Tome is operated by Shane Ward, doing business as Tome ("Tome," "we," "us," or "our"), and provides a voice-recording and life-journaling application, the website at tomejournal.com, and related services (collectively, the "Service"). This Privacy Policy explains what information we collect, how we use and share it, the choices you have, and how to exercise your rights. It should be read together with our Terms of Service. By creating an account or otherwise using the Service, you agree to the practices described here. If you do not agree, please do not use the Service.
This policy is written to be specific rather than generic: every practice described below reflects what the app actually does, not a boilerplate description of what a journaling app might do.
Contents
- Information we collect
- How we use information
- Our legal basis for processing (EEA/UK users)
- Who we share information with
- AI processing and model providers, in detail
- Voice recordings and sensitive/biometric data
- How we secure your data
- Data retention and deletion
- International data transfers
- Your rights and choices
- California privacy rights (CCPA/CPRA)
- Other U.S. state privacy rights
- EEA, UK, and Swiss users (GDPR)
- Children's privacy
- Cookies and tracking technologies
- Legal and safety disclosures
- Data breach notification
- Third-party links
- Changes to this policy
- Contact us
1. Information we collect
Account information. The email address you sign up with, and — if you use Google Sign-In — the name and email address Google shares with us. Creating an account requires nothing else: no phone number, no birthdate, no physical address. We also record when your account was created, because that date starts your free trial.
Recordings and what's made from them. The audio you record, which is saved and backed up to your account in the cloud; the text transcript of each recording; the title, date, people, tags, and short summary generated for it; and any tags you set yourself.
Life Journal content. The questions you're asked, your spoken or written answers (audio and text), questions you write for yourself, and the book chapters compiled from your answers. If you used the earlier Storyteller feature, the stories and conversations saved from it remain in your account and appear under "Earlier stories."
Other content you add. Anything you type directly, photos and files you attach to a memory, and the people and tags you create.
Family plan information. If you own a Family plan, the email addresses you invite and which invitees have joined. If you are invited to one, the fact that you belong to that family and the email address you joined with. A Family plan shares billing, not content: see Section 4.
Usage and billing information. Which plan you're on, your trial dates, how much of your monthly AI and book allowances you've used, and — if you subscribe — a Stripe customer ID, subscription ID, renewal date, and subscription status. Tome never receives or stores your card number, expiration date, or CVV; Stripe collects and processes that information directly, under its own privacy policy.
Device and diagnostic information. If you opt in (you're asked once, and can change your answer at any time in Settings), we receive crash reports and technical diagnostics through Firebase Crashlytics: device model, operating system version, app version, and the state of the app at the moment of a crash or error. This never includes your recordings, transcripts, or anything you've written, and nothing is collected here if you decline or opt out.
Information kept only on your device. Some preferences — such as Life Journal questions you've skipped and queued follow-up questions — are stored on your device and are not sent to us.
Information we do not collect. We do not collect precise geolocation, contacts, browsing history outside the app, or any information from other apps on your device. We do not use advertising identifiers, and the Service contains no third-party advertising or tracking SDKs.
2. How we use information
- To provide the Service: storing and backing up your recordings, transcribing them, organizing them with titles, dates, people, and tags, choosing Life Journal questions, showing live captions while you answer, and compiling your answers into book chapters.
- To operate your account: authentication, sync across your devices, trials, Family plan membership, and enforcing plan allowances.
- To process payments and manage subscriptions, through Stripe.
- To maintain and improve the Service's reliability — for example, using opt-in crash reports to find and fix bugs.
- To communicate with you about your account, such as a security notice, a billing problem, or a reply to a support request.
- To comply with legal obligations, and to detect, prevent, or address fraud, abuse, or security incidents.
We do not use your journal content, recordings, or transcripts to train any AI model — ours or a third party's — and we do not sell or use your information for advertising, because the Service carries no advertising to begin with.
3. Our legal basis for processing (EEA/UK users)
If you are located in the European Economic Area, the United Kingdom, or Switzerland, we process your information under the following legal bases:
- Performance of a contract — processing your content and account information is necessary to provide the Service you've signed up for.
- Consent — for optional diagnostics/crash reporting, which is off until you affirmatively opt in, and for any other processing where we ask you directly.
- Legitimate interests — for example, maintaining the security and integrity of the Service — balanced against your rights and never used to justify uses you would not reasonably expect.
- Legal obligation — where processing or disclosure is required by law.
4. Who we share information with
We do not sell your personal information, and we do not share it with third parties for their own marketing purposes. We share information only in the following circumstances:
- Service providers ("processors") who perform specific, limited functions on our behalf and under contractual confidentiality and data-protection obligations — listed in detail in Section 5.
