Privacy Policy

Last updated: October 2026 · Applies to the Tummi iOS app and this website

1. Who is responsible

The controller under the EU General Data Protection Regulation (GDPR) is:

Tummi is made by me as a solo developer. I have not appointed a data protection officer because the law does not require one for my processing. You can reach me directly at the address above for any privacy question.

2. No account

You can use Tummi without signing up. There is no user account, no login, and Tummi does not ask for your name, e-mail address or phone number.

3. Your diary is stored on your device

Everything you log in Tummi is stored locally on your iPhone, inside the app's protected storage. This includes bowel movements (Bristol type, colour, amount, urgency, straining, pain, blood, mucus, notes), attempts, water, fiber, laxatives, meals and food tags, symptoms, period, medication, daily check-ins (sleep, stress, mood), profiles, reminders and settings. Tummi also keeps daily snapshots of your diary on the device so you can recover from mistakes.

Much of this is health data. I do not receive it, and it is not sent to any server operated by me or on my behalf. It is processed on your device because you enter it and want the app to show it back to you (Art. 6(1)(b) GDPR, and for health data your explicit choice to enter it, Art. 9(2)(a) GDPR). You can change or delete any entry at any time.

If you use iPhone backups (iCloud Backup or a backup on your computer), iOS may include app data in those backups. These backups are controlled by you and Apple under Apple's terms.

4. Automatic backup in your iCloud

To protect you from losing your diary, Tummi automatically saves a backup of your diary in your own private iCloud account, using Apple's iCloud key-value storage. This backup is tied to your Apple Account. I cannot access it, and it is not visible to anyone else. Apple stores and transfers this data for you under the iCloud terms and Apple's privacy policy. Photos are not part of this iCloud backup.

You can switch the iCloud backup off at any time in Tummi under Settings, Your data, iCloud backup. If you are not signed in to iCloud, no iCloud backup is made. Legal basis: providing the backup function of the app (Art. 6(1)(b) GDPR) and your choice to use iCloud (Art. 9(2)(a) GDPR).

5. Photos

You can add a photo to an entry. Photos taken in Tummi use Tummi's own in-app camera and are saved only inside the app's private storage. They are never saved to the Photos app, your camera roll or iCloud Photos, and they are never uploaded. Viewing photos is protected with Face ID (or your passcode).

Tummi reads a photo only on your device: for imported photos, the time the photo was taken (from the image's EXIF data), and for all photos a suggested stool colour. There is no server analysis and no AI service involved.

Tummi asks for camera access only when you open the camera. If you import an existing photo (From Photos), iOS shows its photo picker and Tummi receives only the photo you choose. Tummi keeps its own private copy; the original stays where it was.

6. Face ID

Photos are always locked. You can also lock the whole app under Settings, Privacy. Face ID is handled entirely by iOS. Tummi never receives your face data. It only learns from iOS whether the check succeeded.

7. Apple Health (optional)

If you turn on Apple Health in Tummi under Settings, Extras and give permission, Tummi writes the following symptom samples to the Health app: constipation, diarrhea, bloating and abdominal cramps. Tummi only writes; it does not read any data from Apple Health. Health data is never used for advertising, never shared with third parties by me and never included in analytics.

Legal basis: your explicit consent (Art. 9(2)(a) GDPR). You can withdraw it at any time in Tummi's settings or in the Health app (Sharing, Apps, Tummi).

8. Notifications

Tummi can remind you gently after a number of days without a bowel movement, and in the evening if you wish. These are local notifications scheduled on your device. No data is sent anywhere for them. You can turn them off in Tummi or in iOS Settings.

9. Anonymous usage analytics (PostHog)

To understand which parts of Tummi are used and where people get stuck, the app uses PostHog, a product analytics service of PostHog Inc. Tummi uses PostHog's EU cloud, hosted in Frankfurt, Germany.

What is sent:

• screens opened and buttons or features used (for example "log opened", "calendar viewed", "export tapped")
• onboarding steps reached and whether a question was answered; the answer itself only for "who is this diary for" (you, a child, someone else), never your answers about your health or how often you go
• paywall views, the plan you select, and purchases started, completed or cancelled
• app lifecycle events: installed, updated, opened, sent to the background
• technical context: app version, iOS version, device model, language and approximate country

What is never sent: your diary entries, which kind of entry you made (for example a laxative, a symptom or your period), Bristol types, symptoms, foods, notes, photos, anything from Apple Health, your name, e-mail address, Apple Account, contacts or the advertising identifier (IDFA).

Events are linked to a random identifier created by the app. No person profiles are created, there is no session replay and no tracking across other apps or websites. Your IP address is needed to transmit events; it is not stored with the events and not used to identify you. Debug and test builds send no analytics.

