Privacy Policy

Introduction

Assembly Labs, LLC ("we," "us," or "our") operates the TOMO mobile application. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use TOMO.

We believe in transparency. This policy is written in plain language so you can understand exactly what happens with your data.

What Data We Collect

Information You Provide

• Account Information: Name, email address, and password (or credentials via Apple Sign-In)
• Profile Information: Belt level, stripe count, gym name, date of birth, gender, and body weight (optional)
• Training Data: Session logs, techniques practiced, sparring notes, goals, and any other journal content you create
• Voice Recordings: Audio captured when you use the voice logging feature to record training sessions
• Location (Optional): Coarse location, collected only if you grant permission, used solely to find nearby gyms during onboarding — never stored to your profile or shared

Information Collected Automatically

• Device Information: Device model, operating system version, app version, and unique device identifiers
• Crash Data: Error logs and diagnostic information to help us fix bugs (via Sentry)
• Diagnostic Activity: When something goes wrong, TOMO records the screens you visited and the buttons you tapped in the moments before it, along with your email address, so we can find your specific report when you write in for help. This is attached to error reports only.
• Feedback You Send: If you shake your phone and choose to send feedback, TOMO sends your message, your account email and name, your belt, and a screenshot of the screen you were on so we can see what you saw. Nothing is sent unless you tap Send.
• Purchase and Subscription Status: If a TOMO Pro subscription is offered in your version of the app and you subscribe, Apple processes the payment. We receive your subscription status and an anonymous customer identifier through RevenueCat, never your card details.
• Error Replays: When an error occurs, TOMO saves a short visual recording of the seconds leading up to it. Every piece of text, every image and every graphic in that recording is blurred out before it leaves your device, so your notes, transcripts and photos are not readable in it. Nothing is recorded during normal use, only when an error fires.
• Usage Data: Which screens you open, when you finish signing up, and when you save a session. This tells us where the app is confusing so we can fix it. It never includes what you wrote: your notes, transcripts, body weight, date of birth, gender and injuries are blocked from ever being sent, and the block is enforced in code rather than left to care.

How We Use Your Data

• Provide the Service: Store your training journal and maintain your technique library
• Personalize Your Experience: Deliver belt-specific insights, video recommendations, and training summaries tailored to your level
• Process Voice Recordings: Transcribe your audio into structured session data
• Generate Insights: Analyze your training patterns to surface trends, streaks, and progress metrics
• Improve the App: Understand how features are used so we can make TOMO better
• Communicate with You: Send service-related notifications and respond to support requests

Voice Data

When you use the voice logging feature:

1. Your audio is recorded on your device
2. The recording is sent to AssemblyAI, our transcription partner, for processing
3. The transcript is returned and stored as structured text in your training journal
4. The original audio file is stored privately in your account and accessible only to you

AI Processing

TOMO uses Anthropic's Claude to read your training entries and write your coaching insights. Two things are worth being specific about, because they are easy to assume otherwise:

1. What is sent is not anonymous. To make coaching personal rather than generic, TOMO sends a training profile alongside your session content. That profile includes your first name, belt and stripes, age, gender, body weight if you provided it, your gym, your training patterns, and any coach or instructor names that appear in entries you wrote.
2. It includes injury information. If you mention injuries in your sessions, TOMO tracks which body parts recur and over what period, and sends that history so your coaching can account for it. This is training context, not medical record-keeping, and TOMO does not provide medical advice.

Data Sharing

We share data only in these circumstances:

• Service Providers: With the third-party services below, strictly as needed to operate the app
• Legal Requirements: If required by law, regulation, or governmental request
• Safety: To protect the rights, safety, or property of our users or the public
• Business Transfers: In the event of a merger or acquisition, your data may transfer (we would notify you beforehand)

Third-Party Services

TOMO uses the following services to operate:

Data Storage and Security

• Your data is stored in a Supabase-hosted PostgreSQL database located in the United States
• Data is encrypted in transit (TLS/SSL) and at rest
• Authentication uses industry-standard protocols, including Apple Sign-In
• Access to user data within our organization is strictly limited

While we take reasonable measures to protect your data, no system is 100% secure. We cannot guarantee absolute security.

If Your Data Is Ever Compromised

If we become aware of a data breach in which your personal information collected through TOMO has been accessed, disclosed, or used without authorization, we will notify you, in accordance with applicable law, by email at the address on your account and through a notice in the app.

• What we will tell you: what happened, what categories of your data were involved (including whether any voice recordings or transcripts were affected), when we became aware of it, what we have done in response, and what you can do to protect yourself.
• When: without undue delay after we confirm a breach, and within any deadline that applicable law sets.
• Even if we are not sure: if we cannot yet determine the full scope, we will tell you what we know rather than wait until the picture is complete.

Your voice recordings and their transcripts are the most sensitive data TOMO holds. They are treated as in scope for this commitment in every case.

Your Rights

• Access Your Data: View all training data, profile information, and account details in the app
• Correct Your Data: Update your profile and training information at any time from within the app
• Delete Your Data: Delete individual sessions at any time. To delete your entire account and all associated data, go to Profile → Delete Account in the app. All data is removed immediately.

Data Retention

• Active Accounts: Your data is retained for as long as your account is active
• Deleted Accounts: When you delete your account from the app, all personal data is removed immediately. Anonymized, aggregated data that cannot identify you may be retained for analytics.
• Voice Audio: Original audio recordings are stored privately in your account. They are deleted when you delete your account.
• In one sentence: Deleting your account deletes everything TOMO holds for you, including your voice recordings and their transcripts, and there is no undo.

Children's Privacy

TOMO is intended for adults. The app is not directed to anyone under the age of 18, and we do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has provided us with personal information, contact us at the email below and we will delete it promptly.

Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices, technology, or legal requirements. When we make significant changes, we will notify you through the app or via email. Your continued use of TOMO after changes are posted constitutes acceptance of the updated policy.

Contact Us

Questions, concerns, or data requests related to this Privacy Policy: