Privacy Policy (GDPR) – Perhe.app
Updated: January 13, 2026
Introduction
Tohmoco Oy (hereinafter ”Service Provider” or ”we”) respects your privacy and processes personal data in accordance with the EU General Data Protection Regulation (GDPR) and Finnish data protection legislation. This privacy policy explains how we collect, use, and protect the personal data of users of the Perhe.app mobile application and related services.
Using and registering for Perhe.app requires that the user has reviewed this privacy policy.
1. Data Controller
The data controller is:
Tohmoco Oy
Business ID: 3387948-8
Domicile: Helsinki, Finland
Email (privacy matters): info@tohmoco.fi
A separate Data Protection Officer has not been appointed. You can contact us regarding privacy matters by email.
2. Personal Data Collected
We process the following personal data provided by users or collected during use of the Service:
2.1 Basic User Account Information
- name (if provided)
- email address
- other contact information entered by the user (e.g., profile details)
2.2 Family and Group Features (Shared Data)
Perhe.app is a service designed for shared family use. The following data is typically processed:
- family/group name and settings
- family member invitations and roles (e.g., administrator / member)
- shared content within the family created by users (see section 2.4)
Note: Perhe.app is not intended for independent collection of children’s personal data without parental involvement. The family account administrator is responsible for ensuring that data shared within the family is entered appropriately.
2.3 Service Usage Data
- login and session data
- language and notification settings
- usage-related event data (e.g., feature usage frequency)
2.4 User-Generated Content
Users can store content in Perhe.app, such as:
- calendar entries, tasks, and reminders
- shopping lists and notes
- images and documents (e.g., school notices, recipes, receipts)
- messages/internal comments within the family (if feature is enabled)
2.5 Technical Data, Logs, and Device Information
- device model and operating system version
- app version and language
- device identifiers (e.g., app-specific identifiers), IP address, and diagnostic data
- log data (for troubleshooting, security, and abuse prevention)
2.6 Push Notification Data
- push token (device-specific notification identifier)
- notification status and settings
2.7 Customer Service Data
- content of support requests and any attachments
- communication between user and customer support (e.g., email)
2.8 Payment and Subscription Data (App Stores)
Perhe.app payments are typically processed through Apple App Store or Google Play Store (in-app purchases).
- we receive subscription status information from the app store (e.g., active/inactive), subscription period type, and transaction identifiers
- we do not receive or store payment card details
2.9 Device Permissions
The app requests the following permissions on your device:
- Camera: Scanning documents and receipts to create calendar events, taking profile photos, and attaching images to notes. Data is not saved without user action.
- Photo Library / Photos: Selecting images for notes, messages, and profile pictures. The app only processes images selected by the user.
- Push Notifications: Calendar reminders, chore reminders, and family messages and updates. Notifications can be disabled in app or device settings.
- Network Access: Syncing data between family members, user account management, and subscription processing. The app requires an internet connection for full functionality.
You can revoke permissions at any time in your device settings.
Providing personal data is a prerequisite for using the Service to the extent that the data is necessary for creating a user account and providing the Service.
3. Processing Purposes and Legal Bases
We process personal data for the following purposes:
3.1 Providing and Maintaining the Service (GDPR Article 6(1)(b) Contract)
- creating user accounts and login
- enabling family account/group functionality
- storing and syncing tasks, calendars, lists, and other content
- sending push notifications and service reminders according to user settings
- managing the 30-day free trial and subscription status
3.2 Service Development, Analytics, and Bug Fixes (GDPR Article 6(1)(f) Legitimate Interest)
- monitoring app functionality and performance
- investigating errors and crashes
- statistical analysis of feature usage (preferably anonymized/aggregated)
3.3 Customer Service and Communication (GDPR Article 6(1)(b) and/or 6(1)(f))
- responding to support requests
- sending important service-related messages (e.g., terms of service changes, security notices)
3.4 Marketing (GDPR Article 6(1)(a) Consent)
We do not send electronic direct marketing (such as newsletters) without the user’s explicit consent. Consent can be withdrawn at any time.
3.5 AI Features (GDPR Article 6(1)(b) Contract)
Perhe.app uses artificial intelligence for the following features:
Document Scanning and Text Recognition
- We use optical character recognition (OCR) to read text from images.
- Recognized text is analyzed by Google Gemini AI to extract event information (date, time, location).
- Processing occurs in Google’s cloud service.
Data Processing in AI Features
- Scanned data is processed in real-time and is not permanently stored on Google’s servers.
- We do not use scanned data to train AI models.
- Parsed event data is stored in our Supabase database in the user’s calendar.
You can avoid AI processing by creating events manually instead of scanning.
4. Regular Data Sources
- Data is primarily obtained from the user during registration and use.
- Technical data and logs are collected automatically from app usage.
- Subscription status is obtained from the app store (Apple/Google) and RevenueCat service to verify subscriptions.
Sign-In Services
We offer sign-in through Google Sign-In and Apple Sign-In services:
- Google Sign-In: Google shares your name, email address, and profile picture with us with user consent. We do not gain access to your Google account password.
- Apple Sign-In: Apple shares your name and email address with us. You can choose ”Hide My Email” to have Apple create a private relay address.
