Tomodomo Privacy Policy
Last updated 4 October 2026This policy explains what data Tomodomo (“the App”) collects, why, and where it goes. It's written in plain language on purpose. Tomodomo is developed by Jens Christian Blix in Norway (“we”, “us”), who is the data controller for the online features described below.
The short version
- By default, everything stays on your iPhone. Your tabs, bills, items, friends, photos, receipts and budgets are stored in the App's local database. If you never go online, nothing you enter is sent to us.
- Going online is optional. If you sign in with Apple, your tabs are copied to our server so you can use them on another iPhone, restore them, and share a tab with the people you split it with.
- Sharing places is optional too, and off until you turn it on. You can show the places you've rated to friends, or share your stars anonymously so everyone can find good places — without them being linked to your account.
- A few features talk to other services — venue logos (Tomodomo Pro, only if you turn it on), exchange rates, Apple Maps searches, push notifications and Apple's in-app purchases. Each is described below.
- No ads, no analytics, no tracking, no selling of data.
On your iPhone
| Data | Where it lives | Leaves your iPhone? |
|---|---|---|
| Tabs, bills, items, splits, settlements, budgets | Local database on your iPhone (SwiftData) | Only if online |
| Friends/members you add | Local database | Only if online |
| Photos you attach (venue, receipt, trip and item photos; translated menu photos you keep) | Local database | Only if online |
| Payment details (yours, and the ones you add for a friend — a Vipps number, PayPal, an account number…) | Local database | Only if onlineYour own go to your friends on Tomodomo — see Payment details below |
| The phone number of a contact you link a friend to | Local database — you pick it in Apple's contact picker, which hands over only that number; the App has no access to your contacts | No |
| Where a bill was added | Local database — only if you turn on Remember where bills are added, or set a place by hand | Only if online |
| Your rating (stars) and note for a bill | Local database | Only if online, or if you share placesYour note never leaves your own devices and account |
| The secret used to make anonymous rating codes | iOS Keychain, synced through your iCloud Keychain | NoOnly the codes made from it are sent, never the secret |
| Menus you scan (the dishes and prices read off a photo) | Local database, on that bill, until you clear it or close the tab | NoThe photo itself is read on your iPhone and is not kept |
| Face ID / Touch ID | Handled entirely by iOS (LocalAuthentication) | NoThe App only gets a yes/no from iOS |
| Your PIN | A one-way hash in the iOS Keychain | No |
| App preferences (currency, theme, accent colour, background, light/dark, etc.) | Local device storage (UserDefaults) | Partly, if onlineTheme, accent, background, light/dark and the location switch go with your online profile |
Scanning and translating a menu or a photo, and Apple Intelligence where your iPhone has it, all run on your iPhone. Nothing about the photo or its text is sent anywhere. (If a translation language has to be downloaded first, iOS does that itself.)
Backups you make are files you save yourself, wherever you choose. We never receive them.
If you delete the App and you're not online, everything is deleted with it.
Online (optional): your tabs on our server
Going online is part of Tomodomo Pro; joining a tab someone shares with you is free. You go online by Sign in with Apple. Nothing is uploaded until you do.
What we receive from Apple when you sign in: an identifier for your Apple ID that is unique to Tomodomo, and an e-mail address — your real one, or a private relay address if you choose “Hide My Email”. We use the e-mail only to identify your account; we don't send you e-mail. We never see your Apple ID password.
What is stored on our server:
- your tabs and bills — names, items, prices, who shares what, payments, settlements, budgets, and a bill's location and place if it has them;
- your stars for a bill, which the members of that tab can see, and your note for it, which only you can read;
- the photos attached to them;
- your profile: which person in your tabs is you, your e-mail as above, the friends you've added (names, colours, the category you gave them, and payment details you added for them) and your look and location preferences, so a new iPhone can be restored;
- for shared tabs: who is a member of which tab, open invites (the invite code itself is stored only in scrambled form), requests to join, and which people you've been in a tab with (so you can add them to another tab without a code);
- the name, colour and name reading your friends see, and your own payment details if you've added any (your “friend card”), so a change you make reaches the friends you're connected with on Tomodomo; if you use friend codes, also your friend code and which people you've become friends with that way (whoever enters your code sees your name and colour before adding you);
- the notifications sent to you (see below);
- your iPhone's push notification token, if you allow notifications;
- if you have Tomodomo Pro, the record of your subscription (see In-app purchases below).
