Legal
Privacy policy
This policy covers Tondo and its website. Signing in alone uploads no projects; Tondo sync requires a separate explicit choice. We never sell personal data.
On this page
1 The short version
Tondo keeps local projects on your device and uses your own iCloud for supported Apple-device sync. A Tondo account is optional for ordinary app use and store purchases. Account-based project sync and community sharing are separate choices. Website purchases use the Tondo account. We never sell personal data.
This policy covers Tondo and its website. It explains the account, community, Ravelry, purchases and the local worksheets you choose to use.
2 Who is responsible (controller)
- Legal name
- Oomny B.V. (Besloten Vennootschap)
- Address
- Le Mairekade 77, 1013 CB Amsterdam, Netherlands
- Chamber of Commerce (KvK)
- 88737365
- VAT identification (btw-id)
- NL864757062B01
- support@tondomakers.com · privacy: privacy@tondomakers.com
- Phone
- +31 70 2212442
Oomny B.V. provides Tondo and is responsible for the account, sync, community, website and support processing described here. Its registration and address are on our legal information page. For privacy questions, write to privacy@tondomakers.com.
3 Where your app data lives
Local app content: your charts, project notes, images and craft records are stored on your device. Tondo and its store purchases remain usable without a Tondo account. If you choose a Tondo account, we process the Apple or Google identifier, your Tondo account identifier and session security data to provide the requested service (Article 6(1)(b) GDPR). We do not receive your Apple or Google password. Linking sign-in methods requires separate verification; matching email addresses do not merge accounts. Signing in alone uploads no projects; Tondo sync requires a separate explicit choice.
Tondo syncs supported records to your own iCloud so it appears across your iPhone, iPad and Mac. For that sync, the data is replicated through your Apple account’s iCloud, where Apple operates the storage; it is governed by Apple’s privacy policy and never passes through a server of ours. Your own iCloud sync is separate from optional Tondo-account sync and community sharing described below.
On supported Apple devices, Tondo can use on-device models to help match chart symbols. Android uses on-device text recognition. Your chart content is not sent to a cloud AI model.
Tondo sync stores knitting and fabric project documents, attachments, inventory, revisions and installation IDs with Cloudflare D1 and R2. R2 storage has EU jurisdiction; this does not guarantee that all processing takes place only in the EU. Sign-in tokens may contain a name or email address. Our identity records use provider and account IDs and security data, never your password.
The Tondo community stores profiles, accepted rules, posts, photos, comments, likes, follows, blocks, groups, events and published designs. Content is for signed-in members, subject to group restrictions. Sharing a project excludes its private documents, scans, notes and recipient; publishing your own design is a separate action. We remove EXIF and other embedded metadata from photos. Moderation processes reports, reporter IDs and rights claims. Cloudflare Email Service sends moderators excerpts and notes, plus contact details for rights claims, without reporter IDs.
A profile photo is optional. Members see it with your profile, posts, comments and group memberships. We store only a re-encoded square copy without EXIF or location data, and we never copy the photo from your Apple or Google account automatically. Members can report a profile photo, and blocking a member hides their photo from you. Moderators can remove a profile photo; the removal is recorded in the moderation audit.
If you turn on community notifications, we store the push token Apple (APNs) or Google (Firebase Cloud Messaging) gives the app on this device, with the kinds of notifications you chose. We use it only to tell you about what you turned on. Apple or Google delivers the notification; it contains a name and a short excerpt. When you turn notifications off, sign out or delete your account, we delete the token. Legal basis: GDPR 6(1)(b).
For the Ravelry link, we store your username and encrypted OAuth tokens to read your Ravelry data, download your files through our proxy and send Ravelry only what you choose (a linked project's progress and status, a photo, your queue or favourites), plus which Tondo project is linked to which Ravelry project. Ravelry is an independent controller. Disconnecting in Tondo deletes the connection, tokens and project links; you can also revoke authorisation at Ravelry. Downloaded files remain on your device.
Catalogue downloads use Cloudflare; restricted downloads check your account and purchase rights. Linking a store purchase verifies its proof of purchase. Version checks send the app ID, platform and storefront country. Voice commands use the system recogniser; audio may reach Apple or the device’s speech service, never Tondo. The legal basis for requested services is Article 6(1)(b) GDPR. Moderation and security rely on our legitimate interests and applicable legal duties under Article 6(1)(f) and (c).
Account, sync, community and Ravelry features need the data described above to work. You can use local projects without enabling them. Choosing not to provide the required account or purchase information prevents us from providing the corresponding online service. We do not make automated decisions with legal or similarly significant effects; automated moderation holds can be reviewed by contacting support.
On Android, the on-device text recognition features for reading yarn labels use Google ML Kit. Your input images and text and the resulting content are processed on the device, not sent to Google for cloud AI processing. Google states that ML Kit may send technical metrics about SDK performance and use, including device and app information, a per-installation identifier and error events. See Google’s ML Kit data disclosure. Those provider diagnostics are separate from your photos and other content; we do not receive them as app analytics.
When you ask to create or link a Ravelry project, Tondo sends the project name to Ravelry. A photo you choose to send is re-encoded on the device without location or camera metadata before transfer. These are explicit actions, not automatic sharing of your library.
