TOMST 汤姆斯特 homeTOMST logo
连接测试

TOMST Lolly 隐私政策

适用于：TOMST Lolly 中国版（Android）

版本 2026-10-22。生效日期及更新日期：2026 年 10 月 22 日。

本政策以中文和英文两种文本发布，两种文本含义相同。如有不一致，对中国大陆用户以中文文本为准。您的同意同时适用于两种文本，无论您阅读的是哪一种。

1. 谁处理您的信息，以及如何联系我们

TOMST Lolly 由在捷克共和国注册的公司 TOMST s.r.o.（地址：Michelská 964/78, 141 00 Praha 4, 捷克共和国；增值税号 CZ27139140）开发和提供，该公司同时运营本应用所连接的服务器 tomst.cn。本政策中的"我们"和"TOMST"均指 TOMST s.r.o.。

隐私问题与请求：tomst@tomst.com。技术支持与诊断日志：app@tomst.com。

我们在中国大陆的联系方是上海赛弗生物科技有限公司（SHANGHAI SAFE BIOTECH CO LTD），电子邮箱 1364685620@qq.com。您可以就本政策的任何事项用中文写信给他们；他们会把您的请求转交 TOMST，由 TOMST 答复。赛弗生物在中国大陆分销 TOMST 的硬件并链接到本应用的下载页面；它不托管、不签名、不修改、也不分发本应用，并且不从应用收到任何信息。

谁对什么负责。依据《中华人民共和国个人信息保护法》，TOMST 是个人信息处理者，负责应用处理个人信息的方式，包括在应用使用您的位置之前征得您的同意（第 11 节），以及 TOMST 收到的个人信息：应用向 tomst.cn 发出的请求（第 7 节）、您发送的诊断日志和崩溃报告（第 8 节和第 9 节）以及您写给我们的邮件（第 10 节）。依据欧盟《通用数据保护条例》（GDPR），TOMST 是其所收到信息的控制者；GDPR 之所以适用，是因为 TOMST 设立于欧洲联盟。应用保存在您设备上的信息，例如测量数据、站点名称、备注、照片和位置，处于您或您所在单位的控制之下，由其决定记录什么以及如何处置；TOMST 不会收到这些信息，也无法访问，并且在设计应用时使这些信息保留在设备上，除非您把它们发送出去。

本版本应用仅供中国大陆用户使用。

2. 简要概述

  • Lolly 无需账号，无需联网即可使用。您的测量数据、站点、备注和照片保存在您的设备上，除非您自己发送、分享、导出或上传它们。
  • 应用中没有广告、统计分析或跟踪功能，TOMST 的服务器不会自行收集您的测量数据。
  • 应用只在两种情况下自行连接 tomst.cn：首次设置时，在您同意之前，获取本政策和《用户协议》，以便您阅读；在您同意之后，每次启动时检查是否有新版本以及是否有 TOMST 的公告。这些请求不含任何标识您或您设备的标识符；服务器只为答复而使用您连接的 IP 地址，不予保存（第 7 节）。
  • 其他一切都只在您决定时才会离开设备：您发送给 TOMST 的诊断日志或崩溃报告（每次都需要您勾选一个选框；日志包含其所涉数据记录器的测量数据和序列号，崩溃报告不含测量数据）、您用自己的邮件应用发送的邮件、向您自行设置的您自己的服务器的上传，以及您分享或导出的文件。
  • 位置信息是可选的，并且保存在您的设备上。

3. 本政策的范围

本政策说明 Android 版 TOMST Lolly 中国版如何处理信息：哪些信息保存在您的设备上，哪些信息会离开设备，发送到哪里，保存多久，以及您享有哪些权利。第 6 节列出了可能离开设备的全部内容。

Lolly 是 TOMST 数据记录器的配套软件：它通过 TOMST 的 USB 适配器下载记录器中的测量数据，显示并保存这些数据。它没有用户账号、订阅、付费、广告、社交功能，没有向其他用户发布内容的功能，也没有自己的云存储。它从 tomst.cn 的下载页面安装，不在任何应用商店提供。TOMST 在中国大陆没有服务器、办公室或公司。本应用面向成年人的专业、科研和技术工作，不面向未满 14 周岁的儿童（第 21 节）。

4. 无需账号，无需注册

Lolly 没有用户账号。您无需注册或登录，也无需向我们提供姓名、手机号或电子邮箱即可使用应用。

应用会在您的设备上记录您已接受的本政策和《用户协议》的版本，以便在文本变更时再次询问您；该记录不发送给 TOMST。如果 tomst.cn 的下载页面在下载之前请您确认接受，TOMST 同样不保留该确认的任何记录。您唯一需要输入的账号信息，是您设置自动导出时您自己的服务器的信息（第 13 节）。

5. 保存在您设备上的信息

Lolly 把它的工作成果保存在您初次设置时选择的数据文件夹（默认为 Documents/Lolly）以及应用的私有存储空间中（其他应用通常无法读取）：

  • 从数据记录器下载的测量文件，以及由它们生成的文件（例如土壤湿度换算文件和修复副本）；
  • 您为一次下载添加的内容：站点名称、备注、照片；
  • Lolly 随下载记录的内容：日期和时间、数据记录器的序列号、类型和固件版本、存储器的占用程度、时钟的偏差、下载如何结束，以及在您允许定位时的位置；
  • 与数据记录器通信的日志（见下文），以及在您发送或删除之前的崩溃报告（最长 30 天，最多保留最近的 40 份）；
  • 应用数据库、您创建的备份、您的土壤校准曲线和设置，包括您已接受的这两份文本的版本；
  • 如果您使用自动导出：您的服务器地址、用户名以及密码或 SSH 密钥，以及等待上传的文件列表；
  • 临时文件，例如正在准备分享的压缩包。

以上内容都不会由应用自行发送给 TOMST。Lolly 的私有存储不参与 Android 的自动备份，也不会转移到新设备，因此在新设备上 Lolly 从空白开始；您的数据文件夹和您自己的备份是迁移工作成果的方式。

关于日志。Lolly 在每次下载时把一份原始日志保存在您的数据文件夹中，并在其私有存储中保留最近几次与适配器通信的诊断日志，较旧的会自动删除。两者都是 Lolly 与数据记录器之间通信的完整记录：其中包括测量数据本身、数据记录器和适配器的序列号及固件、应用版本，以及设备的品牌、型号和 Android 版本。它们不包含您的位置、站点名称、备注或照片。请像对待所属的测量文件一样对待原始日志。

6. 会离开您设备的信息

以下是完整的概览，各节给出详细说明。中国版应用不使用任何 Google 服务，也不包含任何第三方广告、统计分析或跟踪组件（第 16 节）。

应用自行发起的连接，只连接 tomst.cn：

  • 获取您所用语言的本政策和《用户协议》，在首次设置时您同意之前，以及每次您打开它们时（第 7 节）；
  • 您同意之后每次启动时的更新检查和 TOMST 公告查询，以及在您确认后下载新版本（第 7 节）。

只在您决定时：

  • 您点按"检查更新"时的更新检查（第 7 节）；
  • 您发送给 TOMST 的诊断日志（第 8 节）；
  • 您发送给 TOMST 的崩溃报告（第 9 节）；
  • 您用自己的邮件应用写给 TOMST 的邮件（第 10 节）；
  • 在您设置自动导出之后，向您自己的服务器的上传（第 13 节）；
  • 您自己分享、导出或备份的文件（第 14 节）。

