Tomelet
English onlyEnglish

Privacy Policy

Effective date: 10 October 2026 · Applies to the Tomelet apps, Tomelet Sync and tomelet.app

The short version

1. Who we are

Tomelet is operated by TOMELET PTE. LTD., 60 Paya Lebar Road, #06-53, Paya Lebar Square, Singapore 409051 ("Tomelet", "we"). For privacy questions, write to [email protected].

2. Data that stays on your device

The app keeps a local database of the books you import (the files themselves, their metadata and covers), your reading positions, highlights, notes, bookmarks, stylus ink, collections, tags and settings. None of this is sent to us unless you enable Tomelet Sync. Uninstalling the app removes it; you can also export it at any time from Settings → Backup.

3. Optional account and sign-in

Tomelet Sync requires an account. You create one by signing in with your email address, Google, Apple or Facebook (LinkedIn and WeChat may be added later). We receive from the provider a stable identifier for your account and — if you allow it — your email address and display name. We never see your password for that provider. We store: the identifier, email address (if shared), display name (if shared), the date you joined, your subscription state, your storage usage, and the public keys of your devices.

Signing in with Facebook. Tomelet asks Facebook only for your public profile and your email address. On Android, iPhone and iPad the sign-in runs through Facebook's software kit inside the app; on Windows, Linux and Mac it opens Facebook's login page in a Tomelet window. From Facebook we keep your Facebook account identifier, your name and, if Facebook shares it, your email address, and our server checks each sign-in directly with Facebook. Facebook learns that you signed in to Tomelet. On Android, iPhone and iPad, Facebook's kit keeps its sign-in token on your device until you sign out of Tomelet; the Windows, Linux and Mac apps clear the Facebook session as soon as the sign-in finishes. See Meta's Privacy Policy for its processing.

Facebook's kit contacts Facebook when the app starts. In the Android, iPhone and iPad apps, Facebook's kit fetches Tomelet's sign-in settings from Facebook each time the app starts — for everyone, whether or not you sign in with Facebook. Like any internet request, this shows Facebook your device's IP address; it does not include your books or your Tomelet account. Tomelet has turned off the kit's automatic event logging and its collection of advertising identifiers, uses Facebook's Limited Login on iPhone and iPad, and never asks for permission to track you. Tomelet does not use Facebook for advertising or analytics. The Windows, Linux and Mac apps contact Facebook only when you choose to sign in with it.

4. Tomelet Sync: what the server can and cannot see

Tomelet Sync is designed on the zero-knowledge model used by password managers. Before anything leaves your device it is encrypted with keys generated and kept on your device (and, optionally, your Recovery Key). Our servers and our staff cannot read your book files, titles, authors, annotations, notes, ink or reading positions.

The server does see: encrypted records and files (ciphertext), their sizes and timestamps, your device identifiers and device public keys, a push token for each device that registers one (section 7), and which account they belong to. We use this only to store, deliver and meter your data, and to wake your devices to sync.

If you lose access to all of your devices and your Recovery Key, your synced data cannot be recovered by us or anyone else. This is a deliberate property of the design.

5. Purchases

Tomelet Sync is sold through Google Play, the Apple App Store and, on desktop, a web checkout run by our reseller Paddle.com, which is the merchant of record for those orders. Payments are handled by those stores or by Paddle; we never receive your card number. We receive confirmation of the purchase, its product, dates and state (active, expired, refunded) through RevenueCat, which we use to manage subscriptions across platforms. See the privacy policies of RevenueCat and Paddle for their processing.

6. Advertising in the free app

On Android, iPhone and iPad, the free app shows an interstitial advertisement before a book opens, served by Google AdMob. The Windows, Mac and Linux apps show no advertising and run no advertising software. Ads are non-personalised by default; where the law requires consent (for example the EEA, UK and Switzerland, or under US state privacy laws), you are asked first and can change your choice in Settings → Privacy. Ad content is restricted to a general-audience rating. AdMob may collect device information such as an advertising identifier, approximate location derived from IP address, and ad-interaction data according to Google's advertising policies. No ads are shown inside the reader, on your first day of use, to profiles marked as children, or to Tomelet Sync subscribers.

7. Waking your devices to sync

If you use Tomelet Sync on Android, iPhone, iPad or Mac, the app registers a push token with our server so that your device can be woken in the background to sync when one of your other devices makes a change. On Android the token comes from Google Firebase Cloud Messaging; on Apple devices it comes from Apple Push Notification service. To wake a device we send its token to Google or Apple with a message that says only that something changed, and they deliver it. The message carries no book, title, highlight, note, ink, reading position or other content, and no notification is shown. We delete the token when you sign out or remove the device, and with the rest of your account data when you delete your account (section 12). See Google's and Apple's privacy policies for their processing.

8. Book details, catalogues and the public domain library

Book details. When you import a book, Tomelet can fill in a missing cover, series and subjects by sending the book’s ISBN, or its title and first author, to Open Library, run by the Internet Archive, and downloading the cover from it. This tells Open Library which titles you are looking up; it does not include your account or anything you have written. The feature is on by default; you can turn it off at any time in Settings → Privacy → Look up book details online.

