Privacy

• Your phone number. It is your account, and the app does not work without it.
• Your name, and what you do, your city and your website if you fill them in.
• Your profile photo, if you add one. We keep it as two picture files, a large and a small one, without the location or other details a camera saves in a photo. We never take photos from your phone’s contacts.
• The recommendations you write, including the phone number and name you type for the person you recommend.
• Who your friends are, and the invite links you send.
• The messages you send and receive in the app, who wrote each one and when, and how far each of you has read.

To run the service we also keep the login codes we send you and whether they arrived, counters that stop one number, or one network, asking too much too fast, and the last number you looked up — that one so we can spot somebody walking through numbers to harvest the directory. Our servers, and the network in front of them, log what any web request carries, including your phone’s IP address. If the app hits an error, a report goes to our error-tracking service so we can fix it. It carries no invite code, no login code, no phone number and nothing you typed — only which request failed and how long each field was.

The app also reports crashes and counts a few actions, both through Google Firebase. A crash report carries more than the error itself: the stack trace and what every running thread was doing, your phone’s model and processor, its operating system and version, how much memory and disk space it has, whether the screen was turned, whether the app was in the background, whether the phone is rooted, the app’s version, and Firebase’s own ids for the installation and the session. Never your name and never your number. We count nine things we chose: the app being opened, a sign-in finishing, an invite being shared, an invite being opened, a recommendation being written, an expert being called, an expert being opened in WhatsApp, an account being deleted, and an invite message being written. Each of those nine is a count and nothing more — no name, no number, no text you typed. The last one also says whether the AI wrote the message or our standard text was used, and if the standard text, why (the AI switched off, at its daily limit, too slow, failing, or its message not usable).

Firebase also counts things on its own, which we do not choose and cannot switch off one by one while analytics is on: that the app was opened for the first time, that a session started, how long you were using it, and a few more like them. To those it attaches what it knows about the device — the model, the operating system, the app version, the language and the country — and its own id for that installation. We never tell it who you are, so it has no name and no number; it has an id that changes if you reinstall, and a picture of a phone rather than a person. The app you install from the stores does this. The test builds we use ourselves send no counts at all — but they do still report crashes, because a crash found in testing is the cheapest one there is.

If you allow notifications, your phone gives us an address to send them to (a push token from Google Firebase Cloud Messaging), tied to the session you are signed in with. We forget it when you sign out or delete your account. A notification tells you that somebody recommended you or wants to be friends: it carries their name and the first words of what they wrote, never a phone number, and it travels through Google to your phone. You can turn notifications off in your phone’s settings.