应用不会自动把您的测量数据、位置、照片、备注或站点名称发送给 TOMST。只有在您自己选择发送的日志、邮件或附件中，TOMST 才会收到它们。

7. 自动请求：获取法律文本与更新检查

请求携带的内容。更新检查、更新下载和公告查询携带应用版本和版本号、版本类型、Android 版本，以及一个标识应用而非标识您的固定代码；获取两份文本的请求只携带应用版本、版本类型和 Android 版本。与任何互联网连接一样，它们也会让服务器看到您连接的 IP 地址。它们不含任何标识您、您的设备或本次安装的标识符，应用也不会单独发送"已安装"的消息。

服务器如何处理。tomst.cn 由 TOMST 在位于中国香港的租用硬件上运营。它只为答复请求而使用 IP 地址，不把地址写入这些请求的任何日志。只有在连接尚未发出任何请求就失败时，或服务器防火墙拦截到零星数据包时，地址才可能出现在服务器的一般错误日志或防火墙日志中，最多保存四周，并且不涉及应用的任何内容。在中国香港和德国提供硬件的托管服务公司可能保留其自身的网络数据。对于更新，服务器只按天统计请求次数：更新检查按应用版本、版本类型和 Android 版本统计；下载按应用版本统计，完成的下载另按版本类型统计；以及因同时到达的请求过多而被拒绝的请求。这些是请求次数，不是设备数量：一台设备一天内多次启动应用，就会被统计多次，计数也无法区分不同的设备。获取法律文本的请求不计数。

安装更新。当有新版本时，应用会告诉您新版本带来了什么，并请您在一个从不预先勾选的选框中确认已阅读《用户协议》和本政策；在移动网络下，它还会告诉您下载的大小，并在下载前询问您。首次更新时，Android 会请您允许 Lolly 安装应用（第 15 节）。安装前，应用会检查文件是否完整、是否由 TOMST 签名，然后由 Android 提出它自己的询问。未经您确认，不会下载或安装任何内容。

TOMST 的公告。在您同意之后，应用在每次启动时还会向 tomst.cn 查询 TOMST 是否有关于应用或设备的公告，例如关于故障、安全问题或测试版结束的公告，并以您所用的语言显示。该请求携带的信息与更新检查相同，并且不计数。公告只包含文字，可能附有指向 tomst.cn 的链接；它不能更改应用或您设备上的任何内容。您可以勾选"不再显示"停止显示某条公告；否则它会在下次启动时再次显示。

为什么需要这些请求。测试版会在其停止日期停止工作（《用户协议》第 4 节），故障和安全问题只能通过新版本修复，因此如果没有更新检查，应用可能会在不告知您的情况下停止工作或一直存在故障。计数让 TOMST 了解哪些版本仍在使用，从而知道何时可以停用旧版本。在您同意之前获取这两份文本，是因为您无法同意尚未能够阅读的文本。

处理依据。依据《个人信息保护法》，更新检查、公告查询和更新下载是履行与您订立的《用户协议》所必需的（第十三条第一款第二项），在您同意之前获取这两份文本是订立该协议所必需的（同一项）。依据 GDPR，更新检查、公告查询和更新下载的处理依据是 TOMST 在保持其提供的应用安全、最新，告知您故障以及了解在用版本方面的合法利益（第 6 条第 1 款 f 项），获取两份文本则是您通过启动应用为订立协议而采取的步骤（第 6 条第 1 款 b 项）。同意本政策并不是这些请求的处理依据。由于请求不含标识符，IP 地址不被保存，各次请求之间也没有任何关联，它们对您的影响有限。

您的反对权。依据 GDPR，您可以随时写信至 tomst@tomst.com 反对更新检查和公告查询（第 19 节），TOMST 会考虑您的反对并予以答复。应用没有关闭该检查的开关，因此立即停止这些请求的方式是在不联网的情况下使用应用；应用的全部核心功能都可以这样使用。

8. 您发送给 TOMST 的诊断日志

有几个按钮会准备一个诊断压缩包："向 TOMST 发送日志"和"向 TOMST 发送日志邮件"（在"设置"中、在图表的数据工具中，以及在数据记录器疑似故障时出现的提示中）、"设置"中的"发送反馈"，以及 Lolly 无法读取的文件的卡片上的"发送至 TOMST"。Lolly 从不自行发送压缩包。随后出现的对话框中有一个选框，它从不预先勾选："我已阅读隐私政策，同意将此诊断日志发送给 TOMST 用于技术支持，包括在中国大陆境外处理。我知道其中包含所涉数据记录器的测量数据和序列号。"隐私政策可在同一对话框中打开，每次发送都会再次询问该选框。只有在您勾选之后，才可以选择：

  • "发送至 TOMST"：压缩包通过加密连接上传到 tomst.cn，并保存在 TOMST 位于德国的服务器上。您会得到一个参考编号，联系我们时可以引用。服务器保存压缩包以及日期、应用版本、发送类型和参考编号，不保存 IP 地址。
  • "准备邮件"：您自己的邮件应用打开，附上压缩包，收件人为 app@tomst.com。只有您按下发送，它才会发出，此时我们也会收到您的电子邮箱地址。

开关"仅报告问题，无需回复"在每次新的发送时默认打开。如果您希望 TOMST 回复，请关闭它并填写您的邮箱地址：它随压缩包一起传输并一同保存，只用于就该次发送回复您。

压缩包可能包含：

  • 一份简短报告：您输入的备注、应用版本和版本类型、Android 版本和构建号、设备的品牌、型号和内存、创建时间、应用最近处理过的错误列表（错误的类型和代码中的位置，不含文件路径或消息文本），以及压缩包中各文件的名称和大小；
  • 相关数据记录器的诊断日志（第 5 节），以及在大小限制之内本设备最近使用过的其他数据记录器的诊断日志，其中包括这些下载的测量数据，以及数据记录器和适配器的序列号和固件；
  • 出现故障时 Lolly 当时另存的记录；数据记录器疑似故障时，关于它的一份简短技术报告；
  • 固件更新的记录，如果您在"设置"中勾选了它们。

压缩包中没有：您的位置、站点名称、您为下载附加的备注、照片、您的设置、作为文件的测量文件本身，以及与您的下载一起保存的原始日志。

序列号。数据记录器的序列号标识的是一台设备，TOMST 可能能够通过其销售或服务记录把它与某位客户关联起来。我们只用这种关联来答复您以及帮助处理您的设备和数据，不据此建立任何关于个人的画像。

目的：答复您的支持请求，查找应用、适配器或数据记录器的故障原因，并应您的要求帮助处理您的数据。处理依据：您通过勾选该次发送的选框作出的同意（《个人信息保护法》第十三条第一款第一项、第十四条和第三十九条；GDPR 第 6 条第 1 款 a 项），您为获得回复而填写的邮箱地址也包含在同一同意之中。发送是自愿的，应用的其他功能不受影响。保存期限：第 18 节。