Where: our server runs on Supabase, our hosting provider and data processor, in the EU (Stockholm, Sweden). Data is encrypted in transit (HTTPS) and protected by access rules: only you, and the members of a tab you share, can read a tab and its photos.
Sync: the App uploads what you change and downloads what changed elsewhere — when you open it, when you pull to refresh, and shortly after you edit. While a shared tab is on screen, the App keeps a connection open to our server so changes from the other members show up straight away; it closes when you leave the tab or the App.
Sharing a tab
When you share a tab, everyone in it can see and edit the whole tab — all its bills, items, photos, amounts and the names of the people in it — and sees who last edited a bill. Only invite people you're comfortable sharing that with.
- An invite is a one-time code that you send yourself, through any app you like. The link in it opens tomodomoapp.com, which passes the code to the App. A code works once and expires after seven days.
- A friend who joins becomes themselves in the tab: the name and colour they use on their own iPhone replace the ones you gave them in that tab.
- The owner can remove people or stop sharing; anyone can leave. Those who lose access are told, and the tab is removed from their iPhones. Bills they took part in stay in the owner's tab.
Sharing places and ratings (optional)
The Map can show the places your friends have been and the places other users rate well. Each kind of sharing has its own switch in Settings ▸ Place sharing, off until you turn it on, and can be turned off again at any time. Only places that come from Apple Maps (with an Apple Maps place ID) are ever shared; a bill with only a location is not.
With friends. If you turn on Share my places with friends (this needs your online account), our server stores, linked to your account: each place's Apple Maps ID and position, your average stars there, the year you were last there, and whether it's a favourite. Only the friends you're connected with on Tomodomo — through a shared tab or a friend code — can read it. Your notes and amounts are never included. Turning it off deletes those rows; deleting your online account deletes them all.
With everyone, anonymously. If you turn on Share my ratings anonymously, the App sends, for each place: its Apple Maps ID, the place's own position, your average stars there, and a code made on your iPhone from a random secret and the place ID. The code is different for every place, so two of your ratings can't be grouped together, and nothing from your account, your name, notes, dates, amounts or your own location is sent. No sign-in is needed. Others only ever see a place's rounded average and a rough count, and only once at least three different people have rated it.
- Not linked to your account. We don't store anything that connects these ratings to you. Because of that, deleting your online account can't remove them — use Delete my shared ratings in Settings ▸ Place sharing first. Turning the switch off, deleting a bill's rating, and Delete profile and all app data also withdraw them.
- Protection against fake ratings. Uploads are signed with Apple's App Attest, which proves they come from a genuine copy of the App on a real device without saying who you are. Our server keeps that device key's public half and a count of uploads in the current hour (to limit how many can be sent), with no account and never together with a rating.
- Browsing. When you look at the Everyone layer, the App asks our server for rated places in the area on screen. That request carries no account or identifier.
- IP addresses. Like any internet request, these reach our server with your IP address. We don't store it, but our hosting provider's logs keep it for a short time.
Adding friends with a code
Your friend code (with its link and QR code) lets someone add you as a friend on Tomodomo without sharing a tab first. It's free and optional — it's only made when you open My friend code. Anyone who has your code can add you: they see your name and colour, and you both become friends (the same as having been in a tab together) — from then on they also get your payment details, if you've added any (see below). The code works until you make a new one, which stops the old one working; friends you already have stay. The link opens tomodomoapp.com, which passes the code to the App.
Removing a friend
Remove in Friends ends a friendship on Tomodomo for both of you: our server deletes the connection between your accounts, so you no longer get each other's name and colour updates, payment details or shared places, and you can't add each other to a tab without an invite. The other person isn't told. Each iPhone drops the other's payment details the next time it syncs. Tabs you're both in aren't touched — you stay in them together, and what's in them stays. On your own iPhone, someone you've split bills with is kept in those bills and only hidden from your friends; someone with no history is deleted. A friend code or joining a tab together makes you friends again.
Payment details
You can add how people can pay you — a Vipps number, a PayPal address, a bank account number — in Settings ▸ My profile. If you're online, they're part of your friend card: the friends you're connected with on Tomodomo get them, and see them when they owe you money (when settling up and in your payment requests), never in their friends list. The App tells you this before you save your first one. Change or delete them at any time; a detail you delete is removed from your friends' iPhones the next time they sync — and if you stop being friends on Tomodomo, all of them are removed from that person's iPhone and online profile the next time they sync. Strangers who only have your friend code never see them.