We never keep your contacts’ names or numbers. Only short codes that can’t be turned back into a number. To show who is already on tojeto, the app sends a scrambled form of the numbers (a hash, not the numbers themselves). To put likely experts first in the picker, and only after you agree to it in the app, it sends the details saved on each contact card (such as name, job title, company, email, website, town, and the country code of their number), never the number itself or notes. We compare them with our own list of trade words, and a third-party service, Google’s Gemini AI (on Google Cloud’s Vertex AI, in the European Union), reads them to guess each person’s trade, town, and name as you would say it, and how likely a friend would recommend them for their work. That last guess only orders your list on your own phone; our server does not keep it. We can also move all or part of this reading to OpenAI, another AI service; it then reads the same details, for the same guesses. We add three things about you, so the guesses fit you: your town and what you do, from your own profile when you have filled them in, and the country code of your number. Never your name or your number itself. The app asks first, on each phone. In the newest version, a line under every button that asks for your contacts says that an outside AI service may read your contacts’ names, job titles and other details, never their phone numbers, and tapping that button is your yes; a phone that allowed contacts before and never answered still sees “Yes, find them” at the top of its contacts list. In the version before, it tells you that we read your contacts’ details, never their numbers, to find experts, and you say yes by tapping “Yes, find them” at the top of your contacts list, or OK where the app shows the same sentence. In older versions of the app, allowing contact access where it says so is also a yes. Without the yes, nothing about your contacts goes to Google’s AI or to OpenAI, and the list puts likely experts first by the trade words in their names and job titles. Newer versions of the app find those words on your phone; older versions send the names and job titles to our server to find them, and the server keeps none of it. In each part, people already on tojeto come first, and the rest keep your phone’s own order. To withdraw the yes, turn off tojeto’s access to your contacts in your phone’s settings: nothing more is sent from the app’s next step (only a request already on its way completes), and the guesses are removed from your phone. Your contacts’ phone numbers never go to Google’s AI or to OpenAI. Our server keeps none of it: the only contact we store is one you pick, and the short codes below. The app keeps those guesses on your phone, until you sign out, so it does not ask again each time. Google keeps none of it once it has answered, unless its automatic checks flag a request as possible abuse: then it may keep that request for up to 90 days, and its staff may look at it. Google never uses them to train its models. When OpenAI does the reading instead, it keeps the request and its answer for up to 30 days to detect abuse, and never uses them to train its models. When you invite a friend, OpenAI writes the message for you, from the activities and towns of the people you recommend. Only if you have agreed to the contact reading above does it also get your friend’s name as you saved it and the country code of their number, never the number itself. If it does not answer in time, you get our standard message. When you recommend someone, OpenAI also suggests a few phrases for your note, from the activity and town you give that person and, when the app knows it, whether they are a man or a woman; never their name or number. If it does not answer in time, you get our standard phrases. OpenAI keeps what it is given for these two and what it writes for up to 30 days to detect abuse, and never uses them to train its models. We never ask your phone where you are. No advertising, and no tracking across other apps or sites.

Friends who have you too. When you allow contacts, the app also sends the scrambled form of every number in your phone, and again now and then, not only when you open the picker. Our server turns each one into a short code with a key only it holds, keeps the code and drops the scrambled form. About 57 Croatian numbers share each code, so no number or name can be read back from it, and we never try. We keep the codes with your account so that people on tojeto who have your number, and whose number you have, become your friends by themselves; they get a notification. Very rarely a code also matches someone who has your number while you don’t have theirs; if that happens, remove them like any friend. Tapping Allow on contacts is your yes to this, and the line under the button says so; if you allowed contacts before this was added, nothing is kept until you tap Connect me on the Friends tab. To stop it, turn off Connect automatically in Settings: no new automatic friends, and we delete your codes. We also delete them when you turn off tojeto’s access to your contacts, sign out or delete your account, and after 6 months without a check from your phone. Friends you already have stay until you remove them, and someone you remove never comes back automatically.

Your friends

see your full name, your city and what you do, and the people you have recommended.

Any member

can see the recommendations you write, with your first name and an initial, and can open your page from there: what you do, your city, and what others wrote about you. They see the person you wrote about by first name and initial and without a number, unless they or a friend of theirs recommended that person too, that person is their friend, or they already have the number.

Someone you recommend

sees what you wrote about their number. They see your full name if you are friends, and your first name with an initial if you are not.

Anyone who has your number

sees your name, your photo, what you do, your city, how many people you have recommended, and that you have an account with us, as soon as you open one, whether they type your number in or have it in their contacts. If somebody has recommended you, they also see how many people recommended you, and can open your page and read what those people wrote. That is how a person checks that the number they were given is the right one.

Someone you write to

sees your messages and your name: your full name if you are in their network (a friend, or someone they or their friends recommended), your first name with an initial if not. Nobody else reads them, except our team when one of you reports the conversation.

Anyone holding an invite link you sent

sees your full name when they open it, without signing in. A link can be forwarded, so treat one like anything else you send.

Your profile photo

is seen by everyone above who sees your name, and also shows in the preview of an invite link you sent.

If somebody recommends you and you would rather your number were not shown, you can hide it. People still see the recommendation, without the number. Somebody who typed your number in themselves still has it — hiding it cannot take that back.

If somebody recommends their plumber, we hold that plumber’s number and name — typed by a person who knows them, as a business contact, so that others can find them. When the person recommending them leaves the notice on (it is on by default), we send them one text message to say they were recommended and where to see it — at most a few per number, never after they tell us to stop — and we remove them on request.