9. 您发送给 TOMST 的崩溃报告

当应用意外关闭或停止响应时，它会在设备上写入一份报告，不发送任何内容。下次启动时，它会询问您一次是否发送该报告，选框从不预先勾选："我已阅读隐私政策，同意将此崩溃报告发送给 TOMST 用于技术支持，包括在中国大陆境外处理。其中不含测量数据。"与日志一样，回复开关默认打开；关闭后您可以填写邮箱地址，它随报告一起传输并一同保存。您未发送的报告在设备上最多保留 30 天。在"设置"的"崩溃与日志"中，您可以查看设备上保存的每一份报告及其日期和应用版本，发送其中任何一份（同样需要勾选选框）或删除它们。

一份报告包含：应用版本、版本类型和构建类型；设备的品牌和型号、Android 版本、处理器类型、应用使用的语言，以及内存容量的大致等级；应用已运行的时长及其占用的内存；错误及其调用栈，以及 Android 结束应用的方式；当时应用的状态，例如打开的界面、下载的状态、手机时钟是否已用卫星时间核对，以及您的数据文件夹所在的存储类型（从不包含其名称或路径）；应用最近的事件记录，时间精确到分钟，不含您输入的任何文字；重复崩溃和已处理错误的计数；以及所连接数据记录器的类型和固件版本。

应用不会在报告中放入任何标识您或您设备的标识符，也不放入位置、地区或时区、测量数据、照片、备注、站点名称，以及文件夹、文件或服务器的名称。数据记录器和适配器的序列号不作为报告的字段发送；应用在运行期间遇到的序列号、文件名、地址和电子邮箱地址（您为获得回复而填写的邮箱除外）也会从报告的文本中删除。这些过滤自动进行；它们能大幅减少、但无法完全排除错误信息中仍含有可识别内容的可能。

已发送的报告通过加密连接传输到 tomst.cn，并与日期和应用版本一起保存在 TOMST 位于德国的服务器上，不含任何 IP 地址。目的：发现并修复应用中的故障。处理依据：您通过勾选该份报告的选框作出的同意（《个人信息保护法》第十三条第一款第一项、第十四条和第三十九条；GDPR 第 6 条第 1 款 a 项）；发送是自愿的。保存期限：第 18 节。

10. 您发送给 TOMST 的邮件

Lolly 从不自行发送邮件。它的邮件选项会打开您自己的邮件应用，收件人为 app@tomst.com；您可以阅读、修改、删除附件或关闭它，只有您按下发送，邮件才会发出。这样的邮件包含您写的内容、应用和设备的技术信息（应用版本、Android 版本、品牌、型号和内存），以及在您选择时附上的第 8 节所述的压缩包。我们也会收到您的电子邮箱地址。

我们用这些邮件回复您、查找问题原因、帮助处理您的数据，以及改进应用和数据记录器。邮件通过您自己的邮件服务提供者发送到位于捷克共和国的 TOMST。处理依据：您通过发送邮件作出的同意（《个人信息保护法》第十三条第一款第一项和第三十九条）；依据 GDPR，为 TOMST 在答复您并解决您提出的问题方面的合法利益（第 6 条第 1 款 f 项）。保存期限：第 18 节。

11. 位置信息

依据中国法律，精确位置信息可能属于敏感个人信息，Lolly 按敏感个人信息对待它。在 Lolly 中它是可选的：设置步骤会先说明用途，然后由 Android 询问权限。您可以跳过、拒绝，或以后在 Android 设置中撤回，也可以在 Lolly 的"设置"中关闭 GPS。

如果您允许，Lolly 会把您的位置用于：

  • 记录一次下载的地点（纬度、经度、海拔高度和定位精度），与该次下载一起保存在您的设备上；
  • 为该地点建议一个名称，名称在设备上从应用内置的地图数据中查找，坐标不会为此发送给任何在线服务；
  • 在首页显示您的位置、所在地区和海拔高度；
  • 在 Lolly 设置数据记录器时钟之前，用卫星时间核对手机时钟；
  • 在您附加的照片没有自己的坐标时，为照片补充坐标。

Lolly 在应用打开时使用您的位置，不请求后台定位。下载可以在息屏时继续进行；在此期间 Lolly 可能用卫星时间核对手机时钟，下载完成时保存手机已有的最后一个位置。

GPS 坐标使用 WGS-84 坐标系。为了方便您在高德地图、腾讯地图或百度地图中使用，应用会同时显示换算后的 GCJ-02 和 BD-09 坐标；换算在设备上完成，数据文件中保存的仍是原始坐标。如果您点按一个已保存的位置，Lolly 会在您选择的地图应用中打开它，并把坐标交给该应用。

如果您拒绝，只有依赖位置的功能会改变：下载在保存时没有坐标，也没有建议的地点名称；首页不显示位置、地区和海拔；您附加的照片不会由 Lolly 添加坐标；Lolly 也无法在设置数据记录器时钟之前用卫星时间核对手机时钟，因此会直接使用手机当前的时钟。下载、查看、保存和导出测量数据都照常进行。

对您的影响：保存的坐标会显示您工作的地点，您把带有坐标的文件交给谁，谁就会知道这些地点。坐标与下载一起保存在您的设备上，只会随您导出、分享、备份或通过自动导出上传的文件（下载的信息文件、地图文件和照片）离开设备。它们从不属于崩溃报告或诊断日志的一部分；除非您自己发送给我们（例如在邮件附件中），TOMST 不会收到您的位置。

处理依据：您在说明用途的设置步骤中、随后在 Android 自身的权限询问中作出的单独同意（《个人信息保护法》第十三条第一款第一项、第二十九条和第三十条），您可以随时按上文所述撤回。

12. 照片

您可以为一次下载附加照片：用相机应用拍摄、从设备中选取，或从其他应用分享到 Lolly；Lolly 本身不持有相机权限。Lolly 会在所附照片的元数据（EXIF）中写入数据记录器的序列号，并在照片本身没有坐标且 Lolly 知道位置时写入地点坐标。照片中原有的其他元数据保持不变。

照片保存在您的设备上，只会随导出、分享、备份，或您设置为包含照片的自动导出上传离开设备。由于元数据随照片一起传递，您转交的照片可能会透露数据记录器、地点以及照片原本记录的内容。

13. 自动导出到您自己的服务器

自动导出默认关闭，需要您在"设置"中自行设置。开启后，每次完成的下载会自动上传到您选择的位置：您自己的 WebDAV 服务器（例如坚果云、Nextcloud）或 SFTP 服务器。上传在后台进行，遵循您的"仅在 Wi-Fi 下"设置。

Lolly 直接与您的服务器通信，TOMST 不在其中，也不会得到副本。您输入服务器地址、用户名和密码；SFTP 也可以使用 SSH 密钥代替密码，Lolly 可以在设备上生成密钥，您也可以导入已有的密钥。私钥保留在设备上，从不发送给 TOMST、服务器或任何备份；如果您把 Lolly 的公钥交给了服务器，在不再希望 Lolly 连接时请在服务器上删除它。如果 SFTP 服务器的身份发生变化，Lolly 会拒绝连接，直到您确认。

上传的内容：在"自动导出"模式下，每次下载作为可读文件上传（测量文件；含站点名称、备注、坐标以及 Lolly 关于该次下载的记录的信息文件；您选择的地图文件；在您开启时的土壤换算文件和站点照片；以及该次下载的原始日志）。在"自动备份"模式下，每次下载作为一个备份文件上传，包含同样的信息以及您的应用设置。密码和密钥从不包含在备份中。

