Tondo Privacy Policy

Effective date: October 10, 2026

Doctorsfit ("we") provides Tondo, a photo filter and editing app for iOS and Android (the "App"). This policy explains what information the App handles, what it does not, and what leaves your device.

1. Summary

There is no sign-up, and we do not operate any server or database.
Photo editing and AI Select analysis run entirely on your device. Your photos and face information are never sent to us or to any third party.
On Android, the Google MediaPipe library used by AI Select may send usage statistics (not photo content) to Google (section 4-2).
Payments for Tondo Pro are processed by the Apple App Store or Google Play (section 4-1).
There are no ads, no advertising identifiers, and no analytics tools operated by us.

2. Information we do not collect

Account information such as name, email or phone number (no sign-up)
The content of your photos or face information
Location, contacts, calendar, camera or microphone
Advertising identifiers or behavioral data

3. Information handled on your device

Item	Details	Where	Retention
Photos you select	Read for editing and AI Select analysis. Temporary copies made by the photo picker are kept briefly in the app cache and deleted automatically. To let you reopen your work, a copy of the photos, the edit state and a cover image are kept inside the App (edit sessions).	App storage on the device (edit sessions are excluded from cloud backup and device transfer)	Until you delete them, or automatically when the count/storage limit in Settings is exceeded (oldest first). Removed when the App is deleted
Edited photos	Saved as new photos; originals are never changed.	iOS Photos library / Android "Pictures/Tondo" album	Until you delete them
AI Select results	Sharpness, exposure, face, open-eye and composition scores, and similarity values between photos, calculated on the device and shown on screen.	On the device	Removed when the App is deleted
Settings, recipes, favorites	Adjustments you saved and display preferences	App storage on the device	Until you delete them or the App
Purchase status	Whether you own Tondo Pro (the result of checking the store's purchase record)	On the device	Until the App is deleted (the store keeps its own purchase record in your store account)

This information stays on your device and is not sent to us.

4. Information that leaves your device

4-1. Payments

Tondo Pro (a one-time purchase) is paid through the Apple App Store or Google Play billing system. Payment details such as card numbers are never shared with us; each store's privacy policy applies. The App communicates with the store to check whether you own Tondo Pro.

4-2. Android — Google MediaPipe usage statistics

On Android, AI Select uses Google's MediaPipe library to find faces, check open eyes and compare photo similarity. The analysis runs on the device and photos and face information are not sent (the transmitted fields contain no photo or face content). However, under the MediaPipe APIs Terms of Service, MediaPipe may send usage statistics such as the following to Google when you use AI Select:

App information: app identifier (package name), app version, MediaPipe version, task name
Usage and performance: start/call/end/error events, start latency, average and maximum processing time, elapsed time, skipped count, counts by input type, error codes
Device and environment (added by Google's transport component): network type, device model, manufacturer and hardware, OS build, language, country and time zone, carrier code
The connection IP address, which reaches Google's servers as part of any network communication

Google uses this information to measure MediaPipe's performance and usage, to debug and maintain it, and to detect misuse, and processes it under the Google Privacy Policy. The App has no setting to turn this transmission off, and it tells you about it on the AI Select start screen. The iOS version uses Apple's on-device Vision framework and makes no such transmission.

5. App permissions

iOS — Photos: selecting photos to edit, saving edited photos, and deleting rejected photos from AI Select after you confirm (through the iOS confirmation dialog; they go to Recently Deleted and can be recovered)
Android — Internet and network state: checking purchases with Google Play, and the MediaPipe usage statistics in section 4-2
Android — Google Play billing: buying Tondo Pro
Android — Vibration: haptic feedback when you interact with the App
Android — Storage: used only on Android 10 and below, to save edited photos to the "Pictures/Tondo" album
On Android 11 and above, the App reads only the photos you pick in the system photo picker, without any photo-access permission. Rejected photos from AI Select are deleted only after you confirm in the App and allow it in the system dialog; they are moved to the trash and can be recovered.

6. Sharing, processors and international transfer

We do not collect your personal information, so we do not provide it to third parties or entrust its processing to anyone. Payments (Apple, Google) and MediaPipe usage statistics (Google LLC, USA) described in section 4 are handled by those companies under their own policies, and usage statistics may be transferred to Google servers outside your country.

7. Your rights

You can delete the information inside the App at any time through Settings (e.g. "clear all") or by deleting the App.
We do not keep any information that identifies you. Please send any privacy questions or requests to the contact below.
For MediaPipe usage statistics sent to Google, you can exercise your rights as described in the Google Privacy Policy.

8. Children

Tondo is not directed to children under 13. We do not collect personal information from any user, and we do not knowingly collect children's personal information.

9. Changes

If this policy changes, we will update the effective date and post it on this page. Significant changes will also be announced with an app update.

10. Contact

Business: Doctorsfit (닥터스핏)
Representative & privacy officer: Jaedeok Seo (서재덕)
Email: drsfit@doctorsfit.kr