Tiluma privacy

Tiluma is a self-help app for quitting cannabis. This page explains what data the app processes. In short: your entries stay on your device. I have no access to them.

Note on the website: If you visit this website (not the app), the KLMN Media privacy policy applies as well. It also explains that the website uses Google Analytics only with your consent. The Tiluma app itself contains no analytics software.

1. Controller

Tim Kullmann
Im Urnenfeld 19, 63920 Großheubach, Germany
Email: klmn.media.websites@gmail.com · Phone: +49 172 9584230

2. The essentials

• All entries (check-ins, journal, craving moments, plans and more) are stored only locally on your device.
• There is no account, no advertising and no third-party tracking software.
• The local database is encrypted. The key sits only in your device's protected storage.
• You can export and delete your data at any time.

3. What data is stored in the app

Depending on what you enter: information about your use and quitting (e.g. stop date, reasons, frequency, spending), daily check-ins (mood, sleep, craving), journal entries, craving moments, slips, plans, an optional trusted person (name and phone number) and settings. This may be health data within the meaning of Art. 9 GDPR.

This data does not leave your device, I do not receive it and cannot see it. Where processing on your device still falls under the GDPR, it is based on your consent by entering the data (Art. 6(1)(a), Art. 9(2)(a) GDPR) and on using the app (Art. 6(1)(b)).

4. Protection on your device

• The local database is encrypted with SQLCipher; the key is held in the Keychain (iOS) or Keystore (Android) of this device only.
• The data is excluded from iCloud and device backups (iOS) and not part of Google backup (Android).
• You can optionally protect the app with your own PIN, Face ID or Touch ID. Biometric data is processed by your operating system only, the app does not receive it.
• Discretion: neutral app icons, neutral notifications and widgets that show no numbers while the lock is on.

5. Permissions

• Notifications: the daily check-in reminder is scheduled locally on your device. There is no push server.
• Face ID / Touch ID: only for the app lock, through the system.
• Sharing: you create the export and the PDF report yourself and share them through your device's share menu with people of your choice. The files are not encrypted, share them only with people you trust.

6. Purchases (Premium)

Billing runs through the Apple App Store or Google Play (Apple Distribution International Ltd. or Google Ireland Ltd.), whose privacy policies apply. To manage your Premium entitlement I use RevenueCat (RevenueCat, Inc., USA). What is transmitted: a random app user ID, information about your purchase or subscription and technical data such as app version and country. Your entries in the app are not transmitted. The legal basis is Art. 6(1)(b) GDPR. A data processing agreement is in place with RevenueCat; transfers to the USA are covered by EU standard contractual clauses. This section applies as soon as purchases are active in your version of the app.

7. No analytics, no advertising

Tiluma currently contains no analytics or advertising software. If anonymous usage statistics are added in the future, this will only happen with your explicit consent and after this policy has been updated.

8. Help numbers

The app shows help and emergency numbers. A call or text is started through the phone or messaging app of your device; the app itself sends nothing. The numbers have been checked to the best of my knowledge; no guarantee.

9. Export and deletion

In the profile you can export all data as a file (JSON) and irreversibly remove it from your device with "Delete all data". Deleting the app also removes the local data.

10. Age

Tiluma is intended for people aged 18 and over.

11. Your rights

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), data portability (Art. 20) and objection (Art. 21), insofar as I process data about you. Because your entries only exist on your device, you exercise most of these rights directly in the app (export, edit, delete). You can withdraw consent at any time. You also have the right to lodge a complaint with a supervisory authority; the competent one is the Bavarian State Office for Data Protection Supervision (BayLDA), Promenade 18, 91522 Ansbach, Germany.

12. Changes

I will update this policy when the app or the law changes, and I will point it out in the app if data processing changes significantly (for example with an optional account). Last updated: October 2026.

Back to Tiluma →