Privacy Policy

1Who we are

Tammoum is a mobile task assistant published by Tammoum, based in Amman, Jordan. In this policy, "we", "us" and "Tammoum" mean Tammoum, and "you" means the person using the app.

Tammoum is the data controller for the personal data described here. If you have a question about any of it, write to privacy@tammoum.com and a person will answer.

2What we collect

We collect four kinds of data, and nothing beyond them.

• Account data — the email address you sign up with, a securely hashed password, your display name, and your date of birth if you choose to add one to your profile. We need this to have an account to give you at all.
• Your content — the tasks you create, their titles, notes, times, categories, and any photos or files you attach to them. This is yours. We store it so it is there on your next device.
• Voice recordings — only while you are actively recording, and only so the recording can be turned into text. See the voice section below, which is the important one.
• Calendar data — if, and only if, you grant calendar access: the title, time and participants of upcoming events, so Tammoum can show you what is coming and offer to turn it into a task.
• Technical data — the app version, device model, operating system version, and crash reports. This tells us that a build is broken before you have to tell us.

3Voice, specifically

Tammoum records only while you are holding the voice button or while it is listening after you tapped it, and it shows you clearly on screen when that is happening. Nothing is recorded in the background, and the microphone is never opened without a deliberate action from you.

The recording is sent to our server and to a speech-to-text provider, converted to text, and then deleted. We do not keep the audio after transcription, we do not use it to train any model of ours, and we do not permit our providers to use it to train theirs.

The resulting text is treated exactly like a task you typed: it is your content, and the retention and deletion rules below apply to it.

You can use every part of Tammoum without ever granting microphone access. Voice is a shortcut, not a requirement.

4Calendar, specifically

Calendar access is optional and is asked for at the moment it would actually be used, not at launch. If you decline it, Tammoum simply never mentions your meetings.

If you grant it, we read a rolling window of upcoming events so the app can surface them and offer to create tasks from them. We do not write to your calendar without you asking us to, we do not read past events beyond that window, and we never read the contents of meeting attachments.

5Notifications

Reminders are scheduled on your device by the operating system. The text of a reminder is composed on the device from your own task, and the content of your reminders is not sent anywhere.

We ask for notification permission at the point you first set something that needs a reminder, and never at first launch.

6How we use it

• To run the service — showing your tasks, syncing them between your devices, and reminding you.
• To keep accounts secure — detecting credential-stuffing, abuse, and fraud.
• To fix what is broken — diagnosing crashes and errors from technical data.
• To answer you — if you write to support, we read what you sent us.
• To meet legal obligations — tax, accounting, and lawful requests we are actually required to comply with.

We do not sell your personal data, we do not share it with advertisers, and we do not use the contents of your tasks to target anything at you.

7Legal bases

Where the GDPR or a comparable law applies to you, we rely on: performance of a contract (running the service you asked for); your consent (microphone, calendar, and notifications, each of which you can withdraw in your device settings at any time); our legitimate interests (security, fraud prevention, and fixing defects); and legal obligation, where one exists.

8Who we share it with

Only with service providers who need it to make the app work, and only to the extent they need it. Each one is bound by a contract that limits them to acting on our instructions.

• Cloud hosting and database providers, who store the service and your content.
• A speech-to-text provider, which receives a recording and returns text, under terms that forbid retention or training.
• Crash and error reporting, which receives technical data about a failure.
• Email delivery, for account emails such as verification and password resets.
• Law enforcement or a regulator, where we are legally compelled — and we will tell you unless we are legally forbidden from doing so.

9International transfers

Our providers may process data outside your country. Where that happens and the law requires a safeguard, we rely on Standard Contractual Clauses or an equivalent mechanism.

10How long we keep it

• Voice recordings — deleted immediately after transcription.
• Your tasks and attachments — for as long as your account exists, and then per the deletion timeline below.
• Account data — for as long as your account exists.
• Technical and crash data — up to 12 months.
• Records we are legally required to keep (for example accounting records) — for the period the law sets, and no longer.

11Your rights

Depending on where you live, you have some or all of the following rights, and we honour all of them for everyone regardless of where they live: to access your data, to correct it, to delete it, to get a portable copy of it, to object to or restrict processing, and to withdraw a consent you gave.

You can delete your account and everything on it from inside the app at Settings → Account → Delete account, or through the request form on this site. For anything else, write to privacy@tammoum.com and we will answer within 30 days.

If you are in the EEA or the UK and you think we have got this wrong, you have the right to complain to your local supervisory authority.

12Deletion timeline

• Your account stops working the moment you confirm deletion.
• Your tasks, attachments and account record are erased from our live systems within 30 days.
• Encrypted backups roll off within 90 days at the outside.
• Anything we are legally obliged to keep is kept, and nothing else is.

13Security

Data is encrypted in transit with TLS and at rest by our hosting providers. Passwords are stored as salted hashes and never in a form we can read. Access tokens are short-lived and refresh tokens rotate on every use. Access to production systems is limited to the people who need it.

No system is perfect. If we suffer a breach that puts you at risk, we will tell you and the relevant regulator within the time the law allows.

14Children

Tammoum is not intended for children under 13, and we do not knowingly collect data from them. If you believe a child has given us data, write to us and we will delete it.

15Changes to this policy

If we change this policy in a way that matters, we will tell you in the app before the change takes effect, not after. The date at the top of this page is always the date of the current version.

16Contact

Privacy questions: privacy@tammoum.com. Anything else: support@tammoum.com. Postal address: Amman, Jordan.