If somebody writes to a person who is not on tojeto, we let that person know once: “You have a new message from” and the writer’s first name with an initial, and a link to get the app. It never contains the message itself. It goes by WhatsApp where we can, and by text message where WhatsApp cannot reach them. That is at most two such notices per number, ever, on top of the recommendation messages above; login codes that a number asks for itself are separate. When they join with that number, the conversation is theirs. A number that told us to stop gets none.

If that is you: write to us and we will remove your number, your name and the recommendations written about it.

There are two ways to delete your tojeto account:

1. In the tojeto app, open Profile › Settings, tap Delete account, and type your phone number to confirm.
2. Or email support@toje.to from any address, telling us the phone number you use for tojeto. We delete the account within 30 days.

Deleting your account happens at once and cannot be undone. Your name and everything you filled in are removed from the live service, your friendships end, and the recommendations you wrote stop being shown anywhere. Copies in our backups are deleted automatically within a limited period.

Your messages are removed from your account. The people you wrote to keep the conversation, with you shown as “Deleted account”, until they delete their account too.

One thing stays. If other people recommended your number, what they wrote is theirs: they keep the number they typed and the name they gave you. Anyone who types that number still finds their recommendations. Sign up again on the same number and the recommendations written in the last twelve months show up on the new account; older ones stay in the app but no longer attach to you. If you would rather they went, ask us and we will remove them.

Deleting your account does not reach the crash reports and counts described above. They were never tied to your account — they carry Firebase’s id for the app installation and nothing that says who you are — so there is nothing in them to find and delete by your name or number. They age out on Google’s schedule instead. Removing the app from your phone ends that id.

support@toje.to

TO JE TO Systems d.o.o., Grgura Ninskog 10, 23000 Zadar, Croatia. OIB 93140278315. The company is the data controller for everything on this page. On the App Store, the app is published by Oleksii Masnyi on behalf of TO JE TO Systems d.o.o.

Write to support@toje.to about anything here.

Your account and what you do with it

your number, your name, your profile photo, the profile fields you fill in, your friendships, the recommendations you write — to provide the service you asked for. GDPR Article 6(1)(b), performance of a contract. When someone reports you, the photo you had then is kept with the report on legitimate interest, Article 6(1)(f): keeping the service safe, as both app stores require.

Your messages

to deliver what you write to the person you write to, which is the service you asked for. GDPR Article 6(1)(b), performance of a contract. The text that tells a person not on tojeto that a message is waiting, and a report with its copy of the conversation, rest on legitimate interest, Article 6(1)(f): letting people reach an expert whose number they do not have, and keeping the service safe, as both app stores require.

The numbers, names and job titles in your contacts

legitimate interest, Article 6(1)(f): showing you which contacts are already on tojeto and which might be an expert, when you open the picker. The numbers arrive scrambled. Only once you have agreed to it in the app, the details saved on each contact card (such as name, job title, company, email, website, town, and the country code of their number), never the number itself or notes, are compared with a list of trade words and read by Google’s Gemini AI (Vertex AI, in the European Union), or, where we move all or part of the reading to it, by OpenAI, to guess a trade, a town, a clean form of the name and how likely a friend would recommend the person, with your own town, what you do (from your profile) and the country code of your number sent alongside as context; the numbers never go to Google’s AI or to OpenAI. Our server keeps none of it after the answer (the short codes below are kept, for their own reason); the app keeps the guesses on your phone until you sign out; Google keeps none of it once it has answered, except a request its automatic checks flag as possible abuse, for up to 90 days. When you invite a friend, OpenAI writes the message from the activities and towns of the people you recommend, and, only once you have agreed to the contact reading, from your friend’s saved name and the country code of their number; never the number itself. When you recommend someone, OpenAI suggests phrases for your note from that person’s activity, town and, when known, gender; never their name or number. OpenAI keeps what it is given and what it writes for up to 30 days to detect abuse.

