfers, children, processors and retention periods.
  • 2026.08.04: Added data retention information.
  • 2026.07.27: Added information about the use of AdMob advertising.
  • 2024.06.26: Added user ID collection, related to login at our cloud service provider.
  • 2016.03.13: Published.

1. Who we are

This policy explains how TomyLabs (“TomyLabs”, “we”, “us”) collects, uses and protects personal data when you use our websites and apps. TomyLabs is the data controller for the personal data described here.

We may update this policy from time to time. The version and date above show when it last changed, and we will notify you of material changes in the app or by email where appropriate.

2. What we collect

Depending on how you use our websites and apps, we may collect:

  • Identity and contact data: first and last name, email address.
  • Account data: a user ID, used for login with our cloud service provider.
  • Technical data: IP address, browser user agent string, device identifiers and, in Android apps, the Google Advertising ID.
  • App usage and stability data: how our apps are used, crash reports and performance data, device model and operating system version, as reported through Android Vitals.
  • Comment data: the content you enter in comment forms, together with your IP address and user agent string.
  • Website usage data: pages visited and general traffic statistics from traffic log cookies on our websites.
  • Communications: messages you send to us, and your marketing preferences.

We do not knowingly collect special categories of personal data (such as health data or religion).

3. How and why we use your data (legal bases)

Purpose Data Legal basis (GDPR Art. 6)
Provide your account and our apps, including login Name, email, user ID Performance of a contract
Improve and customize our products and services Technical, usage and app stability data Legitimate interests (keeping our products useful and reliable)
Monitor app usage and stability App usage, crash and performance data, device model and operating system version Legitimate interests (keeping our apps stable)
Spam detection and security on comments and sites IP address, user agent string Legitimate interests (protecting our services)
Send marketing emails about new products and offers Name, email Consent, or legitimate interests where the law allows for existing customers
Contact you for market research Name, email Consent
Show personalized ads through Google AdMob Advertising ID, device identifiers, IP address Consent
Comply with legal obligations and handle legal claims Any relevant data Legal obligation or legitimate interests

Where we rely on consent, you can withdraw it at any time, without affecting the lawfulness of processing before withdrawal. Where we rely on legitimate interests, you have the right to object (see section 9).

4. Marketing emails

We send marketing emails only where you have agreed or where the law otherwise allows. Every marketing email contains an unsubscribe link, and you can also opt out at any time by writing to support@tomylabs.com. Opting out of marketing does not affect service messages we need to send you, such as account notices.

5. Advertising (Google AdMob)

Our Android apps use Google AdMob to display ads. AdMob may use device identifiers (such as the Google Advertising ID) and your IP address to show ads, including personalized ads based on your activity in our apps and elsewhere. Google acts as an independent controller for this processing. See Google’s policy at https://policies.google.com/privacy.

In the EEA and UK, personalized ads are shown only if you give consent through the consent message in our app. You can change or withdraw that choice at any time through the privacy or consent settings in the app.

You can also:

  • reset your advertising ID or opt out of ads personalization in your Android device’s Google or Privacy settings (menu names vary between versions);
  • manage Google’s ad settings at https://adssettings.google.com.

If you decline personalized ads, you may still see non-personalized ads.

6. Cookies and similar technologies

Our websites use cookies. A cookie is a small file placed on your device that helps us analyze web traffic and remember your preferences. We use traffic log cookies to see which pages are used, for statistical purposes, and we delete that data when it is no longer needed. Cookies that are not strictly necessary are set only with your consent where the law requires it. You can accept or decline cookies, and change your browser settings to block them, although parts of the site may then work less well.

Our apps do not use browser cookies, but they may use device identifiers and similar technologies as described in section 5. We use Android Vitals to track app usage and stability.

7. Who we share data with

We do not sell, rent or lease your personal data. We share it only with:

  • Service providers (processors) acting on our instructions: Google (Firebase), our cloud service provider for login and app services, and DreamHost, our website hosting provider. We have data processing agreements with them.
  • Google for advertising through AdMob (section 5), and for app usage and stability data, which Google collects through Android Vitals (section 6).
  • Gravatar (Automattic) on our websites: an anonymized hash of the email address in a comment may be sent to Gravatar to check whether you have a profile picture (https://automattic.com/privacy/).
  • Authorities or advisers where required by law or to establish, exercise or defend legal claims.

8. International transfers

Some of our providers, including Google, may process data outside the EEA or UK. Where they do, we rely on safeguards such as an adequacy decision, the EU Standard Contractual Clauses (and the UK addendum), or the EU–US Data Privacy Framework where the provider is certified. You can contact us for a copy of the safeguards used.

9. Your rights

If you are in the EEA or UK (and, where applicable, elsewhere), you have the right to:

  • access the personal data we hold about you and receive a copy;
  • rectify data that is inaccurate or incomplete;
  • erase your data (“right to be forgotten”);
  • restrict processing in certain cases;
  • data portability: receive your data in a structured, commonly used format;
  • object to processing based on legitimate interests and to direct marketing at any time;
  • withdraw consent at any time;
  • not be subject to decisions based solely on automated processing with legal effects (we do not make such decisions).

To exercise a right, email support@tomylabs.com. We may need to verify your identity and will respond within one month. You can delete your account and data yourself at https://www.tomylabs.com/delete-account/.

You also have the right to complain to your local data protection authority. In Norway this is Datatilsynet (https://www.datatilsynet.no). In other EEA countries you can find yours at https://edpb.europa.eu; in the UK it is the Information Commissioner’s Office (https://ico.org.uk). We would appreciate the chance to resolve your concern first.

10. How long we keep data

  • Account data (name, email, user ID): for as long as you have an active account. After you delete your account, we delete all personal data from our systems within one month, except where we must keep something to meet a legal obligation.
  • Comment data (including IP address and user agent string): as long as the comment is published.
  • Server and security logs (including IP addresses): 30 days.
  • Website traffic statistics from cookies: 130 days, then deleted or anonymized.
  • Marketing preferences: until you withdraw consent or unsubscribe, with a minimal record kept so that we honor your opt-out.
  • Advertising data and Android Vitals data held by Google are governed by Google’s own retention policies.

11. Security

We use suitable technical and organizational measures to protect personal data against unauthorized access, loss or disclosure, including access controls and encrypted connections. No system is completely secure. If a personal data breach is likely to put your rights at risk, we will notify the relevant authority and, where required, you.

12. Children

Our products are not directed at children under 18. We do not knowingly collect personal data from children below that age. If you believe a child has given us personal data, contact us and we will delete it.

13. Embedded content and links to other websites

Articles on our sites may include embedded content (such as videos or images) from other websites. Embedded content behaves as if you had visited the other website, which may collect data about you, use cookies and track your interaction, including if you are logged in there.

Our sites may link to other websites. We do not control them and are not responsible for their privacy practices, so please read their policies.

14. Contact us

For questions about this policy, to exercise your rights, to request removal of your email or user ID, or to update your information:

If you believe any information we hold about you is incorrect or incomplete, contact us and we will correct it promptly.