安全：上传通过加密连接进行（HTTPS 或 SSH）。服务器密码和私钥用 Android 密钥库中的密钥加密后保存在设备上。

责任：上传到哪里、上传什么由您选择，目的地的运营者依据其自身的条款处理这些文件；目的地可能位于中国大陆以外。TOMST 提供这一应用功能，并对其按本节所述运行负责，但不会收到上传的数据，也不决定这些数据在目的地如何处理。

停止：暂停或关闭自动导出，上传即停止。在"设置"中删除该服务器会从您的设备上移除它保存的信息。Lolly 从不删除您服务器上的任何内容。

14. 您自己分享、导出或备份的文件

Lolly 可以分享或保存所选下载的压缩包、把图表保存为图片，以及创建数据库备份。每一次都由您决定文件去向。这样的文件可能包含测量数据、数据记录器序列号、站点名称、备注、坐标以及带有元数据的照片（第 5、11、12 节）。当您把文件交给其他应用或个人后，它们按其自身的规则处理，因此请考虑您转交的内容，特别是其中他人的信息。

15. 权限

中国版应用持有的权限及用途：

  • 位置信息（精确和大致）：可选，见第 11 节。
  • 通知：必需。Lolly 与数据记录器通信时 Android 会显示通知，正是它让下载可以在息屏时继续；Lolly 也用通知显示下载、导出和上传的进度和结果，从不用于营销。
  • USB 设备：插入适配器时 Android 会询问您。
  • 网络和网络状态：自动请求（第 7 节）、您选择的发送和自动导出。
  • 安装应用：仅用于安装从 tomst.cn 下载的更新，且仅在您确认后（第 7 节）。首次更新时，Android 会打开其自带的"安装未知应用"设置，由您允许 Lolly 安装；您可随时在该设置中重新关闭，下次更新时 Lolly 会再次询问。
  • 存储（仅 Android 9）：把 Lolly 照片查看器中的照片保存到相册。
  • 不让应用访问您个人信息的权限：在下载或固件更新进行时前台运行并保持唤醒、手机重启后继续等待中的上传、振动，以及雨天模式的传感器高频读取。

您的数据文件夹不需要存储权限：您在 Android 自己的文件夹选择器中选择它，Lolly 只能使用该文件夹。Lolly 还会读取无需权限的运动、气压、光线和距离传感器，读数只在当下使用，不保存也不发送。Lolly 不申请相机、麦克风、通讯录、日历、电话、短信、蓝牙或后台定位权限，也不读取设备自身的任何标识符。

16. 第三方与服务提供者

应用不会自行与任何第三方共享个人信息。以下各方可能收到某些内容，且仅在您操作时：自动导出上传时您自己服务器的运营者（第 13 节）；您点按已保存位置时您选择的地图应用（第 11 节）；您发送邮件时您的邮件应用和邮件服务提供者（第 10 节）；相机应用以及您向其分享文件的任何应用（第 12 节和第 14 节）；以及您从应用中打开链接时您的浏览器。

服务提供者：TOMST 位于中国香港和德国的服务器硬件租用自托管服务公司，由其提供运行 tomst.cn 和 TOMST 存储服务器的机器和网络。

第三方代码：应用不包含广告、统计分析或跟踪组件。应用包含开源组件，其代码中还包含一个由 Google 制作的崩溃报告库（Firebase Crashlytics）及其所依赖的 Firebase 库。在本版本中应用不启动它们，它们也不被用于收集或发送任何内容。

17. 向中国大陆以外提供的信息

TOMST s.r.o. 位于捷克共和国。tomst.cn 服务器位于中国香港，您发送的日志和崩溃报告保存在 TOMST 自己位于德国的服务器上：

  • 自动请求（第 7 节）只到达香港服务器，请求及您连接的 IP 地址在连接持续期间在那里处理，不予保存（第 7 节所述的例外情形除外）。
  • 您发送的诊断日志或崩溃报告经由香港服务器传输到 TOMST 位于德国的服务器；香港服务器不传递任何关于您的连接的信息。
  • 您发送的邮件通过您自己的邮件服务提供者发送到位于捷克共和国的 TOMST。

依据《个人信息保护法》，就此需要告知您的是：境外接收方为 TOMST s.r.o.（联系方式见第 1 节）；自动请求的目的是提供更新和现行文本，您发送的内容的目的是技术支持以及发现和修复故障；信息范围是第 7 至第 10 节所述的内容，没有其他；信息通过加密连接传输，保存在 TOMST 的服务器上，只有负责支持和开发的 TOMST 工作人员可以访问，并按第 18 节删除；您可以写信至 tomst@tomst.com 或通过我们在中国大陆的联系方，按第 19 节向 TOMST 行使您的权利。

同意：自动请求以履行《用户协议》为依据（第 7 节），因此不另行请求单独同意；只有在不联网使用应用时才不会发生这些请求。对于每一份诊断日志或崩溃报告，勾选其选框即是您对该次传输的单独同意，未经勾选不会传输任何内容。在您的邮件应用中按下发送，即是您对该封邮件的同意。

依据 GDPR，您发送的内容保存在欧洲联盟境内：保存在 TOMST 位于德国的服务器上，邮件则保存在位于捷克共和国的 TOMST；香港服务器只负责转发。自动导出的上传发送到您指定的位置（第 13 节）。

18. 信息保存多久，以及如何删除

在您的设备上：您创建或下载的内容保留到您删除为止。Lolly 会在 30 天后自动删除崩溃报告，并自动删除较旧的诊断日志。卸载应用，或在 Android 设置中执行"清除存储"，会删除 Lolly 的私有存储（数据库、设置、服务器密码、SSH 密钥、诊断日志和崩溃报告）。您的数据文件夹会保留在设备上，您上传、分享或通过邮件发送的任何内容也会保留在原处，直到您在那里删除。

在 TOMST：

  • 上传的诊断日志在到达 180 天后删除；只有在与之或同一设备相关的支持事项仍在处理时才会保存更久，并在该事项结束时删除；
  • 崩溃报告在到达 180 天后删除；
  • 邮件在处理您的请求以及理解同一设备日后问题所需的期间内保存；
  • 更新计数不能识别任何人；进入一般错误日志或防火墙日志的地址（第 7 节）最多四周后即被删除。

您可以随时要求提前删除您发送的任何内容（第 19 节）。如果法律要求 TOMST 保存更久，则只在法律要求的期间内保存。

19. 您的权利以及如何行使

依据《中华人民共和国个人信息保护法》，您有权：

  • 知悉并决定您的个人信息如何被处理，以及限制或拒绝处理：本政策即为说明，您可以不同意并不使用本应用；
  • 查阅和复制：应用持有的内容都在您的设备上，可随时查看和导出；对于您发送给我们的内容，可以向我们索取副本，或在符合法律规定的条件时要求我们将其转移给您指定的其他处理者；
  • 更正和补充：在应用中修改站点名称、备注和照片；如果您发送给我们的内容有误，请告诉我们；
  • 删除：设备上的内容您可以自行删除；您可以要求我们删除您发送的日志、崩溃报告或邮件；
  • 撤回同意：对于位置，在 Android 设置中撤回权限，或在 Lolly 的"设置"中关闭 GPS；对于您已发送的日志或崩溃报告，上传本身无法撤销，但您可以随时写信至 tomst@tomst.com 或 app@tomst.com，撤回您对其继续保存的同意，我们随后会将其删除。撤回不影响撤回前的处理，每次新的发送都会再次询问您；
  • 要求我们对本政策或我们处理您信息的方式作出解释说明；
  • 用户去世后，其近亲属可以就去世者本人的信息行使上述权利，去世者生前另有安排的除外。

