Privacy Policy

Last updated: October 27, 2026

ToMoreNow is a goal-coaching app that runs on your phone. This policy explains what that means in practice, including the places where it is not absolute. The beta program, including the waitlist on this website, has its own Beta Program Privacy Policy.

The app does not send us your data. There is no account, no sign-in, and no ToMoreNow database anywhere but your own device. We cannot read your goals or your conversations with the coach, because they are never sent to us. If you join the beta program, what you choose to give us there is described in the Beta Program Privacy Policy.

Four things can leave your phone, and each is described below: the request that downloads the coach's AI model, an anonymous usage summary that contains no identifiers and none of your words and that you can switch off, a question about your goal that you choose to copy to another assistant, and a file you choose to export yourself.

What the app stores on your device

Your goals, the actions you log, the notes you add, any workouts you record (exercises, sets, reps and weights, and for runs and rides the time and distance), the full text of your conversations with the coach, the coach's summary of your history, and your settings. All of it is held in a database on your phone and is removed when you delete the app.

The coach also keeps a few things it works out from what you write, on the phone only: a profile of how you write to it (message length, and how often you use lowercase, emoji or exclamation marks, as numbers, never the text), short phrases you put in quotes or names you coin for things, and the tone of your latest message, as one of a few fixed labels it uses to match your energy for a day. Settings → What the coach has picked up lists the phrases and lets you delete each one; deleting a phrase also removes every line of the coach's summary that mentions it.

The app also records, for its own use on your phone, when you change a goal's target or date, a weekly note of where each goal stands, and whether a reminder was tapped. These are dates and numbers, never text, and they are not sent anywhere.

If you switch on Incident telemetry in Settings — it is off unless you turn it on — the app also records, on your device only, that the crisis card appeared, and each time a note you add while logging reads as a hard moment or calls something "pointless": a timestamp and a flag, never the note itself. It records no message text, no goal, and nothing that identifies you. These rows stay on the phone and are included in your export.

What the coach is, and where it runs

The coach is an AI model that runs on your phone. Your messages are processed on the device and are not sent to us or to any other company for processing.

On phones that support Apple Intelligence, the app uses Apple's on-device Foundation Models. On other phones, the app downloads an open-source model (Gemma 3) once and runs it locally. On some Android phones, Settings also offers a larger open-source model (Gemma 4) as a choice; it runs on the phone in the same way.

When setting up a goal, the coach can look up a handful of general facts, such as how long a beginner training plan usually runs. In this version those answers come from a short list bundled inside the app, so the lookup sends nothing anywhere. A version that searches the web exists in the app's code but is not switched on. If it is switched on in a future version, it will only ever send a search phrase you have read and approved, and this policy will say so, with a new date, before that happens.

Asking another assistant for a plan. A goal's chat can offer a step-by-step plan drafted by another assistant. If you take it up, the app writes a short question (your goal's title, what finished means, its start and end dates, and for some kinds of goal a line saying what kind of coach to ask) and puts it on your clipboard or your phone's share sheet. The app sends it nowhere itself: it leaves your phone only if you paste or share it into an assistant you choose, and from then on that assistant's own privacy policy applies. It never includes your notes, your reasons, or anything from your conversations. When you paste the answer back, the app reads it on the phone, shows you the steps, and saves only the ones you keep.

Speaking to the coach, and hearing it

You can tap the microphone to speak instead of typing. Your speech is turned into text on your phone. The app only offers the microphone on phones that can do this without sending your voice anywhere, so on some phones it does not appear. What you said appears in the message box for you to check and change. Nothing is sent to the coach until you tap Send, and then it is treated exactly like a message you typed. No recording of your voice is made or kept.

The app asks for microphone access the first time you tap the microphone, not before. You can turn it off in your phone's settings at any time; you can still type.

You can also have the coach's replies read aloud. This uses your phone's own built-in voice. On Android, the app chooses a voice that runs on the phone rather than one that works over the internet, where the phone offers one.

One download your phone may make. On some Android phones, speaking to the coach needs Android's English speech model, and Settings offers to download it. If you tap that, Android downloads the model from Google, the same way it downloads its other system components. The app sends nothing with that request, and nothing about you or your goal, but Google sees the request and your phone's internet address, as with any download, under Google's own privacy policy. Nothing is downloaded unless you tap the button.

Your calendar

If you ask the coach to schedule sessions for a goal, the app asks for calendar access at that moment, not before. It reads only when your existing events start and end, so it can suggest free slots. It never reads titles, locations, attendees or notes, and none of it leaves the phone. It writes to your calendar only when you confirm a suggested slot, and you can remove that event like any other. You can withdraw calendar access in your phone's settings at any time; the rest of the app is unaffected.

Health data

The app does not connect to Apple Health or Health Connect and does not read your phone's health store. Workouts you log inside the app are fitness data you typed in yourself; they stay in the app's database on your phone, leave only in your own encrypted export, and are never sent to us.

The one thing the app downloads

If your phone needs a downloadable model, the app fetches a file from our content host, Cloudflare R2: about 555 MB for Gemma 3, or about 2.6 GB if you choose Gemma 4 on Android. Like any web request, that request includes your device's IP address, which our host may record in its server logs. The request contains nothing about you, your goals or your conversations — it asks for a file, and that file is the same for everyone. Those logs are retained under Cloudflare's own policy.

