Privacy Policy

1. Personal Data Operator

The personal data operator is:

• Name: TOMNI LLC
• Email: admin@tomni.ru
• Telegram: @tomni_app_bot
• The Operator determines the purposes and means of personal data processing and ensures its protection in accordance with RF law

2. What Data We Collect

We collect the following categories of personal data:

• For adult users: email address, password (stored in hashed form), display name, birth year, gender
• For children's accounts: nickname, birth year, PIN code (stored in hashed form), age group
• Couple profile data: partner information, invitation code, connection status
• Usage data: quiz and survey results, journal entries, skill progress (for children), preferences, Platform activity data
• Messages: text messages in chats (for couples and children's chats), voice messages
• Media content: photos uploaded to profile or journal (compressed and stored in secure cloud storage)
• Technical data: IP address, device and browser type, session data
• Subscription data: subscription status, payment history (no bank card details)

3. How We Use Your Data

We process personal data for the following purposes:

• Providing access to Platform features and personalizing user experience
• Operating couple features (matching, joint quizzes, chat)
• Operating the children's section (logic worlds, AI mentor, safe chats, skill tree)
• AI content moderation to ensure safety, especially in the children's section
• Generating personalized recommendations using AI
• Ensuring account security and preventing fraud
• Maintaining statistics and analytics to improve service quality
• Sending service notifications (with user consent)

4. Legal Basis for Processing

Personal data processing is carried out based on:

• Consent of the data subject (Art. 6, Part 1, Clause 1 of FZ-152) -- the primary legal basis
• For children: consent of a parent or legal guardian for processing the child's data
• Performance of a contract to which the data subject is a party (Art. 6, Part 1, Clause 5 of FZ-152)
• Legitimate interests of the operator (ensuring Platform security)

5. Data Storage

In accordance with Federal Law No. 242-FZ dated July 21, 2014 on localization of personal data of Russian Federation citizens:

• All personal data is stored on servers located within the Russian Federation
• Media files are stored in encrypted secure cloud storage within the RF
• Data is retained for the entire duration of the user's account
• After account deletion, data is deleted within 30 days, except for data required by law
• Backup copies are retained for no more than 90 days after primary data deletion
• Children's account data is deleted immediately upon request of a parent or legal guardian

6. Third-Party Data Sharing

We do not sell, trade, or transfer personal data to third parties, except in the following cases:

• Technical providers: cloud hosting, authentication services -- only to ensure Platform operation, with appropriate confidentiality agreements
• AI services: for generating personalized recommendations and content moderation -- data is transmitted in anonymized form
• Legal requirements: in cases provided by RF law, upon request of authorized government bodies
• Children's data is NOT shared with third parties under any circumstances, except as required by law

7. Children's Data -- Enhanced Protection

Enhanced protection measures are applied to personal data of children (users aged 6 to 17):

• Collection of children's data is only carried out with the consent of a parent or legal guardian
• The volume of collected data is minimized: only nickname, birth year, and PIN code
• All chats undergo real-time AI moderation to filter unsafe content
• Parents have full access to their child's data through the parent code
• Parents have the right to request complete deletion of their child's data at any time
• Children's data is not used for advertising purposes or profiling
• Children cannot independently share personal data with other users -- the friend-code system ensures controlled friend additions

8. Cookies

We use the following types of cookies:

• Essential: for authentication, session management, and security
• Functional: for saving user preferences (interface language, theme)
• Analytics: for collecting anonymized Platform usage statistics
• We do NOT use advertising cookies and do NOT share data with advertising networks
• You can manage cookies through your browser settings. Disabling essential cookies may affect Platform functionality

9. Data Subject Rights

Under FZ-152 "On Personal Data," you have the right to:

• Obtain information about the processing of your personal data
• Access your data and request a copy
• Demand correction, blocking, or deletion of inaccurate or outdated data
• Export your data in a machine-readable format
• Withdraw consent for personal data processing
• Appeal the operator's actions to Roskomnadzor
• Parents have the right to exercise all of the above rights with respect to their children's data

10. Data Security

We implement a comprehensive set of organizational and technical measures to protect data:

• Encryption in transit (TLS 1.3) and at rest (AES-256)
• Hashing of passwords and PIN codes using bcrypt (12 rounds)
• Role-based access control and principle of least privilege
• Real-time AI content moderation, especially in the children's section
• Regular security audits and monitoring for suspicious activity
• Rate limiting to protect against attacks
• Automatic compression and anonymization of uploaded images

11. Policy Changes

We reserve the right to amend this Policy. In case of significant changes, we will notify you via email or through a Platform notification at least 14 days before the changes take effect. Continued use of the Platform after changes are made constitutes your acceptance of the updated Policy. If you disagree with the changes, you may discontinue use and delete your account.

12. Contact Information

If you have questions regarding this Privacy Policy or the processing of your personal data, contact us:

• Operator: TOMNI LLC
• Email: admin@tomni.ru
• Telegram: @tomni_app_bot
• Data protection officer: admin@tomni.ru
• Supervisory authority: Roskomnadzor (https://rkn.gov.ru)