依据 GDPR，对于 TOMST 持有的关于您的信息，您享有查阅权（第 15 条）、更正权（第 16 条）、删除权（第 17 条）、限制处理权（第 18 条）、以可携带的形式获取您基于同意发送的内容的权利（第 20 条）、随时反对基于 TOMST 合法利益的处理（例如更新检查）的权利（第 21 条），以及随时撤回同意且不影响撤回前处理的权利（第 7 条第 3 款）。TOMST 不会仅凭自动化方式对您作出任何决定，也不进行用户画像（第 22 条）。

如何提出请求：请写信至 tomst@tomst.com 或联系我们在中国大陆的联系方（第 1 节）。由于应用没有账号，请告诉我们上传日志的参考编号，或崩溃报告的日期和应用版本（可在"设置"的"崩溃与日志"中查看），以便我们找到它。我们只要求提供找到信息并合理确认请求涉及您自己的数据所需的内容，对合理的请求不收取费用。我们会及时处理请求，并在 15 个工作日内答复。依据 GDPR 提出的请求，我们最迟在收到后一个月内完成；如果请求复杂或数量众多，GDPR 允许再延长最多两个月，此时我们会在第一个月内告知您延长的原因。如果我们无法满足您的请求，会说明理由以及您可以如何投诉（第 23 节）。

20. 安全

向 TOMST 的发送和向您自己服务器的上传都通过加密连接传输，服务器密码和 SSH 密钥在设备上按第 13 节所述受到保护。在 TOMST 的服务器上，日志和崩溃报告只有负责支持和开发的 TOMST 工作人员可以访问，并按期删除。

您的测量文件是数据文件夹中的普通文件：能打开该文件夹的人以及您允许读取文件的应用都能读取它们。它们的安全取决于您设备的锁定、文件夹的位置以及您同步的服务。没有任何系统是绝对安全的。如果发生影响您所发送信息的安全事件，我们会依法通知有关部门；在我们有您的联系方式时通过该方式通知您，否则在 tomst.cn 上发布公告。

21. 未满 14 周岁的儿童

本应用面向成年人的专业、科研和技术工作，不面向未满 14 周岁的儿童；应用不核验任何人的年龄。我们不会在知情的情况下收集儿童的个人信息。如果您是父母或其他监护人，并认为有儿童通过本应用向我们发送了内容，请写信至 tomst@tomst.com，我们会删除它。

22. 本政策的变更与历史版本

当本政策发生实质性变更时，TOMST 会在 tomst.cn 上发布新文本并同时发布应用更新，应用会在该更新之后的首次启动时展示新文本并再次请求您的同意。在您同意之前，除获取这两份文本外，应用既不检查更新，也不向 TOMST 发送任何内容；您此前设置的自动导出会继续上传到您自己的服务器。您可以随时在应用的"关于"页面阅读两份文本；应用每次都从 tomst.cn 获取它们，因此需要联网，并且不在设备上保留副本。版本日期标在文本开头。

本政策的现行版本发布在 https://tomst.cn/TOMSTLolly-china/Android/legal/privacy/。TOMST 保存历史版本及其日期；您有合理需要时，可以写信至 tomst@tomst.com 索取曾适用于您的版本。

23. 投诉与联系方式

如果您对我们处理信息的方式不满意，请先写信至 tomst@tomst.com 或联系我们在中国大陆的联系方（第 1 节），让我们有机会改正。您也有权向国家互联网信息办公室投诉举报（举报电话 12377，网址 www.12377.cn）；对于应用权限和行为方面的问题，可以向工业和信息化部的举报受理中心投诉举报（12321，网址 www.12321.cn）。依据 GDPR，您也可以向数据保护监管机构投诉，特别是负责 TOMST 的捷克个人数据保护办公室（Úřad pro ochranu osobních údajů，Pplk. Sochora 27, 170 00 Praha 7, Czech Republic，网址 www.uoou.gov.cz）。

隐私事务：tomst@tomst.com。技术支持：app@tomst.com。中国大陆联系方：上海赛弗生物科技有限公司，电子邮箱 1364685620@qq.com。

TOMST Lolly Privacy Policy

Application: TOMST Lolly, China edition (Android)

Version 2026-10-22. Effective date and last updated: 22 October 2026.

This policy is published in Chinese and in English. Both texts have the same meaning. If they ever differ, the Chinese text applies to users in mainland China. Your agreement covers both texts, whichever one you read.

1. Who handles your information and how to reach us

TOMST Lolly is developed and provided by TOMST s.r.o., a company registered in the Czech Republic (Michelská 964/78, 141 00 Praha 4, Czech Republic; VAT number CZ27139140), which also runs the server tomst.cn that the app connects to. In this policy "we" and "TOMST" mean TOMST s.r.o.

Privacy questions and requests: tomst@tomst.com. Technical support and diagnostic logs: app@tomst.com.

Our contact in mainland China is SHANGHAI SAFE BIOTECH CO LTD (上海赛弗生物科技有限公司), email 1364685620@qq.com. You can write to them in Chinese about anything in this policy; they pass your request to TOMST and TOMST answers. SafeBio distributes TOMST's hardware in mainland China and links to the app's download page; it does not host, sign, change or distribute the app, and it receives no information from it.

Who is responsible for what. Under the Personal Information Protection Law of the People's Republic of China, TOMST is the personal information handler for how the app handles personal information, including asking for your consent before it uses your location (section 11), and for the personal information TOMST receives: the requests the app makes to tomst.cn (section 7), the diagnostic logs and crash reports you send (sections 8 and 9) and the emails you write to us (section 10). Under the EU General Data Protection Regulation (GDPR), which applies because TOMST is established in the European Union, TOMST is the controller of what it receives. What the app stores on your device, such as measurements, site names, notes, photos and positions, stays under your control or that of the organisation you work for, which decides what is recorded and what happens to it; TOMST does not receive this information, has no access to it, and designs the app so that it stays on the device unless you send it out.

This edition of the app is made only for users in mainland China.

2. Summary

  • Lolly needs no account and works without internet. Your measurements, sites, notes and photos stay on your device unless you yourself send, share, export or upload them.
  • The app contains no advertising, analytics or tracking, and no TOMST server collects your measurements by itself.
  • The app connects to tomst.cn by itself in two cases only: at the first setup, before you agree, to fetch this policy and the User Agreement so that you can read them; and after you agree, at each start, to check for a newer version and for a notice from TOMST. These requests carry no identifier of you or your device; the server uses your connection's IP address only to answer and does not keep it (section 7).
  • Everything else leaves the device only when you decide: a diagnostic log or a crash report you send to TOMST, each time behind a box you tick (a log contains the measurements and serial numbers of the dataloggers it covers, a crash report contains no measurements), an email you send from your own email app, an upload to your own server that you set up, or a file you share or export.
  • Location is optional and stays on your device.

