This Privacy Policy applies to the Toss mobile application (“Application”) for Android. By using the Application you agree to the practices described below.
Information we collect
Information you provide directly
- Email address: collected when you sign in via Google OAuth (powered by Supabase). Used for authentication and as your default capture destination.
- Display name: optional. Used as the sender name on outgoing emails.
- Email destinations: email addresses you add as capture destinations. Stored locally on your device and sent to our server only when processing a capture.
- Text captures: text you type and submit as a capture.
- Voice recordings: audio recorded via the microphone when you use voice capture. Uploaded to our server for transcription and AI processing.
- Photos: images taken via the camera or selected from your library when you use photo capture.
- Files: files selected from your device (any type, up to 10 MB) when you use file capture.
Information collected automatically
- Device Internet Protocol (IP) address
- Operating system and device type
- App version and crash/error data (via Firebase Crashlytics)
- Subscription and purchase status (via RevenueCat)
The Application does not collect precise location data.
The website
This website sets no cookies, runs no analytics and embeds no third-party trackers. Nothing is stored on or read from your device, which is why you are not asked to accept anything. The only data it handles is what you type into the support form on the help page, which is emailed to us and not stored on the site. The form is protected by Cloudflare Turnstile, which checks that you are not an automated script.
Cloudflare, which serves this website, records technical request data such as IP addresses in its own logs to deliver and protect the site. That happens on Cloudflare’s servers, not on your device.
How we use your information, and on what legal basis
| What we do | Why | Legal basis (GDPR Art. 6) |
|---|---|---|
| Forward your captures as emails to your chosen destinations | It is the service you signed up for | Performance of a contract, Art. 6(1)(b) |
| Transcribe voice recordings and process capture content with AI to generate titles, summaries and routing (Pro) | Part of the Pro service | Performance of a contract, Art. 6(1)(b) |
| Verify your identity when you sign in | To give you access to your account | Performance of a contract, Art. 6(1)(b) |
| Determine Free or Pro access from your purchase status | To provide the tier you paid for | Performance of a contract, Art. 6(1)(b) |
| Collect crash and error diagnostics | To find and fix defects | Legitimate interest, Art. 6(1)(f) |
| Keep records of subscriptions and purchases | Belgian accounting and tax law | Legal obligation, Art. 6(1)(c) |
| Contact you about important service changes | To keep the service usable and safe | Performance of a contract, Art. 6(1)(b) |
| Send marketing email | Only if you ask for it | Consent, Art. 6(1)(a) — withdrawable at any time |
All AI processing happens server-side and asynchronously; it never blocks your capture.
Anonymised, aggregated usage data may be used to improve the Application. Once anonymised, it can no longer identify you and is no longer personal data.
Data storage and retention
- Captures are stored locally on your device (SQLite) until successfully sent, then kept in a local history log.
- Captures transmitted to our server are processed and forwarded by email. The text we generate for a capture is held only until your app collects it, usually within seconds, and deleted after 48 hours at the latest. Apart from that, we don’t keep the content of your captures after delivery, other than in error logs when a delivery fails.
- Once an email has been delivered, a copy remains with the email provider that sent it before being automatically purged: 30 days at Resend, 7 days at AhaSend. It also remains in the mailbox of whoever you sent it to, which is outside our control.
- Account data (email, settings) is stored in Supabase’s German region, inside the European Union, and retained for as long as your account is active.
- Crash and error diagnostics are retained, anonymised, for up to 90 days.
- Subscription and purchase records are retained for 7 years, as required by Belgian law.
To request deletion of your data, see Delete your account or contact us at hello@tossit.app.
Third-party services
The Application uses the following processors. Each has its own privacy policy.
- Infomaniak: AI transcription and content processing for Pro captures. Infomaniak is a Swiss company and processes this content in Switzerland. Privacy policy
- Supabase: authentication and user management. Our Supabase project is hosted in Germany, so your account data is stored in the European Union. Supabase Pte Ltd, the company behind it, is established in Singapore. Privacy policy
- Resend: transactional email delivery. Privacy policy
- AhaSend: transactional email delivery, used alongside Resend so your captures still go out when one provider is unavailable. AhaSend B.V. is established in Amsterdam, the Netherlands, and stores message data inside the European Union. Privacy policy
- RevenueCat: in-app subscription and purchase management. Privacy policy
- Railway: cloud hosting for the backend API. Our backend runs in Railway’s EU West region in Amsterdam, so captures are processed inside the European Union. Railway Corporation itself is established in the United States. Privacy policy
- Firebase Crashlytics (Google): crash reporting and diagnostics. Privacy policy
- Cloudflare: hosting of this website and bot protection on the support form. Privacy policy
We do not sell your personal data to any third party, and we do not use your captures to train AI models.
