Privacy Policy

Last updated: September 16, 2026

This Privacy Policy explains how Tomogether collects, uses, and protects personal data when you use our website, mobile interface, Telegram bot, and related services (the "Service"). It is written to comply with the EU General Data Protection Regulation (GDPR), the UK GDPR, and the data-protection laws of the Republic of Armenia.

1. Data controller

The controller for the personal data described in this policy is Sole Proprietor Baluev Dmitrii (in Armenian official records: Private Entrepreneur «ԱՁ»), an individual entrepreneur registered in the Republic of Armenia (HVHH / tax ID 20286781, public registry number 286.1580941). Registered office: 27 N. Tigranyan Street, Yerevan, Armenia.

For privacy questions, contact [email protected].

2. What data we collect

2.1 Information you provide

  • Account email address and chosen language.
  • Authentication identifiers from third-party providers when you log in with them (Google account ID, Telegram user ID).
  • Messages, prompts, and other content you submit when interacting with Companions.
  • Optional profile data (display name, preferences) that you choose to provide.

2.2 Information generated by your use of the Service

  • Conversation history with Companions, including AI-generated responses and references to gifts, items, and in-app actions.
  • Subscription tier, in-app purchases, virtual-currency balances, and transaction logs.
  • Telemetry such as IP address, timestamps, page views, errors, and approximate location derived from IP.
  • Device and browser metadata (user-agent, viewport, language).

2.3 Information from third parties

  • Authentication and basic profile information from Google and Telegram when you choose to sign in with them.
  • Aggregated payment status from our payment processor (we do not receive your full card details).

3. How we use your data

We use personal data to:

  • Provide and operate the Service, including generating Companion responses.
  • Authenticate you and protect your account.
  • Process subscriptions and in-app purchases.
  • Maintain conversation memory so Companions can refer back to past interactions.
  • Improve reliability and performance through diagnostics, error logs, and traces.
  • Detect abuse, fraud, and violations of our Terms of Service.
  • Communicate with you about your account, security, and material changes to the Service.
  • Send occasional product updates, announcements, and tips related to features you may find useful. These messages are sent only if you have opted in, and every email contains a one-click unsubscribe link. We do not use your data for third-party advertising.
  • Comply with legal obligations.

4. Legal bases for processing (GDPR)

  • Performance of a contract — to deliver the Service you have asked us to provide.
  • Legitimate interests — to keep the Service secure, prevent abuse, and improve reliability.
  • Consent — for optional features such as marketing emails (where applicable). You can withdraw consent at any time.
  • Legal obligation — to satisfy accounting, tax, and compliance requirements under Armenian and EU law.

5. Sharing with third parties

We do not sell your personal data. We share it with carefully selected service providers (sub-processors) only to the extent necessary to run the Service:

  • AI model providers — your messages and a minimal amount of context are sent to large-language-model providers to generate Companion responses. These providers process the data on our behalf and may not use it to train their general-purpose models when configured for our use.
  • Image and voice generation services — your prompts and chosen settings are sent to image-generation and text-to-speech services when you receive media from Companions.
  • Messaging transport (Telegram, etc.) — messages are delivered through the messenger you have chosen; their privacy practices also apply.
  • Authentication providers (Google, Telegram) — only when you choose to sign in with them.
  • Payment processors — to process subscriptions and one-time purchases.
  • Hosting and infrastructure providers — to operate servers, databases, and content delivery.
  • Product analytics (PostHog) — pseudonymised usage events are sent to PostHog (hosted in the European Union) only if you consent to analytics cookies, to understand aggregate product usage. Session recording and automatic event capture are disabled.

We may also disclose data when required by law, to enforce our Terms, or to protect the safety of users or the public.

6. International transfers

Some of our service providers are located outside the European Economic Area and Armenia. Where we transfer personal data outside the EEA or Armenia we rely on appropriate safeguards such as Standard Contractual Clauses approved by the European Commission, adequacy decisions, or equivalent mechanisms recognised under Armenian law. Our product-analytics provider (PostHog) hosts personal data on servers in the European Union under a Data Processing Agreement with us; that data is not transferred outside the EEA.

7. Retention

  • Account data is retained while your account is active.
  • Conversation history is retained while your account is active to maintain Companion memory; you can request deletion at any time.
  • Transaction logs are retained for as long as required by accounting and tax law (typically up to 7 years).
  • Diagnostic logs are retained for up to 90 days unless required longer for security investigations.
  • When your account is deleted (on your request to [email protected]), we will erase or anonymise your personal data within a reasonable period, except where retention is required by law.

8. Your rights

Subject to applicable law, you have the right to access, correct, delete, or export your personal data; to object to or restrict certain processing; and to withdraw consent where processing is based on it. To exercise these rights write to [email protected]. We will respond within the time limits required by applicable law (typically one month under the GDPR). You also have the right to lodge a complaint with your local data-protection authority.

9. Security

We use industry-standard technical and organisational measures to protect personal data: encryption in transit, encryption of sensitive memory fields at rest, access controls, distributed locks for concurrent operations, and audit logging. No method of transmission or storage is completely secure; we cannot guarantee absolute security but will notify affected users of personal-data breaches as required by law.

10. Children

The Service is not directed to children under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

11. Cookies and similar technologies

We use cookies and similar technologies in two categories:

  • Essential cookies — required for authentication, session security, CSRF protection, language preference, and basic functionality. They are always active because the Service cannot operate without them.
  • Analytics cookies — optional, set only if you consent. With your consent we use PostHog (hosted in the European Union) to understand aggregate product usage; if you reject, PostHog is fully disabled and sends nothing. We also use our own cookieless analytics, running on our own servers, which counts visits in aggregate without cookies or personal data — it is not tracking and does not depend on your consent.

On your first visit you will see a consent banner where you can accept analytics cookies or reject non-essential ones; your choice is stored locally, applies across our website and app, and can be changed at any time by clearing site data in your browser. We do not use cookies for advertising or for sharing your data with third-party marketing networks. For details see our Cookie Policy.

12. Changes to this policy

We may update this policy from time to time. Material changes will be announced at least 30 days in advance through the Service or by email before they take effect.

13. Third-party data and attributions

The list of countries and cities offered in your profile comes from GeoNames, licensed under Creative Commons Attribution 4.0. The list is shipped with our application as static data: choosing your city does not send any request to GeoNames and does not disclose anything about you to them.

14. Contact

Privacy questions or requests: [email protected].