3. What this policy covers

This policy explains what the China edition of TOMST Lolly for Android does with information: what stays on your device, what leaves it, where it goes, how long it is kept and what your rights are. Section 6 lists everything that can leave the device.

Lolly is companion software for TOMST dataloggers: it downloads their measurements through TOMST's USB adapter, shows them and saves them. It has no user accounts, subscriptions, payments, advertising, social features or features for publishing content to other users, and no cloud storage of its own. It is installed from the download page on tomst.cn, not from an app store. TOMST has no server, office or company in mainland China. The app is intended for professional, scientific and technical work by adults, not for children under 14 (section 21).

4. No account, no registration

Lolly has no user accounts. You do not register or sign in, and you do not give us your name, phone number or email address to use the app.

The app records on your device which versions of this policy and of the User Agreement you accepted, so that it can ask you again when a text changes; it does not send that record to TOMST. If the download page on tomst.cn asks you to confirm your acceptance before a download, TOMST keeps no record of that confirmation either. The only account details you ever enter are those of your own server, if you set up Auto export (section 13).

5. What stays on your device

Lolly stores its work in a data folder you choose during setup (by default Documents/Lolly) and in the app's private storage, which other apps cannot normally read:

  • the measurement files downloaded from your dataloggers, and files derived from them (for example soil moisture conversions and repaired copies);
  • what you add to a download: a site name, a note, photos;
  • what Lolly records with a download: the date and time, the datalogger's serial number, type and firmware, how full its memory was, how far its clock was off, how the download ended, and the position, if you allow location;
  • logs of the communication with the datalogger (below), and crash reports until you send or delete them (at most 30 days, the 40 most recent);
  • the app's database, the backups you create, your soil calibrations and your settings, including which versions of these texts you accepted;
  • if you use Auto export, your server's address, your user name and password or SSH key, and the list of files waiting to be uploaded;
  • temporary files, for example an archive being prepared for sharing.

None of this is sent to TOMST by itself. Lolly's private storage is left out of Android's automatic backup and of the transfer to a new device, so on a new device Lolly starts empty; your data folder and your own backups are how you move your work.

Logs. Lolly saves a raw log with each download in your data folder, and keeps diagnostic logs of recent sessions with the adapter in its private storage, where older ones are removed automatically. Both are complete records of the communication between Lolly and the datalogger: they contain the measurements themselves, the serial numbers and firmware of the datalogger and the adapter, the app version and the device's make, model and Android version. They do not contain your position, site names, notes or photos. Treat a raw log like the measurement file it belongs to.

6. What leaves your device

This is the complete overview; the sections named give the details. The China edition uses no Google service and contains no third-party advertising, analytics or tracking component (section 16).

Connections the app makes by itself, to tomst.cn only:

  • fetching this policy and the User Agreement in your language, at the first setup before you agree and whenever you open them (section 7);
  • the update check and the look for a notice from TOMST at each start after you agreed, and the download of a new version once you confirm it (section 7).

Only when you decide:

  • an update check when you tap Check for updates (section 7);
  • diagnostic logs you send to TOMST (section 8);
  • crash reports you send to TOMST (section 9);
  • emails you write to TOMST with your own email app (section 10);
  • uploads to your own server, once you set up Auto export (section 13);
  • files you share, export or back up yourself (section 14).

The app does not send your measurements, position, photos, notes or site names to TOMST automatically. TOMST receives them only inside a log, an email or an attachment that you chose to send.

7. Automatic requests: the legal texts and the update check

What the requests carry. The update check, the download of an update and the look for a notice carry the app version and version code, the edition, the Android version and a fixed code that identifies the app, not you; the requests for the two texts carry only the app version, the edition and the Android version. Like every internet connection, they also reveal your connection's IP address to the server. They carry no identifier of you, of your device or of this installation, and the app sends no separate "installed" message.

How the server handles them. tomst.cn is run by TOMST on rented hardware in Hong Kong. It uses the IP address only to answer the request and writes it into no log of these requests. Only a connection that fails before any request is made, or a stray packet that the server's firewall blocks, can leave an address in the server's general error or firewall log, for up to four weeks and without anything about the app. The hosting companies that provide the hardware in Hong Kong and Germany may keep network data of their own. For updates, the server keeps only daily counts of requests: update checks per app version, edition and Android version; downloads per app version, the completed ones also per edition; and requests turned away because too many arrived at once. These are counts of requests, not of devices: a device that starts the app several times a day is counted several times, and the counts cannot tell one device from another. The requests for the legal texts are not counted.

Installing an update. When a newer version is offered, the app tells you what it brings and asks you to confirm, in a box that is never ticked in advance, that you have read the User Agreement and this policy; on mobile data it also tells you the size of the download and asks before downloading. The first time, Android asks you to allow Lolly to install apps (section 15). Before installing, the app checks that the file is complete and signed by TOMST, and then Android asks its own question. Nothing is downloaded or installed without your confirmation.

Notices from TOMST. At each start after you agreed, the app also asks tomst.cn whether TOMST has a notice about the app or the equipment, for example about a fault, a security problem or the end of the beta, and shows it in your language. This request carries the same information as the update check and is not counted. A notice holds only text and possibly a link to tomst.cn; it cannot change anything in the app or on your device. You can tick "Don't show again" to stop a notice; otherwise it is shown again at the next start.

Why the requests are needed. A beta version stops working on its end date (User Agreement, section 4), and faults and security problems are fixed only through new versions, so without the check the app could stop, or stay faulty, without telling you. The counts show TOMST which versions are still in use, so that it knows when an old one can be retired. The texts are fetched before you agree because you cannot agree to texts you have not been able to read.

Legal basis. Under the Personal Information Protection Law, the update check, the look for a notice and the update download are necessary to perform the User Agreement with you (Article 13(1)(2)), and fetching the two texts before you agree is necessary to conclude it (same article). Under the GDPR, the update check, the look for a notice and the update download rest on TOMST's legitimate interest in keeping the app it provides secure and up to date, in telling you about faults and in knowing which versions are in use (Article 6(1)(f)), and fetching the two texts is a step you take towards the agreement by starting the app (Article 6(1)(b)). Agreeing to this policy is not the legal basis for these requests. Because they carry no identifier, their IP address is not kept and nothing links one request to another, their effect on you is limited.

Your right to object. Under the GDPR you can object to the update check and the look for a notice at any time (section 19) by writing to tomst@tomst.com; TOMST will consider your objection and answer it. The app has no switch for the check, so the immediate way to stop the requests is to use the app without an internet connection; all its core functions work that way.