- Within a Family plan — the plan owner can see the email addresses they've invited and which invitees have joined. Every member, including the owner, has a separate private account: no member can see another member's recordings, journal, or book, and the owner cannot see members' content.
- Legal and safety reasons — see Section 16.
- Business transfers — if Tome is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you before your information becomes subject to a different privacy policy.
- At your direction — for example, when you export your book to a Word document and choose where to send it.
5. AI processing and model providers, in detail
Turning a recording into an organized, searchable memory — and your answers into a book — involves more than one step, and different steps are handled by different providers. Requests go from Tome's servers to the provider; the app never sends your content to them directly. Each provider receives only the input its task requires — never your account email or password, and never your whole account:
- OpenAI turns audio into text. It receives a recording when it is transcribed — when you open it, when you tap "Tag now," or in the daily batch that processes earlier days' recordings when you open the app. While you answer a Life Journal question, it also receives your answer in short segments of a few seconds each, to show live captions as you speak.
- Anthropic (Claude) works with text only, never audio. It receives a recording's transcript and returns a title, date, people, tags, and short summary. For Life Journal questions, it receives the questions you've already been asked and your answers within that stage of life, and suggests a follow-up. When you ask for your book, it receives your answers and earlier stories for that stage and returns a chapter in your own words — grammar tidied and spoken self-corrections applied, with nothing invented.
Under these providers' terms for business use of their APIs, content we send is not used to train their models. A provider may keep inputs and outputs for a limited period, typically up to 30 days, solely to detect abuse and keep its service safe, after which they are deleted. Where a provider offers us a shorter-retention or zero-retention option, we use it.
Tome previously used Google's Gemini models for the Storyteller guided interview and for sorting imported documents by period of life. That feature was retired in October 2026, and Tome no longer sends any content to Gemini.
Tome's own infrastructure — the database, file storage, and application servers — runs on Google Cloud and Firebase, based in the United States. Stripe processes payments and holds billing information under its own privacy policy, available at stripe.com/privacy.
6. Voice recordings and sensitive/biometric data
Some jurisdictions (including Illinois, Texas, and Washington) regulate "biometric identifiers," which can include voiceprints used to identify a specific person. Tome does not create voiceprints and does not use your recordings for biometric identification or speaker verification. Your audio is stored so you can play it back, and is used to produce a text transcript. We do not match your voice against other recordings, build a biometric profile of you, or use voice data to identify or authenticate you.
Depending on what you choose to record or write about, your content may reveal sensitive information — health, religious beliefs, relationships, or similar — the same way any personal journal might. That information is treated with the same access controls, encryption, and non-disclosure practices as the rest of your content, described throughout this policy. We do not analyze your content to infer sensitive attributes about you for any purpose beyond the features described in Section 2.
7. How we secure your data
Everything sent between the app and Tome's servers travels encrypted over HTTPS. Stored data — your database records and uploaded files, including your recordings — is encrypted at rest by Google Cloud's infrastructure. Access to production data is limited to what's necessary to operate and support the Service, and every collection is governed by security rules that scope a request strictly to the account that owns it — one account's data is never readable by another's request, enforced at the database layer, not just in application code. Billing and Family plan fields can only be changed by Tome's servers, not by the app.
No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. If we become aware of a security incident affecting your information, we will notify you as described in Section 17.
8. Data retention and deletion
Deleting a memory or a story moves it to Trash, where it remains fully recoverable for 30 days before being permanently removed — or you can empty Trash yourself at any time for an immediate, permanent delete.
Deleting your account is immediate, not delayed: every recording, memory, journal answer, chapter, story, person, tag, and attachment, along with the account itself, is permanently removed as soon as you confirm, and any active subscription is cancelled in the same step. If you own a Family plan, the family is dissolved and its members return to having no plan; if you belong to one, you are removed from it. There is no waiting period and nothing is held back afterward, apart from the billing records described below. You can do this from Settings inside the app, or without installing anything, at tomejournal.com/account.html.
Short of a full account deletion, we retain your content for as long as your account exists, so the Service can keep doing what it's for — being there when you return to a memory months or years later. This applies whether or not you have an active plan: if a trial or subscription ends, you can still view and play back everything you saved. Billing records may be retained longer where required by tax, accounting, or other legal obligations, limited to what those obligations require.
9. International data transfers
Tome's infrastructure and service providers are based in the United States. If you access the Service from outside the United States, your information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your jurisdiction. Where required, we rely on appropriate safeguards — such as standard contractual clauses — for these transfers.
10. Your rights and choices
Regardless of where you live, you can ask to see what Tome holds about you, correct it, export it, or delete it:
- Access and portability — play back and read everything you've saved in the app at any time, and export your book to a Word document. For a copy of anything else we hold, email us.