4 What this website processes, why, and on what basis
- Website server logs. Our host keeps standard technical access logs (IP address, timestamp, page requested, user-agent) to operate the site and keep it secure. Legal basis: our legitimate interest in running and protecting the site (GDPR Art. 6(1)(f)). Retained briefly and used for nothing else.
- Email you send us. If you email support or privacy, we process your message to answer you. Legal basis: our legitimate interest in responding to you (Art. 6(1)(f)).
- Tondo worksheets and My workspace. The worksheets on the Tondo website (/make) and the sheets in My workspace work entirely in your browser. What you type there is not sent to us or anyone else and is not linked to a Tondo account. A saved sheet stays in your browser’s local storage on this device until you delete it or clear this browser’s data for this site; we cannot see, restore or delete it for you. An exported sheet is a file on your device that you control. Because we never receive these sheets, no legal basis for processing by us is needed.
This website carries no advertising, does no profiling and makes no automated decisions, and we never sell personal data. Apple and Google handle store purchases. For Tondo website purchases we process your receipt email, order and invoice identifiers, amount, currency, payment status, and the terms version and acceptance time. Lava and its payment partners process payment details; our account service does not receive your full card number. Stripe and its payment partners do the same for payments in euros. To apply the right seller and tax, we also record the country you choose, the country of your card or bank as reported by the payment provider, and the country of your internet connection. We use order records to deliver the licence, resolve payment problems and refunds, and meet applicable record-keeping obligations. See our terms for the purchase arrangements.
5 Service providers and recipients
Cloudflare hosts this website, the account and licence service, and the sync and community data in D1 and R2. Cloudflare Email Service delivers moderation notices. Microsoft 365 handles support and privacy correspondence. Apple Push Notification service and Google Firebase Cloud Messaging deliver enabled notifications.
Apple and Google handle sign-in, store purchases, system speech services and the cloud features described in section 3 under their own applicable policies. Ravelry handles the data you choose to exchange with it as an independent controller. Lava and its payment partners process Russian website payments; Stripe processes payments in euros and, outside the EU, acts as reseller through Link. Those payment providers also have their own legal duties and privacy policies.
6 International transfers
Cloudflare and Microsoft operate internationally and may process website and correspondence data outside the European Economic Area. Their data-processing terms include the European Commission’s Standard Contractual Clauses; applicable adequacy decisions may also apply. We do not promise that all processing takes place in the EU. Contact privacy@tondomakers.com for information about the safeguards applying to your data. Independent services you choose, such as a store or cloud drive, explain their own processing in their privacy policies.
Ravelry receives your chosen project information and actions in the United States under its own privacy policy. Stripe and its payment partners may process payment information internationally. For the Russian payment route, we send your receipt email and order details to Lava, operated by LAVALANE LTD in Cyprus. Lava’s privacy policy describes its own processing and possible onward transfers outside the EEA, with safeguards that may include European Commission Standard Contractual Clauses. Its data-processing agreement covers processing on a customer’s behalf. These documents do not establish that every payment partner processes data only in the EU. Contact us for information about the safeguards for your transaction. The checkout identifies the payment provider before you confirm; local app use does not require a website purchase.
7 How long we keep it
- Local app content: for as long as you keep it on your device or in your own iCloud. Removing a local copy does not automatically remove a separately synced or shared copy. Use the app’s deletion controls for those copies.
- Account records and server logs: Tondo sessions expire after at most 30 days. Account deletion immediately ends account access and schedules removal of account records; it does not delete local projects or cancel store purchases. Encrypted Apple revocation data is kept until revocation succeeds. Order and payment records needed for purchase support, refunds and applicable record-keeping obligations are retained separately. Technical server logs are kept briefly for security and operation.
- Support email: for as long as needed to handle your request and a reasonable period after.
Tondo sync uploads and revision history remain until account deletion. Disabling sync or deleting a project does not permanently erase them. Removed community content becomes eligible for scheduled permanent erasure after 90 days. Photos of posts deleted by their author are erased immediately. Moderation audit identifiers remain for 730 days (2 years). Account deletion in the app immediately revokes access and queues erasure of sync and community data. Local copies remain; the separate payment, audit and support retention rules above still apply. Reports and rights claims may remain after the reported content or account is deleted; you can ask us to erase them. Removing your profile photo, or deleting your account, erases the photo from our storage and caches.
Tondo push registrations are deleted when notifications are disabled, when you sign out or when you delete the account.
8 Your rights (GDPR)
Where the GDPR applies, you can request access, correction, erasure, restriction and data portability, and object to processing based on legitimate interests. These rights depend on the circumstances. Where processing relies on consent, you can withdraw it at any time without affecting earlier lawful processing.
Contact privacy@tondomakers.com. We normally respond within one month. We may need proportionate information to verify your identity. If an extension is permitted for a complex request, we explain it within that month. We cannot retrieve content that exists only on your device.
You may complain to the Autoriteit Persoonsgegevens or your local EU/EEA supervisory authority.
10 Children
Tondo community participation requires declaring that you are at least 16 and accepting the community rules. A store age rating does not replace that requirement. Report suspected underage community use or a concern about a child’s data to privacy@tondomakers.com.
11 Changes
If we change this policy we will update this page and the date at the top. Material changes will be made clear.