The public domain library. When you open Import books → Browse public domain, Tomelet sends your search words and your book downloads to Project Gutenberg or the Internet Archive, whichever you choose, identifying itself as Tomelet. Nothing is sent to them unless you use the library.

Catalogues you add. If you add a book catalogue by typing in its address, Tomelet contacts that address when you browse it, and sends it the sign-in details you entered for it, if any. That catalogue’s own privacy policy applies.

Search in browser. If a look-up in the reader finds nothing, you can choose Search in browser to search the web for the selected words. On Android, iPhone and iPad this goes through your device’s own search app where one is available; otherwise, and always on Windows, Mac and Linux, it opens a Google search in your browser. The app tells you where the words will go before the first search, and you can turn the action off in Settings → Privacy → Offer web search from a highlight.

9. Crash reports

When the app crashes, stops responding or runs into an error it cannot recover from, it sends a crash report to Sentry, an error-monitoring service run by Functional Software, Inc., so we can find and fix the problem. It also sends one when sync keeps failing in the same way; that report names only the part of sync that failed, the error code, how many times in a row it happened and, when one waiting change holds the others, what kind of change it is (such as a highlight, a note or a setting) and why it waits — never the change itself. To count how often the app crashes, the app also tells Sentry when a session starts and ends.

A crash report contains the kind of error and where in Tomelet's code it happened, including the list of code libraries the app had loaded; the app version and build; the platform and operating-system version; the device model, maker and processor type; the language; a short list of recent app events, such as the app moving to the background and earlier errors in the same session; and a random identifier created for this installation. That identifier is not your account: it is replaced when you turn crash reports off and on again, and when you delete your account. On Android, a report can also include the device's battery level and charging state, screen orientation, whether it is online or low on memory, and its processor count and speed.

Before a report leaves your device, the app removes file paths and file names, fields that hold book titles, email and IP addresses, sign-in tokens, encrypted data and Recovery Keys, and cuts every web address down to its path (keeping the server name only for our own servers). When a crash happens in the operating system's part of the app, the report comes from Sentry's own code for that system instead, and Sentry removes device identifiers, email and IP addresses, and details such as storage, memory and time zone before storing it. Such a report shows the folder the app runs from: if you have moved Tomelet on a Mac into a folder inside your home folder, that path includes your Mac user name. Reports do not contain your books, notes, highlights, ink or reading positions, or your account details.

Sentry receives your IP address when a report arrives. We have set it not to store the address or the location it could derive from it. Crash reports are kept for 30 days.

Crash reports are on by default. You can turn them off at any time in Settings → Privacy → Send crash reports; turning them off also deletes any report still waiting to be sent from your device.

10. Security logs

For accounts, we keep a security log of sign-ins, device approvals and token refreshes, including the IP address and device identifier, for 12 months. You can view it in Settings → Security. It exists to detect account abuse.

11. The website

tomelet.app is hosted on Cloudflare. It loads no third-party fonts, scripts or trackers and sets no cookies. We use Cloudflare's cookieless, aggregate web analytics (page views by country and browser; no identifiers). If you email us, we keep the correspondence for as long as needed to help you.

12. Retention and deletion

Account data and encrypted sync data are kept while your account exists. Crash reports are deleted after 30 days (section 9). When you delete your account (in the app, or by following the deletion instructions) we delete your profile, linked sign-in identities, devices, encrypted records and files within 30 days, and security logs within 12 months of their creation. Subscriptions must be cancelled separately: in Google Play or the App Store, or, for a subscription bought through the web checkout, on Paddle’s subscription page, which the Manage subscription button in the app and Paddle’s emails link to. Data on your devices stays until you uninstall the app.

13. Children

Tomelet is not directed at children under 13 (or the age of digital consent in your country). Profiles marked as children see no advertising. We do not knowingly collect personal information from children; contact us if you believe a child has created an account.

14. Where data is processed

Sync data is stored on Amazon Web Services. The website runs on Cloudflare's global network. AWS and Cloudflare may process data in Singapore, the United States and other locations where they operate. Push tokens and wake-up messages (section 7) pass through Google's and Apple's push services, which also operate globally. Crash reports (section 9) are processed by Sentry in the United States. Account emails, such as sign-in codes and account-deletion notices, are sent through Mailgun, which processes your email address in the United States. Facebook sign-in and the start-up request of Facebook's kit (section 3) go to Meta, which processes data in the United States and other locations. Where personal data is transferred outside Singapore, we require recipients to provide a standard of protection comparable to the Singapore Personal Data Protection Act through legally enforceable obligations or another permitted safeguard.

15. Your rights

Depending on where you live (for example under the GDPR, the UK GDPR, the CCPA/CPRA or Singapore's PDPA) you may have the right to access, correct, export or delete your personal data, to object to or restrict processing, and to complain to a supervisory authority. Export is built into the app; deletion is described above; for anything else email [email protected]. We respond within 30 days.

16. Changes

We will post changes here with a new effective date and, for material changes, notify you in the app or by email.