Payment details you add for a friend are yours alone: they stay on your iPhone and in your own online profile, and are never sent to anyone else. Once that friend is on Tomodomo and connected with you, the details they added themselves are shown instead.
Notifications
Joining, asking to join, being added as a friend, payment requests and “marked as paid” create a notification for the person concerned. It contains names, the tab's name and, for payments, the amount, as the sender wrote them. It's stored on our server so the App can show it, and — if that person allowed notifications — sent to their iPhone through Apple Push Notification service. The text is put together on the receiving iPhone. You can turn notifications off at any time in iOS Settings.
Other things that leave your iPhone
Venue logos (Brandfetch) — Tomodomo Pro, and off unless you turn them on
With Pro and Look up venue logos on (offered when you first open the App or sign in on a new iPhone, and in Settings ▸ Bills and payments), the App sends a bill's venue name — nothing else, no amounts, no people — to Brandfetch to find a matching logo, and loads that logo from Brandfetch. Each iPhone asks you separately; the choice is never synced. Turning it off, or Pro ending, deletes the logos already downloaded. See Brandfetch's privacy policy.
Exchange rates (Norges Bank)
To convert between currencies, the App fetches published daily exchange rates from Norges Bank (Norway's central bank). Nothing about you or your bills is sent.
Apple Maps
When you search for a place, or open a place's details, the search text, your approximate location (for “Nearby”) and the place's identifier are sent to Apple to answer it. When Remember where bills are added is on, the App asks iOS for your location once when you add a bill; iOS asks your permission first. See Apple's Privacy Policy.
App Attest (Apple) — only if you share ratings anonymously
To prove that anonymous ratings come from a genuine copy of the App, iOS creates a key on your iPhone and Apple confirms it. Apple doesn't learn which places you rate.
In-app purchases (Apple)
Tomodomo Pro is sold by Apple through StoreKit. We never see your payment details or billing address; Apple only tells the App whether you're entitled to Pro. If you use online tabs, our server also keeps a record of your Pro subscription — Apple's transaction ID, which plan, and when it renews or ends, signed by Apple — linked to your online account, so it can check that your own tabs may sync. Apple sends the server updates when the subscription renews, ends or is refunded. The record is deleted with your online account.
None of the logo, exchange-rate or map requests include an identifier tied to you personally (no account ID, no advertising identifier).
How long we keep it, and deleting it
- Your online data stays on our server while you have an online account.
- When you delete a tab or a bill, its content and photos are removed from our server. Only a marker that it was deleted stays, so your other iPhones remove it too.
- Notifications are deleted after 90 days, answered requests to join after 90 days, and invites 30 days after they were used or expired.
- Anonymous ratings stay until you withdraw them (see Sharing places). An App Attest key is kept while the App uses it; its upload count only ever covers the current hour.
- Delete online account (Settings ▸ Online) deletes your account and everything on our server that belongs to it — your tabs, bills, photos, ratings and notes, places shared with friends, profile, notifications and push tokens — and revokes Tomodomo's access to your Apple ID. Tabs that others shared with you stay with their owners. What's on your iPhone is left alone.
- Sign out on this iPhone only stops this iPhone from syncing; your online copy stays.
- Delete profile and all app data (Settings ▸ My profile) erases this iPhone; to remove the online copy too, delete your online account first.
What Tomodomo does not do
- No analytics or crash-reporting SDK.
- No advertising, and no advertising identifiers.
- No tracking across other apps or websites.
- No selling or renting of your data, and no sharing except as described above (our hosting provider, the people you share a tab or your places with, your friends on Tomodomo for your payment details, and — anonymously — your stars for a place).
Your rights
Under GDPR you have the right to access, correct, delete and take a copy of your personal data, and to object to or restrict how it's used. Most of this you can do yourself in the App: view and edit anything, make a backup, or delete your online account. For anything else, contact apps@jcblix.no. You can also complain to the Norwegian Data Protection Authority (Datatilsynet) or the authority where you live.
We process your online data to provide the features you ask for (performance of our agreement with you). Venue logo lookups, recording where bills are added, and sharing places with friends or anonymously happen only with your consent, which you can withdraw by turning them off.
Children's privacy
Tomodomo is not directed at children under 13 (or the relevant minimum age in your country) and does not knowingly collect personal data from children.
Changes to this policy
If what Tomodomo collects or sends changes, this page will be updated and the “Last updated” date above will change.
Contact
Questions about this policy: apps@jcblix.no.