Privacy Policy

Tomorrow (“we”, “us”, “our”) is the data controller for personal data processed in connection with the Tomorrow mobile app and this marketing website. For privacy questions or data requests, contact Show email address.

Website. If you join the waitlist, we collect your email address, the time of signup, and optionally your browser user agent. We use Cloudflare Turnstile to reduce spam; that check may involve your IP address and limited device signals. We use waitlist data only to notify you about launch and product updates.

App. When you create an account and use Tomorrow, we may process: account data (email, display name, avatar) via Firebase Authentication; voice audio you record, transcripts, and AI-extracted tasks, events, and plans; preferences (language, reminder settings, timezone); and device identifiers used for push notifications.

We do not sell personal data. We do not use your voice content to train third-party AI models beyond what is necessary to provide the service under our processors’ terms.

Where the EU General Data Protection Regulation (GDPR) applies, we process personal data on these bases: Contract performance — to create your account, process voice notes, build your plan, and deliver the service you requested. Consent — waitlist emails on this website; you can unsubscribe or ask us to delete your address at any time. Legitimate interests — securing the service, preventing abuse, debugging, and improving reliability, balanced against your rights. Legal obligation — where we must retain or disclose data to comply with applicable law.

We use trusted service providers who process data on our behalf: Firebase / Google (authentication and account identity); OpenAI (speech transcription and structured extraction of tasks and plans from your notes); Cloudflare R2 (storage of voice audio files); Cloudflare Turnstile (bot protection on the website waitlist form — may process IP address and browser signals); SendFox (waitlist email storage and marketing sends); and hosting providers for API and website infrastructure.

These providers process data under their own terms and data processing agreements. They may only use your data to provide services to us, not for unrelated purposes.

Some processors are based in the United States or other countries outside the European Economic Area (EEA). Where we transfer personal data from the EEA/UK/Switzerland, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (SCCs) and/or the EU–US Data Privacy Framework for certified organizations, together with any supplementary measures required by law.

We keep account, audio, transcript, and plan data while your account is active so we can provide the service. If you delete your account in the app (Settings → Delete account) or request deletion by email, we soft-delete your account so it is no longer accessible and revoke your sessions. Associated audio files and backups are purged within approximately 30 days, except where we must retain limited records for legal, security, or accounting reasons.

Waitlist emails are kept until we notify you about launch (or earlier if you ask us to remove them). Server logs may be retained for a short period for security and operations.

If you are in the EEA, UK, or Switzerland, you have the right to: access the personal data we hold about you; rectify inaccurate data; erase your data (“right to be forgotten”); receive a copy of your data in a portable format; restrict or object to certain processing; withdraw consent where processing is based on consent; and lodge a complaint with your local supervisory authority.

You can delete your account and associated data directly in the app under Settings → Delete account. For data export or other requests, email Show email address. We will respond within the timeframes required by applicable law (typically within 30 days).

Tomorrow is not directed at children under 16. We do not knowingly collect personal data from children under 16. If you believe a child has provided us data, contact us and we will delete it.

This site uses Google Analytics to measure visits. Google may set cookies (such as _ga) and receive usage data, including pages viewed. We may also use privacy-friendly first-party analytics (Vercel Analytics). Fonts are self-hosted. Essential server logs may record IP addresses for security and reliability. The iPhone app may use platform push-notification SDKs; those are governed by Apple and Firebase policies as well.

We may update this policy as the product or law changes. The “Last updated” date at the top will change when we do. Continued use of Tomorrow after an update constitutes notice of the revised policy for existing users; material changes will be highlighted where practical.

Privacy and data requests: Show email address. General contact: Show email address. See also our Terms of Service.