Tomos — Privacy Policy

Last updated: 2026-10-27

This Privacy Policy explains how Orban Forest Inc. ("Tomos", "we", "us") collects, uses, and discloses personal information when you use the Tomos mobile app and related services (the "Service"). We are the organization responsible for the personal information under our control, and we handle it in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

If you have questions or requests about your privacy, contact us at [email protected].

1. What we collect

We collect only what we need to run the Service:

• Account & identity. Your email address, and an identifier from your sign-in method — a Google account identifier (Google Sign-In), an Apple account identifier (Sign in with Apple), or a one-time email sign-in ("magic link") token. We also store your chosen primary currency.
• Receipt data you create. When you scan a receipt, we extract structured information from it — merchant name, date, total and tax amounts, currency, and individual line items — and store that structured data together with the AI extraction result. We keep a copy of each receipt image (or the PDF as you uploaded it) so you can see the receipt again next to its data in Tomos on the web and in the Android app. The copy shows everything printed on the receipt, which can include payment card details such as part of the card number, authorization codes and sometimes a cardholder name.
• Bank statements you upload. When you upload a bank or credit-card statement, we extract and store the institution name, the account type, the last four digits of the account number, the statement period, and each transaction — its date, the description as printed by your bank, amount, direction, type, and running balance. We also store the payee name and spending category we infer for each transaction. We never store the full account or card number, and we do not store the statement file itself — the PDF is processed to extract the data and then discarded. Transaction descriptions can include the names of people and businesses you paid or were paid by (for example, an e-transfer recipient); we use them only to organize your own finances.
• Settings you create. Budgets, category corrections, and payee rules you set up.
• Usage & account state. Your scan count, credit balance, subscription tier, and subscription expiry, used to operate quotas and billing.
• Payment identifiers. When you purchase a subscription or credits, our payment processors create identifiers we store to manage your purchase — a Stripe customer identifier and/or a Google Play purchase token. We never receive or store your full card number — card details are handled entirely by the payment processor.
• Waitlist. If you join the waitlist on tomos.app, your email address, which phone you use (Android or iPhone), and where you signed up from. We record whether each email we send you was delivered, bounced, or marked as spam, and if you unsubscribe, the date and any reason you choose to give.
• Technical/diagnostic data. Basic logs needed to operate and secure the Service (e.g., error and request logs). When our servers hit an error, an error report is sent to our error-monitoring provider (Sentry); it can include technical details of the request that failed. We do not use third-party advertising or analytics SDKs.

We do not knowingly collect special categories of sensitive information, and the Service is not directed to children.

2. How receipt and statement processing works (AI processing)

To turn a receipt into structured data, the receipt image is sent to our AI/OCR processor, Google (Gemini), which returns the extracted text and fields. The image is sent to the AI provider only to perform this extraction. We keep our own copy only to show the receipt back to you; it is not sent anywhere else.

To read a bank statement, we send its text to the same processor. Before we send it, we shorten long account and card numbers to their last four digits; the transaction descriptions, dates, and amounts are sent as they appear. The processor also suggests a payee name and spending category for each transaction.

Extraction and categorization are automated and may be inaccurate — you can review and edit extracted receipt data, and you should verify results before relying on them.

3. Why we use your information

We use personal information to:

• create and operate your account and authenticate you;
• extract, store, display, and let you edit and export your receipt data;
• organize your bank and card transactions, budgets, and spending by category;
• provide price-tracking and history features across your own receipts;
• operate scan quotas, credits, and subscriptions, and process payments;
• maintain security, prevent abuse, and meet legal obligations;
• respond to your support requests.

We rely on your consent (which you may withdraw — see Section 7) and on the purposes a reasonable person would consider appropriate in the circumstances.

4. How we share information (sub-processors)

We do not sell your personal information. We share it only with service providers who process it on our behalf, under contract, to deliver the Service.

When you create a share link for your receipt images, those images are available to whoever you give the link and PIN to. This is at your instruction; see Section 6.

Our service providers are:

We may also disclose information if required by law, to enforce our Terms, or to protect the rights, safety, or property of users or the public.

5. Where your information is processed

We operate the Service using infrastructure and the providers above, which may store and process information in Canada and/or the United States. Where information is processed outside your province or country, it may be subject to the laws of those jurisdictions, including lawful access by courts and government authorities. We take reasonable steps to ensure providers protect your information with comparable safeguards.