Sign-in credentials are stored in our Supabase service to maintain your user account.
5. Personal Data Disclosures and Recipients
We do not sell or rent personal data to third parties. Data may be disclosed or access granted to the following parties to provide the service:
5.1 Technical Service Subcontractors (Processors)
We use trusted service providers, including:
- Supabase – cloud and infrastructure services, database, and user authentication
- Firebase – analytics, crash reporting (Crashlytics), and push notification delivery (Firebase Cloud Messaging)
- RevenueCat – subscription management and purchase transaction processing. RevenueCat processes subscription status, type, purchase transactions, app and device identifiers, and subscriber country code. The service does not process payment card details. More information: revenuecat.com/privacy
- Google Fonts – the app dynamically loads fonts (Nunito, Mulish) from Google’s servers. This connection transmits technical information to Google, such as your IP address. More information: developers.google.com/fonts/faq/privacy
These parties process data only according to our instructions and are bound by contractual data protection obligations.
5.2 App Stores (Apple / Google)
Subscription payments and management are handled through Apple App Store or Google Play Store. App stores process payment transactions according to their own terms. We receive subscription status and identifiers from the app store that are necessary for providing the Service.
5.3 AI and Other External Services
Perhe.app uses the following AI and external services:
Google Generative AI (Gemini)
- The app uses Google’s Gemini AI service for document text recognition and automatic event parsing.
- When you use the scanning feature, scanned images and recognized text are sent to Google’s servers for processing.
- Google processes the data to parse event details (date, time, location, description).
- We do not permanently store scanned images on Google’s servers.
- By using the scanning feature, you consent to data being sent to Google’s AI service.
- More information about Google’s privacy practices: policies.google.com/privacy
5.4 Statutory Disclosures
We may disclose data to authorities if required by law or official order.
5.5 Corporate Transactions
In connection with a potential acquisition, merger, or corporate transaction, user data may be transferred as part of the business within the limits permitted by applicable law.
6. Transfer of Personal Data Outside the EU/EEA
We process personal data primarily within the EU/EEA area. If any of the services we use transfers data outside the EU/EEA area, we ensure GDPR-compliant safeguards (e.g., European Commission Standard Contractual Clauses and necessary transfer assessments).
The following services may transfer data outside the EU/EEA:
- Google services (Firebase, Google Sign-In, Google Generative AI, Google Fonts)
- RevenueCat
- Apple (Apple Sign-In)
7. Protection of Personal Data
We have implemented technical and organizational measures to protect personal data:
- data transmission protection (TLS/SSL)
- access control and permission restrictions
- secure password handling (not stored in plain text)
- logging and monitoring to detect abuse
- backup and recovery procedures
Any data security breaches will be reported to authorities and data subjects in accordance with GDPR requirements.
8. Data Retention Period
We retain data only as long as necessary:
- User account data and family account content: as long as the account is active. After account deletion, data is deleted or anonymized within a reasonable time (typically within 30 days), unless longer retention is required by law.
- Customer service messages: for the duration of the matter and a reasonable time thereafter (typically up to 12 months).
- Logs and diagnostics: typically 12 months, unless longer retention is necessary for security reasons.
- Subscription and accounting data: in accordance with applicable law (in Finland, accounting materials are generally retained for 6 years after the end of the fiscal year). Note: app stores retain payment data in their own systems according to their own terms.
9. Data Subject Rights
You have the following rights:
- right to access data (right of inspection)
- right to rectify data
- right to delete data (”right to be forgotten”) where applicable
- right to restrict processing in certain situations
- right to object to processing when based on legitimate interest
- right to data portability (data processed automatically based on contract/consent)
- right to withdraw consent (e.g., marketing, non-essential tracking)
Requests can be sent by email to: info@tohmoco.fi. We will verify identity if necessary to ensure security. We will respond to requests without undue delay, within 1 month at the latest.
10. Right to Lodge a Complaint with a Supervisory Authority
If you believe your personal data is being processed unlawfully, you have the right to lodge a complaint with a supervisory authority. In Finland, the supervisory authority is the Office of the Data Protection Ombudsman (tietosuoja.fi).
We recommend contacting us first so we can try to resolve the matter.
11. Tracking, Analytics, and ”Cookies” in Mobile Applications
Mobile applications do not use cookies in the same way as websites, but the app may use:
- app-specific identifiers
- SDK libraries for analytics and crash reporting
- device advertising identifier (IDFA/AAID) only if used and if the user gives consent (iOS: App Tracking Transparency prompt)
Essential technical identifiers and logs are necessary for the Service’s operation and security. Consent for non-essential tracking (e.g., marketing) is requested in the app and/or through operating system permission prompts.
If Perhe.app also has a website, cookies used on the website are described in a separate cookie policy.
12. Third-Party Services – Summary
13. Changes to This Privacy Policy
We may update this privacy policy as the service develops or legislation changes. We will notify you of significant changes in the app or by email. The date at the beginning of the policy indicates the most recent update.
Contact Information
Tohmoco Oy / Perhe.app
Email: info@tohmoco.fi
Website:
www.perhe.app