Legal basis: my legitimate interest in improving the app in a privacy-friendly way (Art. 6(1)(f) GDPR). Events are deleted after 12 months. You can switch analytics off at any time in Tummi: Settings, Privacy, Share anonymous usage. After that, no more events are sent. PostHog acts as my processor under a data processing agreement. PostHog Inc. is based in the USA; possible access from there is covered by the EU Standard Contractual Clauses.

10. Purchases and Tummi Plus (Apple and RevenueCat)

Tummi is free to download. Tummi Plus is offered as an auto-renewable monthly subscription with a free trial, or as a one-time lifetime purchase. Payment is handled entirely by Apple through the App Store. I never see your payment details.

To know whether you have Plus, Tummi uses RevenueCat, a service of RevenueCat Inc. RevenueCat processes an anonymous app user ID, your purchase and subscription status, purchase history for Tummi, the receipt data provided by Apple, and basic device information such as app version, iOS version, country and currency. RevenueCat does not receive your diary or any health data.

Legal basis: performance of the contract for your purchase (Art. 6(1)(b) GDPR) and legal retention duties (Art. 6(1)(c) GDPR). RevenueCat acts as my processor. RevenueCat Inc. is based in the USA; transfers are covered by the EU Standard Contractual Clauses.

11. Apple App Store

When you download Tummi, buy Plus, cancel a subscription or ask for a refund, Apple processes your data as an independent controller under its own privacy policy. If you agree to share crash reports and app analytics with developers in iOS Settings, Apple provides me with anonymous, aggregated reports. You manage and cancel subscriptions in the App Store settings of your Apple Account.

12. Import, export and backups you create

CSV export, full backup files (diary and photos in one file) and the doctor report PDF are created on your device. Where they go next is up to you (for example Files, AirDrop or e-mail). When you import data from another app, the file is read on your device only.

13. E-mail support

If you write to me, for example via "Send feedback" in the app, I process your e-mail address and the content of your message only to answer you and improve Tummi (Art. 6(1)(f) GDPR). Please do not send health details unless you want to; if you do, I treat them as your explicit consent to read them for your request (Art. 9(2)(a) GDPR). E-mails are deleted when they are no longer needed for your request, unless legal retention duties apply. My e-mail is hosted by Google (Gmail).

Links to my profile on X (@casparbuilds) open X; X's own privacy policy applies there.

14. This website

This website is hosted on Firebase Hosting, a service of Google Ireland Limited. When you open a page, the server processes your IP address, the requested page, date and time, browser and operating system to deliver the page and keep it secure (Art. 6(1)(f) GDPR). The fonts are served from this website itself; no font service is contacted. Google may process data in the USA; transfers are covered by the EU-U.S. Data Privacy Framework and Standard Contractual Clauses. This website uses no cookies, no analytics and no tracking.

15. No ads, no data selling

Tummi shows no ads and contains no advertising SDKs. Your data is never sold, rented or shared for advertising.

16. Children

Tummi is meant for adults and teenagers looking after their own health, and for parents and carers. Parents can create a profile for a child; that diary is stored in the same private way on the parent's device and in the parent's iCloud. I do not knowingly collect personal data from children. The anonymous usage events described above contain nothing that identifies a child.

17. How long data is kept

• Diary, photos, snapshots: on your device until you delete them or uninstall Tummi.
• iCloud backup: in your iCloud until you use "Delete all data" in Tummi or remove it via your iCloud settings.
• Analytics events: 12 months.
• Purchase records: as long as needed for your purchase and legal retention duties.
• Support e-mails: until your request is resolved, unless retention duties apply.

18. Your rights

Under the GDPR you have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and to object to processing based on legitimate interest (Art. 21). Where processing is based on consent, you can withdraw it at any time with effect for the future.

Because your diary lives with you, you can exercise most of these rights directly in the app:

• Access and portability: export your diary as CSV or as a full backup file.
• Rectification: edit any entry.
• Erasure: use Delete all data in Tummi's settings. This deletes your diary, photos and snapshots on the device and clears the iCloud backup. Uninstalling Tummi also deletes all data stored on the device.
• Objection to analytics: switch analytics off in Settings.

For anything else, just write to me. Because analytics and purchase data are anonymous, I may need details from you to find data that relates to you.

You also have the right to lodge a complaint with a data protection supervisory authority, for example the authority responsible for me: Berliner Beauftragte für Datenschutz und Informationsfreiheit, Alt-Moabit 59-61, 10555 Berlin, Germany.

19. Security

Your diary is stored in the app's sandbox and protected by iOS data protection. Photos are additionally locked behind Face ID or your passcode. All data sent to PostHog, RevenueCat and iCloud is encrypted in transit.

20. Changes

If this policy changes, the new version will be published on this page with a new date. For important changes, Tummi will let you know in the app.

21. Contact

Tummi is a diary, not a medical device. It does not diagnose or treat any condition.