- Correction — edit any entry, story, tag, or person directly in the app at any time.
- Deletion — delete individual items (via Trash) or your entire account (immediate and total), both described in Section 8.
- Withdrawing consent — turn off crash and diagnostic reporting at any time in Settings.
- Objection or restriction — contact us using the details in Section 20 and we will respond within the timeframe required by applicable law.
For anything not self-service in the app, email hello@tome.app. We do not require a formal legal process for a request about your own account, and a person reads and handles it — not a ticket queue.
11. California privacy rights (CCPA/CPRA)
If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, "CCPA"), gives you specific rights. In the preceding 12 months, we have collected the following categories of personal information, for the purposes described in Section 2: identifiers (email address and name); customer records (plan and billing status); audio, electronic, and visual information (recordings and attachments you create); and internet or network activity (app diagnostics for your own account, if opted in). The sources, purposes, and recipients of each are described in Sections 1, 2, 4, and 5.
- We do not sell or "share" (as that term is defined under the CPRA, including for cross-context behavioral advertising) personal information, and have not done so in the preceding 12 months.
- We do not use or disclose sensitive personal information for any purpose beyond what is necessary to provide the Service you requested.
- You have the right to know what personal information we collect, to request its deletion, to correct inaccurate information, and to non-discrimination for exercising these rights.
- To exercise these rights, use the in-app or web deletion flow in Section 8, or email hello@tome.app. We will verify your request using your account's email address before acting on it.
12. Other U.S. state privacy rights
Residents of Utah, Virginia, Colorado, Connecticut, Oregon, Texas, and other states with comprehensive privacy laws have similar rights to those described in Section 11: access, correction (where your state provides it), deletion, portability, and opt-out of sale, targeted advertising, and certain profiling. As described throughout this policy, Tome does not sell personal information, does not serve targeted advertising, and does not perform profiling that produces legal or similarly significant effects. To exercise any right available under your state's law, use the deletion flow in Section 8 or contact us using Section 20; we will not charge a fee for a first request in a 12-month period and you may appeal a denial by replying to our response.
13. EEA, UK, and Swiss users (GDPR)
If the General Data Protection Regulation or UK GDPR applies to you, you additionally have the right to lodge a complaint with your local data protection supervisory authority. We encourage you to contact us first at hello@tome.app so we can try to resolve your concern directly. Your rights of access, rectification, erasure, restriction, portability, and objection are described in Section 10 and apply in full; we will respond to a verified request within one month, extendable by a further two months for complex requests, as permitted by the GDPR.
14. Children's privacy
Tome is not directed at children and is not intended for anyone under 13 (or the minimum age required by your jurisdiction, if higher). We do not knowingly collect personal information from a child under that age. If we learn that we have, we will delete that account and its data promptly. If you believe a child has provided us with personal information, contact us at hello@tome.app.
15. Cookies and tracking technologies
The Tome mobile app does not use cookies or third-party advertising trackers. Our website (tomejournal.com) uses only the minimum technology necessary for it to function — such as a sign-in token stored in your browser to keep you signed in while managing your account or subscription — and no advertising or cross-site tracking cookies. Because we do not track users across third-party sites over time, "Do Not Track" signals have no additional effect and we do not respond to them differently.
16. Legal and safety disclosures
We may access, preserve, or disclose account or content information if we have a good-faith belief that doing so is reasonably necessary to: comply with a valid legal process (such as a subpoena, court order, or warrant) or applicable law; enforce our Terms of Service; detect, prevent, or address fraud, security, or technical issues; or protect the rights, property, or safety of Tome, our users, or the public, as required or permitted by law. We do not disclose the content of your journal or stories voluntarily, and we will notify you of a request for your data unless legally prohibited from doing so or where we believe notice would create a genuine risk of harm.
17. Data breach notification
If we discover a security incident that compromises your personal information in a way that requires notice under applicable law, we will notify affected users without unreasonable delay, through the email address on your account, and take reasonable steps to contain and remediate the incident.
18. Third-party links
The Service may contain links to third-party websites (such as Stripe's checkout pages). We are not responsible for the privacy practices of those third parties, and we encourage you to review their privacy policies before providing any information to them.
19. Changes to this policy
We may update this policy from time to time. If a change is material, we will provide notice inside the app or by email before it takes effect, and we will update the "Last updated" date at the top of this page. Continued use of the Service after a change takes effect constitutes acceptance of the updated policy.
20. Contact us
Questions, requests, or concerns about this policy or your information: email hello@tome.app. A person reads it, not a ticket queue, and we aim to respond within a few business days.