Toll privacy policy

Last updated: 11 November 2026

Toll is made by Not My First Codeo Ltd, a company registered in England and Wales (company number 14592589, registered office 167-169 Great Portland Street, 5th Floor, London, W1W 5PF). We’re the data controller for the information described here. Questions or requests: hello@tollhq.app.

This policy covers the Toll app and this website. It also covers test builds of Toll installed through Apple’s TestFlight app.

The short version

• Toll makes an account for you when you first open it, and backs up your library to Toll’s server under it: your topics, cards and questions, the line each card came from, your answers, tolls, coins and settings. The files you add, such as photos and PDFs, never leave your iPhone.
• Signing in is optional. If you sign in with your email address or with Apple, you can get your library back on a new iPhone.
• When you add notes: Toll reads the text on your iPhone; photos and PDFs never leave it. The text goes to Toll’s server and to Anthropic, the company behind Claude, to write questions, and it’s never used to train AI; Toll keeps the questions and the line each one came from, not the rest of your notes. Don’t include patient details or anything that identifies a person.
• We never see which apps you put a toll on or how you use them, unless you send us your Toll log with feedback. Apple’s Screen Time gives Toll anonymous tokens rather than app names, and they never leave your iPhone. Your backup records when you paid a toll, never which app it was for.
• The app sends anonymous usage events so we can see whether Toll works. They never include the content of your notes or questions, or which apps you’ve tolled.
• The app checks with RevenueCat whether you have Toll Pro, under your account ID. If you buy it, Apple takes payment and RevenueCat records your subscription.
• If you send feedback from the app, it comes to us by email and isn’t stored on our server. Your Toll log goes with it only if you tick the box.
• You can delete your account and your library’s backup in the app: You → Delete my data.
• Our website counts visits without cookies and without storing anything on your device, and you can turn that off.
• No ads in the app, no tracking across other apps or websites, and we never sell your data.

What stays on your iPhone

• The files you add: photos, scans and PDFs, and their file names
• The apps you’ve chosen to toll, stored as Apple’s Screen Time tokens
• What Toll works out from your answers, such as which cards are due

This data isn’t sent to us, unless you choose to send your Toll log with feedback (see below). Deleting Toll deletes it.

What we collect

Your account (in the app) When you first open Toll, it makes an account for you, so it can back up your library. Until you sign in, it has no email address or name. It’s also your ID with RevenueCat, which manages Toll Pro (see below). Supabase, which runs our backend, records the IP address and device type of your account’s sign-ins, for security, and we clear them after 30 days. Its own logs keep the IP address of each request for 7 days. Our lawful basis is our legitimate interest in keeping accounts secure.

Signing in is optional. If you sign in with your email address, we send you a 6-digit code through Resend and keep your email address with your account. If you sign in with Apple, Apple gives us an ID for you and, if you choose to share it, your email address, which can be a private address that forwards to yours. We don’t ask Apple for your name. We also keep a token from Apple, only so that Delete my data can end Toll’s access to your Apple Account. We use your email address only to sign you in. Our lawful basis is our contract with you.

If you never sign in, we delete your account and everything in it 12 months after the app last used it; if your iPhone still has your library, the app backs it up again next time. If you’ve signed in, we keep your account until you delete it, or until 24 months after you last used Toll.

Your library’s backup (in the app) Toll backs up your library to its server as you use it, so it’s safe if you lose your iPhone and can come back on a new one. The backup holds:

• your topics, and the things you’ve added: each one’s name, which Toll takes from its content and never from the file name, and a fingerprint of the file, so the same file isn’t added twice
• your cards, their answers and questions, and the line each card came from, with where it was (a page, a slide, a time or a row)
• each answer you give: what you typed or picked, whether it was right, how long it took and the app version
• your tolls (when each began and ended and how it ended, never which app it was for) and your coins, with the time zone you were in for each answer, toll and coin
• your flags, exam dates and results, the answers you’ve marked as right, and your settings
• the packs you follow; Toll’s own packs aren’t copied into your backup
• the devices that use your account: the kind of device, the app version and when it last backed up

It never holds the files you add, the rest of your notes’ text, or the apps you’ve tolled. When you delete something in Toll, the backup marks it as deleted, so your other devices know; it’s removed for good when your account is. It’s stored by Supabase in London. On its way there it passes through our front door at api.tollhq.app, run by Cloudflare, and our server, run by DigitalOcean in London. Our lawful basis is our contract with you: backing up your library is part of how Toll works, so the app needs the account, but you don’t have to sign in. We keep the backup with your account, for as long as we keep your account (see above).

