Last updated 21 August 2026

Tondo shows you one artwork a day. It is free, it has no advertising, and nothing here is watching you.

What is stored

If you sign in with Google or Apple, we keep the name and email address that provider hands us, plus the provider's own identifier for you. If you use Apple's Hide My Email, what we hold is the relay address Apple generates, not your real one. We never receive your password.

If you do not sign in and you are using the iOS app, the app creates a random identifier on your device the first time it opens and keeps it in the iOS Keychain. We store a one-way hash of it, never the identifier itself, along with the date it was last seen. It is not an advertising identifier, it is not Apple's identifier for vendors, and it is not connected to your name, your email, or any other app.

Works you keep are stored against whichever of those two identities you have: your account, or your device's hash.

Server logs record ordinary web-server information, including IP addresses and the pages requested. This is how the server runs, not a profile of you.

If the app crashes or hits an error, technical details about the failure — what broke, the device and OS version, and which screen you were on — go to Sentry, a crash-reporting service, so the mistake can be fixed. It only fires when something goes wrong. It is not analytics and it does not run on ordinary use of the app.

What is not stored

No advertising, and no advertising identifiers. No third-party analytics. No tracking of you across other apps or other websites. No location, no contacts, no health data, no payment details. Nothing is sold, and nothing is shared with anyone for their own purposes.

This is not a promise about our intentions. The test suite fails the build if a tracking or analytics dependency is added to this app while this paragraph still says otherwise, so the paragraph cannot quietly stop being true.

Deleting it

With an account: open Your corner and choose Delete account. It removes the account and every work kept with it, immediately. There is no soft delete and no grace period.

Without an account, on the iOS app: open Your corner and choose Delete this device's data. It removes the stored hash and every work kept on this device, immediately.

Your corner is the small ring at the top right of every screen, and there is a link to it at the foot of your collection.

You can also write to support@dailytondo.com and ask, and we will do it by hand.

The artwork

Every image in Tondo comes from a museum's open-access collection and is in the public domain or released under CC0 — the Metropolitan Museum of Art, the Art Institute of Chicago, the Cleveland Museum of Art, and the Minneapolis Institute of Art. Catalogue text shown beneath a work is the museum's own, and is marked as theirs wherever it appears.

Children

Tondo is not directed at children and does not knowingly collect anything from them.

Changes, and how to reach us

If this policy changes, the date at the top changes with it. Questions go to support@dailytondo.com.