If your phone runs Apple's on-device model, the app downloads nothing. The only other thing the app can ever send is the anonymous usage summary described below.

Notifications

If you allow notifications, the app schedules reminders on your device. They are not sent from a server, we do not use push notifications, and we never receive a notification token. Notifications work with the phone in airplane mode. You can turn them off in your phone's settings at any time; the app still works, and the coach still speaks when you open it.

Anonymous usage statistics

The app can send us a small, anonymous summary of how it is being used. We use it to see which parts of the app help and which get in the way. It is controlled by the Anonymous usage statistics switch in Settings.

Where this is on by default, and where it is not. It is on unless you turn it off, and it is the only thing in the app that works that way — except in the European Union, the European Economic Area, the United Kingdom, Switzerland, the Crown dependencies, Gibraltar, the Faroe Islands and Greenland, where it is off unless you turn it on. The app works out which applies from your phone's timezone and region settings, on the phone. The first-run screen tells you which applies to you. Turning the switch off stops the next summary and discards anything waiting to be sent. The app works exactly the same either way, and nothing about your coaching changes based on it.

What it contains. Counts, yes/no answers and dates, bucketed so that no single summary is distinctive:

• When you set up a goal: which screens you reached, roughly how far through the questions you got, whether a goal came out of it, the kind of goal (one of five broad categories) and the month.
• When a goal ends: how long it ran, how it ended, how many goals you had going at the time (one, two, or three or more), and whether any note you added while logging or recording a slip read as a hard moment or called something "pointless". That last value is only ever "none", "some" or "unknown" — never how many, never which note, and never any of your words. The app works it out on your phone and sends only the answer, and it says "unknown" unless Incident telemetry was also on for the whole of that goal.
• Once a week: how long the app's built-in AI took to answer, as how many replies arrived within each second and how many took too long, together with which engine and model file your phone ran. Never what was asked or answered, and never when.

What it never contains. Your name, your goal titles, your notes, anything you or the coach said, your location, or any device, installation or advertising identifier. There is nothing in it that identifies you or your phone, and nothing that links one summary to another. The app checks every summary against these rules immediately before sending and refuses to send anything that fails them. Because we cannot tell which summaries came from which phone, we also cannot trace one back to you, or delete "your" summaries on request.

Where it goes. To a small service we run, which stores the summaries without your IP address and deletes them after thirteen months. In the current beta version, that service is not yet connected: the app has no destination configured, so no summary is sent even with the switch on. Before a version that does send them is released, this policy will be updated with a new date to say so.

Exporting your data

You can export your data to a file. The file is encrypted with a passphrase you choose, using AES-GCM with a scrypt-derived key, and it is handed to your phone's standard share sheet so you can put it wherever you like — a cloud drive, a message to yourself, another phone. You can import it into ToMoreNow on another phone with the same passphrase.

Two things follow from that. We never see the file, and we cannot recover it: if you forget the passphrase, the export cannot be decrypted by anyone, including us. And once you place it somewhere, that service's privacy policy applies to it.

Settings also offers Share beta metrics, a small file of counts about your use of the app with no text in it. It is not encrypted because there is nothing private in it, and it goes nowhere unless you choose to share it. If you are a beta tester and send it to us, the Beta Program Privacy Policy covers what we do with it.

Backups

The app asks your phone to exclude its data from automatic cloud backups, on both platforms, so that your goals and conversations are not copied into iCloud or Google's backup, and neither is the downloaded coach model.

The trade is worth knowing: if you lose your phone, that data is gone with it. The export described above is how you keep a copy, and it is deliberately something you do rather than something that happens to you.

What we do not collect

We do not collect crash reports, advertising identifiers, device identifiers, installation identifiers, location, contacts, recordings of your voice, or data from your phone's health store. The app contains no advertising, no analytics software from anyone else, and no third-party tracking of any kind. We do not sell your data, and we do not share it with third parties for their own purposes.

We do not collect your goals, your notes, or anything you said to the coach — those stay on your phone. The only thing the app can ever send us is the anonymous usage summary described above, only while that switch is on, and only once a version that sends it is released.

Crisis resources and medical disclaimer

The app includes a safety feature that shows crisis helpline information when certain phrases appear in a message. This runs entirely on your device: the detection is a fixed list of words checked on the phone, and no one is notified.

ToMoreNow is not a medical or mental-health service and is not a substitute for professional care, diagnosis or treatment. If you are in crisis, contact your local emergency services. The crisis resources listed in the app are United States services, and this beta is scoped to the United States.

Children

ToMoreNow is not directed to children and is not intended for anyone under 18. We do not knowingly collect information from children. The beta program, including its waitlist, is for adults only; see the Beta Program Privacy Policy.

Your rights

Privacy laws including the GDPR and CCPA give you rights to access, correct, export and delete your personal data. Because your data exists only on your own device, you exercise all of these directly: view and edit it in the app, export it from Settings, delete phrases the coach has picked up from Settings, and delete everything by removing a goal or deleting the app. We hold nothing to hand over. The anonymous usage summary cannot be attributed to a person, so there is nothing for us to delete on request. If you are in the beta program, what we hold about you there, and how to see, correct or delete it, is in the Beta Program Privacy Policy.

Changes

If this policy changes, the new version appears here with a new date, and material changes will be noted in the app.

Governing law

This policy, and any dispute arising from your use of the app, is governed by the laws of the United States.

Contact

tomorenowapp@gmail.com — Sunya Innovations LLC.