6. Retention and deletion

• Receipts, statements, and account data are retained for as long as your account is active, so your history and price trends remain available to you. We do not impose a fixed expiry on your history.
• Receipt images are kept for as long as the receipt they belong to. Deleting a receipt or your account deletes its image along with it, permanently, within about 31 days (the 30-day grace period plus our nightly clean-up). You can download your receipt images at any time on the web, from History → Receipt images → Download. The download covers the receipts that match the filters you have set in History. In the Android app you can open a single receipt's image from the receipt's detail screen and choose Share to send that one file to another app, and you can get sets of images with a share link (below).
• Share links for receipt images. On the web you can create a link to the receipt images that match your History filters (History → Receipt images → Create link). In the Android app you can create the same kind of link for a date range from Export → Receipt images. Creating a link costs no scans or credits. The link covers the images that matched when you created it; receipts you delete later drop out of it. It is protected by a 6-digit PIN, which we show to you once. Anyone who has both the link and the PIN can download a zip of those images, so share them only with people you trust. The download page shows the person opening it the first part of your email address (the part before the @), as the name the receipts come from. A link works for 7 days, unless you turn it off sooner, and locks permanently after 5 wrong PINs. You can see your active links and turn them off at any time from the account menu on the web (Your data → Shared links) or in the Android app (Settings → Shared links). When your account deletion takes effect, all your links are turned off immediately. We do not store the link or the PIN in readable form, only a one-way hash of each.
• Waitlist signups are kept while the beta waitlist is running. If you unsubscribe, we stop emailing you and keep your address, the phone type and signup source you gave, the date, your reason (if given) and the record of the emails we already sent, so that we never email you again. You can ask us to delete your signup entirely by writing to [email protected]. If you create an account, your signup is matched to it by email address.
• A receipt or statement you delete is removed from your history immediately and permanently purged after a 30-day grace period.
• You can delete your account at any time: on the web from the account menu (Billing → Delete account), in the Android app from Settings → Delete account, or by emailing [email protected] (we confirm and handle requests within 30 days). If your version of the Android app cannot schedule a deletion for subscribers (older versions cannot), update the app or use the web or email. If you have no subscription, deletion takes effect immediately. If you have a paid-up subscription (Stripe or Google Play), we cancel its renewal as part of the deletion, you keep full access until the end of the period you have paid for, and the account is deleted on that date, which we show you. Until then you can undo the deletion from the banner in the Android app or on the web app (for a Google Play subscription you must also restore the subscription in the Play Store). Starting a new subscription or turning renewal back on also cancels the scheduled deletion. When the deletion takes effect, your account is soft-deleted (you are signed out and the data is no longer accessible) and permanently purged after a 30-day grace period. There is no restore after the deletion date; signing in again creates a new account. The deletion flow does not hand over a copy of your data, so download your history (web: History → Export; Android: Export tab) and receipt images (web: History → Receipt images → Download; Android: Export → Receipt images, which creates a link you can open to download them) first; some older versions of the Android app may offer a copy when deleting, but do not rely on it.
• Email hash of deleted accounts. When an account is deleted we keep a one-way, keyed hash of its email address indefinitely. It cannot be reversed into the address, and we use it only so that a new account created with that address does not receive a new free allowance of documents. We keep nothing else from the account for this purpose.
• We retain limited records where required for legal, tax, security, or fraud-prevention purposes, for no longer than necessary.

7. Your rights and choices

Subject to applicable law, you may:

• Access the personal information we hold about you and request a copy (you can export your receipts from History on the web, and download your receipt images from History → Receipt images; in the Android app, use the Export tab, including Export → Receipt images, or open a receipt's image and choose Share);
• Correct inaccurate information — you can edit your receipt data directly in the app;
• Withdraw consent and delete your account, subject to legal or contractual restrictions;
• Ask questions or make a complaint about our handling of your information.

To exercise these rights, email [email protected]. We will respond within the timeframe required by applicable law. If you are not satisfied, you may contact the Office of the Privacy Commissioner of Canada (www.priv.gc.ca).

8. Security

We use reasonable administrative, technical, and physical safeguards appropriate to the sensitivity of the information — including encrypted transport (HTTPS), authentication tokens, and access controls. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

9. Children

The Service is intended for adults and is not directed to children. We do not knowingly collect personal information from children. If you believe a child has provided us information, contact [email protected] and we will delete it.

10. Changes to this policy

We may update this policy from time to time. We will revise the "Last updated" date above and, for material changes, provide a more prominent notice. Your continued use of the Service after a change takes effect means you accept the updated policy.

11. Contact

Orban Forest Inc. 48 Sulky Road, Brantford, ON N3P 1K2 Email: [email protected]