Privacy Policy
Tummidoo — version 1.0, effective 10 October 2026
Who we are
Jan Páv, sole trader, Kovanecká 2110/14, Libeň, 190 00 Praha 9, Czech Republic, ID No. (IČO) 01990764, registered in the Czech trade register. Email support@tummidoo.app, web https://tummidoo.app. We are the controller of your personal data under the GDPR. No data protection officer is appointed.
What we store
- Account. With Sign in with Apple: the user identifier Apple assigns to you and, if you choose to share it, your email address or the private relay address Apple creates for you. With email sign-in: the email address you enter. In both cases the time your account was created.
- Health diary (data concerning health, GDPR Art. 9). Stool entries: date and time, Bristol type, bleeding grade, urgency, colour, trigger tags, note. Symptom entries: type, intensity, trigger tags, note. A daily row derived automatically from your stool entries (stool-count band and highest bleeding grade of the day), which the app stores but never shows as a score.
- Technical logs. IP address, time stamps and request metadata created when the app or the AI connector talks to our servers.
- On your device only. An offline copy of your diary, your reminder time, and today’s counts for the widget and the Apple Watch complication.
We do not collect analytics, advertising identifiers, location, contacts or HealthKit data. We never sell data.
Why and on what basis
| Purpose | Data | Legal basis |
|---|---|---|
| Keeping your diary — saving, showing, editing, syncing to your Watch, exporting | health diary | your explicit consent, given on a separate screen before your first entry (Art. 9(2)(a) and 6(1)(a)) |
| Running your account — sign-in, reminders, support | account data | performance of our contract with you (Art. 6(1)(b)) |
| Security and abuse prevention | technical logs | our legitimate interest in keeping the service safe (Art. 6(1)(f)) |
| Letting an AI assistant you choose read your diary | health diary, account email | your explicit consent and instruction on the authorisation page (Art. 9(2)(a), 6(1)(a)) |
No advertising, no profiling, no automated decisions, no use of your data to train AI models.
Where it is stored and who processes it
Your diary is stored in the European Union.
- Supabase Pte. Ltd. (Singapore) — database and sign-in service, hosted on AWS in Frankfurt, Germany (eu-central-1). Processor bound by a data processing addendum with EU standard contractual clauses for any access from outside the EU.
- DigitalOcean LLC (USA) — the server behind the optional AI connector, Frankfurt (FRA1). It relays each request with your own access token and stores none of your diary. Processor bound by a data processing addendum; certified under the EU–US Data Privacy Framework, with standard contractual clauses as fallback.
- Apple — App Store, TestFlight, Sign in with Apple and notifications. Apple is an independent controller under its own privacy policy. The app does not store your diary in iCloud, CloudKit or HealthKit.
Our processors must protect your data to the same standard as we do and may use it only on our instructions.
When you connect an AI assistant
“Connect your data” does nothing until you turn it on. Tummidoo offers a standard connector (MCP) that any AI assistant supporting remote connectors can use — for example Claude (Anthropic) or ChatGPT (OpenAI). If you add Tummidoo as a connector in such an assistant and approve access on our authorisation page, that assistant can read your diary — entries, daily rows and totals — whenever you ask it a question. Access is read-only. From that moment the company running the assistant you chose (Anthropic Ireland, Limited or OpenAI Ireland Ltd for users in the EEA, or another provider you pick) is an independent controller and handles that data under its own privacy policy, which we do not control. On personal plans your conversations may be used for model training unless you switch that off in the assistant’s settings. The authorisation page names the assistant before you allow access. Revoke access at any time in the assistant’s connector settings (Claude: Customize → Connectors → Tummidoo → Remove; ChatGPT: Settings → Apps & Connectors) or in the app under Settings → Connected AI tools; deleting your Tummidoo account also ends it. We keep a record of which assistant was connected and when access was granted and revoked.
How long we keep it
- Diary and account: until you delete your account. Settings → Delete account removes all your records immediately and permanently — we keep no database backups, so export your diary first if you want a copy.
- Connector access: until you revoke it or delete your account.
- Technical logs: our database provider keeps request logs for 1 day; the AI connector server keeps its logs (your account ID, the tool called and whether it succeeded — no IP address) for up to 7 days.
- Record of your consent (time and version): for as long as your account exists, to prove consent was given (Art. 7(1)).
Your rights
Under GDPR Art. 15–22 you may access, correct, delete, restrict and port your data and object to processing based on our legitimate interest. In the app you can edit or delete any entry, export everything as JSON (Settings → Export data) and delete your account (Settings → Delete account). Withdrawing consent means deleting your account; it does not affect processing before withdrawal. For anything else write to support@tummidoo.app — we reply within one month. You may complain to the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7, uoou.gov.cz) or to the authority in your country.
Children
Tummidoo is for people aged 16 and over. We do not knowingly process data of anyone younger; if we learn that we do, we delete the account.
Security
TLS encryption in transit, encryption at rest, row-level security so each account can read only its own rows, access tokens limited to reading, and production database access restricted to the operator. Any personal data breach is reported to the supervisory authority and, where required, to you as GDPR Art. 33–34 require.
Changes
Material changes are announced in the app and at https://tummidoo.app/privacy at least 14 days before they take effect. The current version is always at that address.
Contact
Jan Páv, Kovanecká 2110/14, 190 00 Praha 9, Czech Republic — support@tummidoo.app — +420 776 899 419