Your assistant.
Not everyone’s recorder.

Account and consent records; preferences, goals, confirmed reminders, connected calendar information, wearer-attributed requests and responses; permitted location and sensor data; device status; and optional safety, support, or research records. Information about health, routines, and relationships may be sensitive.

Tombi is designed to exclude other people’s speech from retained personal assistance records. Release-specific notices will explain the information used by each feature, the choices available to you, and applicable retention terms.

No such promise is made. A consented test build may keep personal-context records in the cloud with authorized staff access. The planned standard service keeps the assistance record primarily on the phone, while some speech and AI functions may still use cloud processors. Your release notice must explain which arrangement applies.

Deliver requested assistance, manage confirmed reminders, answer questions, apply preferences, connect devices, support the account, and maintain security and reliability. Research, cross-user learning, and other secondary uses require separately disclosed authorization where required. Accepting the service does not by itself authorize those uses.

Service providers may process information needed for enabled functions. Authorized staff may access information for disclosed test, support, security, or research purposes. Trusted people see only permitted categories; buying the device or helping with setup does not automatically grant access. Conversations are excluded from the proposed trusted-person view. The draft prohibits selling personal information and using it for cross-context behavioral advertising; provider arrangements must support that commitment.

The feature plan proposes one year of personal conversation history. The policy draft still requires a final schedule for transcripts, summaries, audio buffers, research data, location, logs, backups, and deletion from disconnected devices. These are different data types, not one blanket retention period. No final deletion deadline or zero-retention vendor promise is asserted on this preview.

The proposed controls cover access, export, correction, deletion, connected sources, and individual sharing permissions. Optional research has its own consent and withdrawal process. Removing data needed for a feature may disable that feature. Request channels and release-specific app controls must be published before use.

Research may involve additional raw signals or audio only under a separate, specific authorization with collection and deletion dates. A testing window is not permission to retain information indefinitely. Pseudonymous data can still identify someone and must be treated accordingly.

The service is intended for adults. Health-related information requires appropriate sensitive-data handling; consumer use alone does not establish HIPAA coverage. Security controls and incident procedures must match the actual release. This preview claims neither perfect security nor an independent certification.

The responsible legal entity and privacy contact; actual processors and processing locations; the final retention and deletion schedule; verified security controls; applicable state and consumer-health notices; permission flows; and the effective date. A change in policy must not silently authorize a new sensitive use.