Privacy policy

Version 1.0, last updated 30 June 2026.

This is an English translation provided for convenience. If the versions differ, the Swedish version prevails. The content is fact-checked against how the app actually works, and we review and update the policy continuously. Prefer the short plain-language version? See Privacy and security.

1. About this policy

This policy describes how tilsam processes personal data when you and your family use our app and our website tilsam.se. We built tilsam for children, and that's why data protection is a cornerstone, not an afterthought.

2. Data controller

The data controller for the processing is Per Willstedt, private individual, Sweden. You can reach us by email at sam@tilsam.se or with a message on Instagram (@tilsam.se).

3. Which personal data we process

About the child (the student)

First name or nickname (you choose what to write).
School year, and optionally the school's name.
The schoolwork you add: homework, tests, submissions and presentations with their dates, plus any notes of your own.
Status and outcome for a task, for example whether it's done, or was passed or not passed.
Check-in answers (how a task feels) and time zone.

About you as an adult (account holder)

Name and email address.
Login details (email address and password).
Push notification token and your notification settings.
The time your consent was given, and your language choice.
If you invite another adult to the child's plan: the invited person's email address.

What we never process

Diagnoses, health data, personal identity numbers (personnummer) or grades. There aren't even fields for diagnosis or health in our database.

4. Purposes and legal basis

Providing the service (showing the plan, splitting up work, reminding): the legal basis is performance of our agreement with you.
Sending reminders and notifications: the agreement, and our legitimate interest in the service working as intended.
Processing the child's data: consent from a guardian (Articles 6(1)(a) and 8 of the GDPR).
Improving and securing the service: our legitimate interest.
Contact and sign-ups (by email, Instagram and the form on the website): consent.

5. AI and automated decision-making

tilsam uses AI to help read what you write, for example a typed or pasted week plan, and to suggest how the work can be spread out. The AI only sees your school text, the list of subjects and today's date, never the child's name and never any health data.

The AI suggests, a human confirms. An AI never decides on its own whether or when a reminder is sent, that's done by our own algorithm, which we control. We make no fully automated decisions that have legal effects for you or similarly significantly affect you (Article 22 of the GDPR). The AI processing takes place at Amazon Bedrock in the EU region in Stockholm.

6. Where your data is processed

The child's schoolwork and all AI processing are stored and handled within the EU/EEA, in data centres in Stockholm. The child's data is never sent to the US for storage or AI processing.

Two peripheral services are handled by providers in the US: push notifications (Expo) and the website's sign-up form (Netlify). Only the minimum necessary is transferred there, a device token and the email address you type in yourself, never the child's data. For these transfers we rely on the European Commission's standard contractual clauses (SCCs).

7. Data processors

We use providers that process data on our behalf, under data processing agreements:

Supabase (database and login), EU region (Stockholm).
Amazon Web Services / Amazon Bedrock (AI), EU region (Stockholm).
Sentry (error monitoring, to detect and fix technical errors and crashes), EU region. The service is configured not to receive personal data.
Expo (push notifications), US.
Apple (delivery of push notifications to your device).
Netlify (web hosting and the sign-up form on tilsam.se), US.
Loopia (email, sam@tilsam.se), Sweden.

We never sell your data, and we don't share it for anyone else's marketing.

8. How long we keep data

We keep data for as long as your account exists. We don't delete accounts automatically, your data remains until you choose to delete it yourself.

When you delete your account, the child's data is removed, if you're the only adult with access. If the child lives in two homes, the plan remains with the other home that owns it. Deletion happens without undue delay.

9. Your rights

Under the General Data Protection Regulation you have the right to:

know what data we process about you (access),
have incorrect data corrected,
have data deleted,
restrict or object to the processing,
receive your data in a machine-readable format (data portability),
withdraw a given consent at any time.

Get in touch and we'll help you. You also have the right to complain to the Swedish Authority for Privacy Protection (IMY), imy.se.

10. Children's personal data

tilsam is made for families with children in years 7–9 (högstadiet). A child can have their own account and their own plan, but since it concerns a child's data, the processing takes place with a guardian's consent. In Sweden, children from age 13 can in some cases consent to digital services themselves; for younger children, the guardian's consent is required. We never direct marketing at children.

In the app, the guardian's consent is collected per child at registration, and we log when the consent was given and against which version of this policy (currently version 1.0).

11. Security

Each family's data is separated at the database level (row-level security), so only the adults you've invited yourself can see your child's plan. We minimise what data is processed and never collect more than needed.

12. Cookies and tracking

The website tilsam.se uses no cookies and no tracking tools. The app only uses necessary technical data, such as login and notification tokens, for the service to work, plus error monitoring that helps us find and fix technical errors (see section 7). We use no tools that track you for advertising or profiling.

13. Changes to this policy

We may update this policy. We announce significant changes in the app or via the contact details you've provided. The date of the latest change is at the top of the page.

14. Contact and supervisory authority

Questions about how we process personal data? Write to us by email at sam@tilsam.se or on Instagram (@tilsam.se). The responsible supervisory authority is the Swedish Authority for Privacy Protection (IMY), imy.se.