Transfers outside the European Economic Area
Your captures stay inside Europe while we handle them. They reach our backend in Amsterdam, and voice recordings, transcripts, text, photos and files are transcribed and processed by Infomaniak in Switzerland, which the European Commission recognises as providing an adequate level of data protection. Your account data sits in Germany. No capture content is sent outside the EEA or Switzerland for AI processing.
Once a capture has been turned into an email, delivery is a separate matter: the message goes to the address you chose, wherever that mailbox happens to be. We send through two email providers. Resend is established in the United States; it delivers the email and keeps a copy for 30 days before permanently deleting it. That transfer is covered by the safeguards below. AhaSend is established in the Netherlands and stores message data inside the European Union, keeping a copy for 7 days. Each email goes out through one of the two; the second is used when the first is unavailable.
Some of the other processors are established outside the EEA. For each, the safeguard is:
| Processor | Established in | Safeguard for the transfer |
|---|---|---|
| Infomaniak | Switzerland | Adequacy decision — no further safeguard required |
| Supabase | Data stored in Germany; company in Singapore | Standard Contractual Clauses, for support access from outside the EEA |
| RevenueCat | United States | Standard Contractual Clauses |
| Railway | Servers in Amsterdam; company in the United States | Standard Contractual Clauses, for support access from outside the EEA |
| Resend | United States | EU–US Data Privacy Framework certification, and Standard Contractual Clauses |
| AhaSend | Netherlands; data stored in the EU | No transfer outside the EEA — no safeguard required |
| Google (Firebase Crashlytics) | United States | EU–US Data Privacy Framework certification |
| Cloudflare | United States | EU–US Data Privacy Framework certification, and Standard Contractual Clauses |
You may request a copy of the relevant safeguards at hello@tossit.app.
Permissions used
- Microphone (RECORD_AUDIO): required for voice capture.
- Camera: required for photo capture (long press on the Attach button).
- Storage / media access: required to select files and photos from your device for file capture.
- Internet: required to send captures and authenticate.
In-app purchases
The Application offers a Pro subscription managed through Google Play Billing via RevenueCat. Payment information is handled entirely by the app store and is never processed or stored by us directly.
Children
The Application is not intended for children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, contact us at hello@tossit.app and we will delete it.
Security
We implement appropriate technical and organisational measures to protect your data, including encrypted data transmission (HTTPS), secure authentication tokens, and access controls on our backend infrastructure. No method of transmission over the internet is 100% secure, but we take reasonable steps to protect your information.
Your rights
If you are located in the European Economic Area, you have the right to access, correct or delete your personal data, to restrict or object to processing, to withdraw consent where processing is based on it, and to request data portability. To exercise any of these rights, contact us at hello@tossit.app.
You also have the right to lodge a complaint with a supervisory authority. In Belgium that is the Data Protection Authority:
Gegevensbeschermingsautoriteit / Autorité de protection des données Drukpersstraat 35 / Rue de la Presse 35, 1000 Brussels www.dataprotectionauthority.be
Opt-out
You can stop all data collection by uninstalling the Application using the standard uninstall process on your device or via the app marketplace.
Changes to this policy
We may update this Privacy Policy from time to time. The date at the top of this page tells you when it last changed. We will notify you of material changes by updating this page. Continued use of the Application after changes constitutes your acceptance of the updated policy.
Who is responsible, and how to reach us
The data controller for the Application is:
Sven Dierckens, sole trader (natuurlijk persoon) Rue les Fonds 16, 5340 Gesves, Belgium Enterprise number and VAT: BE 1042.589.256
If you have any questions about this Privacy Policy, or want to exercise any of the rights above, contact us at hello@tossit.app. Further details are in the legal notice.