If you join the waitlist (on our website) Your email address, your answers to the sign-up questions (what you’re working towards, which app takes your time, your iPhone and iOS version) and which link brought you to us. We use this to invite you to try Toll before it’s on the App Store, and to decide what to build first. We send you an email to confirm you’ve joined and, when we invite you, an email with a link to install a test build; we record when we sent your invite and which group of testers it was for. Our lawful basis is your consent. We keep it until Toll is on the App Store for everyone or you ask us to remove you, whichever comes first. Every waitlist email we send has an unsubscribe link: using it removes your email address and answers straight away.

If you visit our website We count page views and a few actions, such as pressing the sign-up button, to see which parts of the site work. We use PostHog in cookieless mode: nothing is stored on your device, and your IP address is used only to tell one visit from another and is then discarded, never stored. We don’t identify you or follow you to other websites. Our lawful basis is our legitimate interest in understanding how our website is used. This data expires after 12 months, and PostHog deletes it after that. You can turn it off for your browser with the button at the end of this page.

Cloudflare, which hosts the website, processes your IP address to deliver the pages and to limit repeated sign-ups from one connection. We don’t store it. When the app sends us a request, such as feedback, we keep a one-way hash of the IP address with that day’s count, to limit how many one connection can send, and delete it after that day.

If you add notes for Toll to write questions from (in the app) Toll reads the text on your iPhone; photos and PDFs never leave it. The text goes to Toll’s server and to Anthropic, the company behind Claude, to write questions, and it’s never used to train AI; Toll keeps the questions and the line each one came from, not the rest of your notes. Don’t include patient details or anything that identifies a person.

The app asks before it sends anything for the first time, and sends nothing if you say no. You can turn this off again at any time on the You tab, and the app then asks before it sends anything. What it sends is the text of the notes you choose: text you paste, the text Toll reads from a PDF or a photo on your iPhone, or a link, which our server opens to get the page’s text. Our server passes it to Anthropic and sends what comes back to your iPhone, without saving the text or the link. The questions go into your library, and so into its backup, with the line each one came from. Anthropic processes the text as our service provider, under its commercial terms: it doesn’t use it to train its models, and it deletes it within 30 days. If its safety systems flag the text as breaking its usage policy, it can keep it for up to 2 years; otherwise, it keeps it longer only if the law requires it.

For each request, our server records a usage row against your account: when it was, what kind of request, how many pages, which AI model, how much it used and cost, and whether it failed. It never records your notes, the questions or the link. We use the rows to count your pages each month and to keep costs in check. Our lawful basis is our contract with you: you’ve asked Toll to write the questions. We keep the usage rows with your account.

If you use the app Anonymous usage events, for example: a setup step completed, a toll started or passed, whether an answer was right, and how long it took. The app sends them first to Toll’s own backend, run on Supabase in London, which keeps a copy for up to 13 months and passes them on to PostHog on its EU cloud. They’re linked only to a random install ID. They never carry your IP address, and never contain the text of your notes, cards or answers, the names of your apps, your name or your email. We use them to find out whether Toll works and to fix what doesn’t. Our lawful basis is our legitimate interest in running and improving the app. In PostHog they expire after 12 months, and PostHog deletes them after that.

One more thing goes with these events, to show us how people find Toll: if you installed Toll from an Apple Ads ad, that ad’s campaign, ad group and keyword ids, which Apple gives the app. They don’t identify you. Toll doesn’t track you across other apps or websites, so it never asks for permission to track you. Our lawful basis is our legitimate interest in knowing which ads bring people to Toll. We keep them with the events, for the same time.