The short codes of the numbers in your phone

your consent, Article 6(1)(a): the Allow tap, under a line that says what it is for, Connect me on the Friends tab, or turning on Connect automatically in Settings; you take it back by turning it off. For the people whose numbers they come from, legitimate interest, Article 6(1)(f): letting two people who already have each other’s numbers find each other on tojeto, with codes from which no number can be read back.

Numbers and names of people who have not signed up

legitimate interest, Article 6(1)(f). A recommendation of a tradesperson is a business contact, shared by somebody who knows them, and the service does not exist without it. When the recommender leaves the notice on, we send them that one text, respect every stop, and we remove them on request. When someone reports their page, the copy kept with the report rests on legitimate interest too: keeping the service safe, as both app stores require.

Login codes, rate counters, the last number looked up, server and network logs, error reports

legitimate interest, Article 6(1)(f) — keeping accounts secure and stopping the directory being harvested.

Crash reports and usage counts

legitimate interest, Article 6(1)(f) — knowing when the app is broken, and knowing which parts of it people use, so we can fix and improve it. Neither carries your name or your number. If you would rather not be counted at all, email us and we will tell you what we can switch off.

We do not sell your data and we do not share it for advertising. Other people using the app see what “Who sees what” describes. Beyond that, we share it only with the companies that help us run the service:

• Google Cloud — the servers and the database, in the European Union. And Gemini, Google’s AI on Vertex AI, also in the European Union: reading the details saved on your contact cards (such as name, job title, company, email, website, town, and the country code of their number; never the number itself or notes), to guess who might be an expert, in which town, how to write their name, and how likely a friend would recommend them, when you open the picker. Your own town and what you do, from your profile, and the country code of your number go with them as context. Google never uses them to train its models.
• Cloudflare — the network your requests pass through on the way to us, and the storage that keeps profile photos (Cloudflare R2).
• Meta (WhatsApp) — delivering your login code, and the notice that tells somebody not on tojeto that a message is waiting for them (the writer’s first name with an initial and a link, never the message).
• An SMS provider — delivering your login code when WhatsApp cannot, and the texts that tell somebody not on tojeto that a recommendation or a message is waiting, when WhatsApp cannot reach them.
• Sentry — the error reports, and a sample of timing data about how the service is performing.
• Slack — a short alert to our team when something is reported, so it is read within a day. For a reported recommendation it carries the note, the reason the reporter gave, the reporter’s first name with an initial and the expert’s number with most digits hidden; for a reported message, only the reason and a link to the report, never the messages, a name or a number.
• Google (Firebase) — crash reports through Crashlytics, the nine counts through Google Analytics for Firebase, and notifications to your phone through Firebase Cloud Messaging (on an iPhone, through Apple too), including the sender’s name and the first words of a message.
• OpenAI — writing your invite messages: from the activities and towns of the people you recommend, and, only after you agree to the contact reading, the friend’s name as you saved it and the country code of their number (never the number itself). And suggesting phrases for your note when you recommend someone: from that person’s activity and town, and their gender when the app knows it (never a name or a number). And, where we move all or part of the contact reading to it from Google’s AI, reading the same contact details, with the same context, for the same guesses. It never uses them to train its models.

Each of them is under a contract that binds them to protect your data under the GDPR.

Our servers, the database and the Google AI we use are in the European Union. Some of the companies above sit outside it, or have a parent company that does. Where data leaves the EU, it travels under the standard contractual clauses the GDPR provides for.

Your data for as long as you have an account. The short codes of your contacts until you turn off Connect automatically, turn off contact access, sign out or delete your account, or after 6 months without a check from your phone. A non-member’s number until they ask us to remove it. When someone reports the page of a person who is not on tojeto, we keep a copy of that page as it was then with the report: the number, and the newest recommendations on it (up to 100), each with the name of the person who wrote it. Only our support team sees it. The copy is deleted 90 days after we close the report, also if someone who wrote one of those recommendations deletes their account in the meantime; the report itself, with the reason and what we did, stays. A login code stops working after ten minutes, and it and the record that we sent it are deleted automatically after a fixed period (currently 30 days). The same goes for the counters kept against your number and the last number you looked up. The counter kept against part of a network address is not on that sweep yet. Server and network logs are held by our hosting and network providers and deleted on their own schedule.