8. Diagnostic logs you send to TOMST

Several buttons prepare a diagnostic archive: "Send logs to TOMST" and "Email logs to TOMST" (in Settings, in the graph's data tools and in the message shown when a datalogger looks faulty), "Send feedback" in Settings, and "Send to TOMST" on the card of a file Lolly cannot read. Lolly never sends the archive by itself. A dialog shows one box, never ticked in advance: "I have read the privacy policy and agree to send this diagnostic log to TOMST for technical support, including processing outside mainland China. I know it holds the measurements and serial numbers of the dataloggers it covers." The privacy policy opens from the same dialog, and the box is asked again for every send. Only after you tick it can you choose:

  • "Send to TOMST": the archive is uploaded over an encrypted connection to tomst.cn and stored on TOMST's server in Germany. You get a reference number to quote when you contact us. The server stores the archive with the date, the app version, the kind of send and the reference, and no IP address.
  • "Prepare an email": your own email app opens with the archive attached and app@tomst.com as the recipient. It is sent only if you press send, and we then also receive your email address.

A switch, "Just a bug report, no reply needed", is on for every new send. If you want TOMST to answer, switch it off and enter your email address: it travels with the archive, is kept with it and is used only to reply to you about that send.

What an archive can contain:

  • a short report: the note you typed, the app version and edition, the Android version and build, the device's make, model and memory, the time of creation, a list of the app's recently handled errors (their kind and place in the code, without file paths or message texts), and the names and sizes of the files in the archive;
  • the diagnostic logs (section 5) of the datalogger concerned and, within the size limit, of other dataloggers recently used on this device, with the measurements of those downloads and the serial numbers and firmware of the dataloggers and the adapter;
  • when something failed, the record Lolly set aside at that moment, and when a datalogger looks faulty, a short technical report about it;
  • records of firmware updates, if you tick them in Settings.

Not in the archive: your position, site names, the notes you attached to downloads, photos, your settings, the measurement files as files, and the raw logs kept with your downloads.

Serial numbers. A datalogger's serial number identifies a device, and TOMST may be able to link it to a customer through its sales or service records. We use such a link only to answer you and to help with your equipment and data, and we build no profile of people from it.

Purpose: to answer your support request, to find the cause of a fault in the app, the adapter or the datalogger, and to help with your data when you ask. Legal basis: your consent, given by ticking the box for that send (Personal Information Protection Law, Articles 13(1)(1), 14 and 39; GDPR, Article 6(1)(a)), which also covers an email address you add for a reply. Sending is voluntary, and nothing else in the app depends on it. Retention: section 18.

9. Crash reports you send to TOMST

When the app closes unexpectedly or stops responding, it writes a report on your device and sends nothing. At the next start it asks you once whether to send it, behind a box that is never ticked in advance: "I have read the privacy policy and agree to send this crash report to TOMST for technical support, including processing outside mainland China. It holds no measurements." The same reply switch as for logs is on; switched off, you can enter your email address, which travels and is kept with the report. A report you do not send stays on the device for up to 30 days. In Settings, under "Crashes and logs", you can see every report kept on the device with its date and app version, send any of them (again behind the box) or delete them.

A report contains: the app version, edition and build; the device's make and model, the Android version, the processor type, the app's language and the size of its memory as a rough class; how long the app had been running and how much memory it used; the error with its stack trace and how Android ended the app; the state of the app at that moment, such as the screen that was open, the state of a download, whether the phone's clock had been checked against satellite time, and what kind of storage your data folder is on (never its name or path); the app's recent event log, with times to the minute and without anything you typed; counts of repeated crashes and of handled errors; and the type and firmware of the connected datalogger.

The app puts no identifier of you or your device into a report, and no position, region or time zone, measurements, photos, notes, site names or folder, file or server names. Serial numbers of dataloggers and adapters are not sent as fields of a report, and the app removes from the report's texts the serial numbers it met while it was running, file names, addresses and email addresses (other than yours, if you entered it for a reply). These filters run automatically; they greatly reduce, but cannot completely rule out, that an error message still contains something identifying.

A report you send travels over an encrypted connection to tomst.cn and is stored on TOMST's server in Germany with the date and the app version, without any IP address. Purpose: to find and fix faults in the app. Legal basis: your consent, given by ticking the box for that report (Personal Information Protection Law, Articles 13(1)(1), 14 and 39; GDPR, Article 6(1)(a)); sending is voluntary. Retention: section 18.

10. Emails you send to TOMST

Lolly never emails anyone by itself. Its email options open your own email app with a message addressed to app@tomst.com, which you can read, change, strip of its attachment or close; it is sent only if you press send. Such an email contains what you wrote, technical details of the app and the device (app version, Android version, make, model and memory) and, if you chose so, the archive described in section 8. We also receive your email address.

We use these emails to answer you, to find the cause of a problem, to help with your data and to improve the app and the dataloggers. They go to TOMST in the Czech Republic through your own email provider. Legal basis: your consent, given by sending the email (Personal Information Protection Law, Articles 13(1)(1) and 39); under the GDPR, TOMST's legitimate interest in answering you and solving the problem you raise (Article 6(1)(f)). Retention: section 18.

11. Location

Precise location can be sensitive personal information under Chinese law, and Lolly treats it as such. In Lolly it is optional: the setup step says what it is for before Android asks for the permission. You can skip it, refuse it, or withdraw it later in Android's settings or by switching GPS off in Lolly's Settings.

If you allow it, Lolly uses your position to:

  • record where a download was made (latitude, longitude, altitude above sea level and the accuracy of the fix), saved with that download on your device;
  • suggest a name for the place, looked up on the device from map data built into the app, without sending your coordinates to any online service;
  • show your position, region and altitude on the Home screen;
  • check the phone's clock against satellite time before Lolly sets a datalogger's clock;
  • add coordinates to a photo you attach, when the photo has none of its own.

Lolly uses your position while the app is open and does not ask for background location. A download can continue with the screen off; meanwhile Lolly may check the phone's clock against satellite time, and when the download finishes it saves the last position the phone already had.

GPS coordinates are in the WGS-84 system. So that you can use them in Amap, Tencent Maps or Baidu Maps, the app also shows them converted to GCJ-02 and BD-09; the conversion happens on the device and the data files keep the original coordinates. If you tap a saved position, Lolly opens it in the map app you choose and hands that app the coordinates.

If you refuse, only what depends on the position changes: downloads are saved without coordinates and without a suggested place name, the Home screen shows no position, region or altitude, photos you attach get no coordinates from Lolly, and Lolly cannot check the phone's clock against satellite time before it sets a datalogger's clock, so it relies on the phone's clock as it is. Downloading, viewing, saving and exporting measurements work as before.

What this means for you: saved coordinates show where you work, and anyone you give a file with them to learns those places. The coordinates stay with the download on your device and leave it only inside files you export, share, back up or upload with Auto export (the download's info file, map files and photos). They are never part of a crash report or a diagnostic log, and TOMST receives your position only if you send it to us yourself, for example in a file attached to an email.

Legal basis: your separate consent, given on the setup step that states the purpose and then in Android's own permission question (Personal Information Protection Law, Articles 13(1)(1), 29 and 30), which you can withdraw at any time as described above.

12. Photos

You can attach photos to a download, taken with your camera app, picked from the device or shared into Lolly from another app; Lolly itself has no camera permission. Lolly writes into an attached photo's metadata (EXIF) the serial number of the datalogger and, when the photo has no coordinates of its own and Lolly knows the position, the coordinates of the place. Other metadata already in the photo stays in it.

Photos stay on your device and leave it only inside an export, a share, a backup or an Auto export upload that you set to include photos. Because their metadata travels with them, a photo you pass on can reveal the datalogger, the place and whatever the photo already recorded.