Toll Pro and RevenueCat The app uses RevenueCat to check whether you have Toll Pro, so RevenueCat can receive your anonymous account ID and your device’s vendor identifier even if you don’t buy it. Apple takes payment for Toll Pro. We record your subscription (product, price, dates and renewals) with RevenueCat under an anonymous account id, never your name or email. RevenueCat’s software also sends your device’s vendor identifier. We use the record to keep track of Toll’s subscriptions. If you buy Toll Pro, our lawful basis is our contract with you; otherwise, it’s our legitimate interest in running the app. How long RevenueCat keeps it is in RevenueCat’s privacy policy.

If you send feedback from the app What you write, your app and iOS versions, the first 8 characters of the app’s random install ID, and the first 8 characters of your anonymous account ID. “Include my Toll log” is off unless you tick it. If you tick it, the app’s recent log goes too: it holds the names of the apps and websites you’ve put tolls on, recent app events, and Toll’s recent crash reports from your iPhone. Feedback reaches us as an email sent through Resend, and it isn’t stored on our server. We use it to fix and improve Toll. Our lawful basis is our legitimate interest in running and improving the app. We keep the emails for up to 12 months.

If you send feedback another way Anything you choose to send us by email or from a test build, such as comments, screenshots and crash reports. Apple passes on feedback from test builds with basic device details, and your email address if you choose to include it.

Who we share it with

Only the service providers that help us run Toll, under contract and only for these purposes:

• Cloudflare, which hosts our website and our front door at api.tollhq.app, and stores the waitlist in the EU
• DigitalOcean, which runs Toll’s server in London: your backup passes through it, but it doesn’t store it
• Supabase, which runs our backend, hosted in London: it holds your account and your library’s backup, a usage row for each request to write questions (the pages and the cost), and a copy of the app’s usage events, never the files you add or the rest of your notes
• Anthropic, the company behind Claude, which processes the text of your notes to write questions, under its commercial terms
• PostHog, for analytics on the website and in the app, on its EU cloud
• RevenueCat, which checks whether you have Toll Pro and records Toll Pro subscriptions, under your anonymous account ID (its privacy policy)
• Resend, which sends our emails: your sign-in codes, the one confirming you’ve joined the waitlist, your invite, and the feedback you send from the app
• Apple, which distributes the app, takes payment for Toll Pro, signs you in if you choose Sign in with Apple, and tells the app which Apple Ads ad, if any, it was installed from

Some providers may process data outside the UK. When they do, we rely on appropriate safeguards such as the UK’s International Data Transfer Addendum or an adequacy decision.

Your rights

You can ask us for a copy of your data, including your library’s backup in a form you can use elsewhere. You can also ask us to correct or delete it, to limit how we use it, to object to our using it, or to withdraw your consent. Toll makes no decisions about you by automated means alone. Email hello@tollhq.app and we’ll reply within one month.

If you’re unhappy with how we’ve handled your data, tell us at hello@tollhq.app. We’ll acknowledge your complaint within 30 days, look into it, and tell you what we’ve found. You can also complain to the Information Commissioner’s Office at ico.org.uk.

Deleting your data

In the app, go to You → Delete my data. It deletes your account, your library’s backup and the usage rows from our server, including anything marked as deleted, the app’s usage events from our backend, and your record at RevenueCat, then clears Toll from your iPhone. If you signed in with Apple, it also ends Toll’s access to your Apple Account. The copy of the app’s usage events in PostHog isn’t deleted: it’s linked only to the random install ID, which is cleared from your iPhone and which nothing we keep links to you any more, apart from any feedback you’ve sent (below). It expires after 12 months, and PostHog deletes it after that. Deleting your data doesn’t cancel Toll Pro, so if you have it, cancel it in your Apple Account first.

Deleting Toll from your iPhone deletes what it keeps there, but not your backup. You can also ask us to delete the data we hold: email hello@tollhq.app, or send feedback from the app (You → Send feedback) and say so. Feedback carries a short install ID and account ID, which help us find your data. Feedback emails you’ve already sent are kept as described above; ask us if you’d like them deleted too.

Children

Toll is for people aged 18 and over. We don’t knowingly collect data from anyone under 18.

Changes

If we add features that use data differently, we’ll update this page and the date at the top before they go live.