Controller: SIA "MIGLAI" (limited liability company registered in the Republic of Latvia), registration no. 40203733943, VAT no. LV40203733943, legal address "Reķu sala 4", Upesciems, Garkalnes pag., Ropažu nov., LV-2137, Latvia. Contact: support@secuora.xyz.
1. What Tumlo is
Tumlo is a general wellbeing and self-tracking journal. It is not intended for the diagnosis, prevention, monitoring, prediction, prognosis, treatment or alleviation of any disease, and is not a medical device.
2. Data you enter and where it lives
Tumlo stores the following only on your iPhone, in the app's private storage, excluded from iCloud backup: face and torso photographs you choose to take; landmark-derived comparison values from those photos; your questionnaire answers; daily check-ins (comfort, water, sleep, stress); food entries and ingredient tags; notes; habit ticks; menstrual-cycle dates if you enter them; your consent decisions with timestamps. Photographs are processed with Apple's Vision framework for comparison only; no identity template is created and no attempt is made to identify anyone. Section 3 explains how face data is handled in detail.
There is no account, no login and no server operated by us that receives this data. We never see it.
3. Face data
This section explains how Tumlo handles face data, meaning information about your face that the app works with when you take a photo. It applies only if you switch on the "Camera and photo comparison" consent. With that consent off, Tumlo does not open the camera for photos and collects no face data.
What Tumlo collects. (a) The daily photos of your face that you choose to take with the front camera, saved as image files. (b) While the camera is open, Apple's Vision framework finds facial landmarks (the outline of the face, eyes, eyebrows, nose and lips) in the live preview, entirely on your iPhone, so the app can show the framing guide and check that your face is centred and straight. These live frames and landmark points stay in memory for a moment and are never saved. (c) For each saved photo, five comparison values calculated on your iPhone from the landmarks and the image: the width of the lower face relative to the upper face, the brightness variation just below the eyes, the face's width-to-height ratio, the sharpness of the jawline and the overall brightness of the scene. The average of your first three photos is kept as your personal baseline. Optional torso photos are stored and deleted in the same way. Tumlo does not use Face ID, the TrueDepth camera or ARKit, does not create a face template or any identifier from your face, and never tries to recognise or identify anyone.
How face data is used. Only to show you your own photos over time and to compare each new photo with your own baseline photo, which is one part of the in-app Comfort Score. Face data is not used for identification or authentication, advertising, marketing, analytics, profiling, data mining or training any model.
Where face data is stored. Only on your iPhone, in Tumlo's private app storage. Photos are saved as files protected by iOS Data Protection, so they cannot be read while your iPhone is locked, and the comparison values are kept in the app's on-device database. Both are excluded from iCloud and device backups, and the app has no cloud sync. We run no server that receives face data, and we never see it.
Sharing. Tumlo does not share, sell or transfer face data to anyone: not to us, not to RevenueCat, not to Open Food Facts, and not to any advertising, analytics or data broker service. A photo leaves your iPhone only if you send it yourself, by tapping Share on a timeline card or "Export all my data" and choosing a destination in the iOS share sheet.
Retention and deletion. Live camera frames and landmark points are discarded as soon as each frame has been processed. Saved photos and their comparison values stay on your iPhone until you delete them: "Delete all my data" in Settings permanently removes every photo and every comparison value, and deleting the app removes them too. Switching off the "Camera and photo comparison" consent stops new photos from being taken; photos you already took stay until you delete them. Because we never receive face data, we hold none ourselves.
4. Legal basis and consent
Some of this data is health data under Article 9 GDPR. Tumlo asks for your explicit, separate consent for each purpose (daily log and questionnaire answers; camera and photo comparison; cycle dates) before storing it, and you can withdraw each consent in Settings at any time. Withdrawal stops new storage of that kind; existing entries stay until you delete them.
5. What leaves your phone
- Purchases. Subscriptions are sold through Apple's App Store. Apple is the merchant of record. Our subscription provider, RevenueCat, Inc., receives an anonymous app-generated identifier and purchase receipts to activate your subscription. No journal data is sent.
- Barcode and product search (optional). If you switch on online lookup, the barcode number or the search text you type is sent to Open Food Facts (Open Food Facts association, France), a non-profit open database, to fetch product names and ingredient lists. Nothing else is sent, and this is off until you allow it.
Tumlo contains no analytics, advertising or attribution SDKs.
6. Retention
Data stays on your device until you delete it. "Delete all my data" in Settings removes every entry, photo and your profile. Deleting the app removes everything.
7. Your rights
Because the data is on your device, you exercise most rights directly: access and portability via "Export all my data"; erasure via "Delete all my data"; withdrawal of consent via the consent switches. You may also contact us at the address above. You have the right to lodge a complaint with the Latvian Data State Inspectorate (Datu valsts inspekcija, dvi.gov.lv) or your local supervisory authority.
8. Children
Tumlo is intended for people aged 16 and over.
9. Changes
We will post changes here and update the date above. Material changes are announced in the app.