Messages are kept for as long as someone in the conversation still has an account. When both people have deleted their accounts, or the writer has deleted theirs before the person they wrote to joined tojeto, the conversation is closed and deleted within 30 days. When one of you reports a conversation, a copy of it is kept with the report until 90 days after we close the report. The alert our team gets about a new report carries only the reason and a link to it, never the messages or anyone’s name or number. For a person not on tojeto, we keep a record that we notified their number about a message, so that we never send more than two.

Your profile photo until you replace it, remove it or delete your account; then it is deleted. A copy that a phone or browser already fetched can stay for up to a day, and a link preview in a chat for as long as that chat keeps it. If someone reports you, the photo you had then stays with the report, seen only by our support team, until 90 days after the report is closed — also if you delete your account in the meantime.

Crash reports and counts sit with Google, and Google deletes them on a clock. Firebase documents that Crashlytics keeps crash data for 90 days before it starts removing it from live and backup systems; that one is fixed and not ours to change. For the counts, the period is a setting on our own Google Analytics property — 2 months or 14 months for the event-level and user-level records — after which Google deletes them. Google’s own aggregated totals are not covered by that setting and are not deleted with them.

Google’s Gemini AI keeps nothing of the contact details it reads once it has answered: we have switched off the cache Google would otherwise keep for up to 24 hours. Only if Google’s automatic checks flag a request as possible abuse of its service may Google keep that request, for up to 90 days, so that its staff can check whether its rules were broken. It never uses them to train its models. Deleting your account cannot reach such a request. Those are Google Cloud’s standard terms, on its pages about caching and data retention and abuse monitoring.

OpenAI keeps what it is given to write an invite and the message it writes, what it is given to suggest note phrases and the phrases it suggests, and, when it does the contact reading instead of Google, the contact details it reads, your own town, what you do and your country code sent with them, and what it guesses, for up to 30 days, to detect abuse of its service, unless the law requires it to keep them longer or keeping them longer is needed to protect its service or others from harm. It never uses them to train its models. That is OpenAI’s standard term for its API. We also switch off OpenAI’s option to keep its answers for later use; that switch does not shorten the 30 days. Deleting your account does not reach what OpenAI keeps either.

Deleting an account takes effect at once in the live service. Copies in our backups are deleted automatically within a limited period.

You can ask us for a copy of what we hold, a correction, deletion, a copy in portable form, or restriction of processing. Where we rely on legitimate interest — the section above — you can object, and that includes anyone whose number is in the app without an account. Write to support@toje.to.

You can also complain to the Croatian Personal Data Protection Agency (AZOP), azop.hr.

No advertising, and no automated decisions about you. What the app does with AI we say plainly here: to sort your contacts, it guesses a contact’s trade, their town, their name as you would say it and how likely a friend would recommend them, from the details you saved on their contact card (such as name, job title, company, email, website, town, and the country code of their number; never the number itself or notes), with your own town, what you do (from your profile) and your country code as context. The guess is shown only to you and kept by the app on your phone until you sign out, unless you use it: when you recommend that person, the trade, town and name it filled in become part of your recommendation, which you can change before you save it, and which others may see like any recommendation. It decides nothing about that person. The app also uses AI to write the invite message you send a friend, from the activities and towns of the people you recommend, and, after you agree to the contact reading, the friend’s saved name and the country code of their number. You see the message before you send it, and can change it. When you recommend someone, it also suggests a few phrases for your note, from that person’s activity, town and, when known, gender. You choose whether to use one, and can change the note before you save it.

tojeto is not for people under 16. If a younger person has signed up, tell us and we remove the account.

The date at the top changes when this page does. The app links here instead of carrying its own copy, so what you read is what applies.