13. Auto export to your own server

Auto export is off until you set it up in Settings. Once it is on, every finished download is uploaded by itself to the destination you chose: your own WebDAV server (for example Nutstore or Nextcloud) or SFTP server. Uploads run in the background and follow your "Only on Wi-Fi" setting.

Lolly talks to your server directly; TOMST is not in between and gets no copy. You enter the server's address, a user name and a password; for SFTP you can use an SSH key instead, which Lolly can create on the device or import. The private key stays on the device and is never sent to TOMST, to the server or into any backup; if you gave your server Lolly's public key, remove it there when you no longer want Lolly to connect. Lolly refuses to connect to an SFTP server whose identity has changed until you confirm it.

What is uploaded: in "Auto export" mode, each download as readable files (the measurement file; an info file with the site name, your note, the coordinates and what Lolly recorded about the download; the map files you select; the soil-converted file and the site photos if you switch them on; and the download's raw log). In "Auto backup" mode, each download as one backup file holding the same information, plus your app settings. Passwords and keys are never part of a backup.

Security: uploads travel over an encrypted connection (HTTPS or SSH). Server passwords and private keys are stored on the device encrypted with a key held by the Android keystore.

Responsibility: you choose the destination and what is uploaded, and the destination's operator handles the files under its own terms; the destination may be outside mainland China. TOMST provides this function of the app and is responsible for it working as described here, but does not receive the uploaded data or decide what happens to it there.

Stopping it: pause or turn off Auto export and uploads stop. Deleting the server in Settings removes its saved details from your device. Lolly never deletes anything on your server.

14. Files you share, export or back up yourself

Lolly can share or save an archive of the downloads you select, save a chart as a picture and create a backup of its database. Each time, you decide where the file goes. Such files can contain measurements, datalogger serial numbers, site names, notes, coordinates and photos with their metadata (sections 5, 11 and 12). Once you hand a file to another app or person, it is handled under their rules, so please consider what you pass on, especially other people's information.

15. Permissions

The permissions the China edition holds, and why:

  • Location (precise and approximate): optional, section 11.
  • Notifications: needed. While Lolly talks to a datalogger, Android shows a notification, which is what lets a download continue with the screen off; Lolly also uses notifications for the progress and results of downloads, exports and uploads, never for marketing.
  • USB device: Android asks you when you plug in the adapter.
  • Internet and network state: the automatic requests (section 7), the sends you choose and Auto export.
  • Install apps: only to install an update downloaded from tomst.cn, and only after your confirmation (section 7). The first time, Android opens its own "Install unknown apps" setting so that you can allow Lolly; you can switch it off there at any time, and Lolly will ask again at the next update.
  • Storage (Android 9 only): to save a photo from Lolly's photo viewer to the gallery.
  • Permissions that give the app no access to your personal information: running in the foreground and keeping the device awake while a download or firmware update runs, continuing a waiting upload after a restart, vibration, and fast sensor readings for rain mode.

Your data folder needs no storage permission: you choose it in Android's own folder picker, and Lolly can use only that folder. Lolly also reads the motion, pressure, light and proximity sensors, which need no permission; their readings are used on the spot and are neither saved nor sent. Lolly does not ask for the camera, the microphone, contacts, calendar, phone, messages, Bluetooth or background location, and reads none of the device's own identifiers.

16. Third parties and service providers

The app shares personal information with no third party by itself. These parties can receive something, and only on your action: the operator of your own server, when Auto export uploads to it (section 13); the map app you choose, when you tap a saved position (section 11); your email app and email provider, when you send an email (section 10); the camera app and any app you share a file with (sections 12 and 14); and your browser, when you open a link from the app.

Service providers: TOMST rents the hardware of its servers in Hong Kong and in Germany from hosting companies, which provide the machines and the network on which tomst.cn and TOMST's storage server run.

Third-party code: the app contains no advertising, analytics or tracking component. It contains open-source components and, in its code, a crash-reporting library made by Google (Firebase Crashlytics) with the Firebase libraries it depends on. In this edition the app does not start them, and they are not used to collect or send anything.

17. Information sent outside mainland China

TOMST s.r.o. is in the Czech Republic. The tomst.cn server is in Hong Kong, and the logs and crash reports you send are stored on TOMST's own server in Germany:

  • The automatic requests (section 7) reach only the Hong Kong server, where the request and your connection's IP address are handled for the length of the connection and not kept, apart from the exception section 7 describes.
  • A diagnostic log or crash report you send passes through the Hong Kong server to TOMST's server in Germany; the Hong Kong server passes nothing about your connection on.
  • An email you send goes to TOMST in the Czech Republic through your own email provider.

What the Personal Information Protection Law asks us to tell you about this: the overseas recipient is TOMST s.r.o. (contact in section 1); the purpose of the automatic requests is to provide updates and the current texts, and the purpose of what you send is technical support and finding and fixing faults; the information is what sections 7 to 10 describe and nothing more; it is transferred over encrypted connections, stored on TOMST's servers, accessed only by the TOMST staff who handle support and development, and deleted as section 18 says; and you exercise your rights towards TOMST by writing to tomst@tomst.com or through our contact in mainland China, as section 19 describes.

Consent: the automatic requests rest on the performance of the User Agreement (section 7), so no separate consent is asked for them; you avoid them only by using the app without an internet connection. For each diagnostic log or crash report, ticking its box is your separate consent to that one transfer, and nothing is transferred without it. Pressing send in your email app is your consent to that email.

Under the GDPR, what you send is stored inside the European Union, on TOMST's server in Germany or, for emails, at TOMST in the Czech Republic; the Hong Kong server only passes it on. Uploads with Auto export go where you point them (section 13).

18. How long information is kept and how it is deleted

On your device: what you create or download stays until you delete it. Lolly removes crash reports by itself after 30 days and older diagnostic logs automatically. Uninstalling the app, or "Clear storage" in Android's settings, removes Lolly's private storage (its database, settings, server password, SSH key, diagnostic logs and crash reports). Your data folder stays on the device, and anything you uploaded, shared or emailed stays where you sent it until you delete it there.

At TOMST:

  • an uploaded diagnostic log is deleted 180 days after it arrived; it is kept longer only while a support case about it, or about the same equipment, is still open, and is deleted when the case ends;
  • a crash report is deleted 180 days after it arrived;
  • an email is kept as long as needed to handle your request and to understand later problems with the same equipment;
  • the update counts identify nobody; an address that reached the general error or firewall log (section 7) is gone within four weeks.

You can ask for anything you sent to be deleted earlier at any time (section 19). Where the law requires TOMST to keep something longer, it is kept only as long as required.

19. Your rights and how to exercise them

Under the Personal Information Protection Law of the People's Republic of China you have the right:

  • to know and to decide how your personal information is handled, and to restrict or refuse it: this policy is the explanation, and you can decline it and not use the app;
  • to access and copy: what the app holds is on your device, where you can view and export it at any time; for anything you sent us, you can ask us for a copy or, where the conditions set by law are met, for its transfer to another handler you name;
  • to correct and complete: change site names, notes and photos in the app, and tell us if something you sent us is wrong;
  • to delete: delete anything on the device yourself, and ask us to delete a log, a crash report or an email you sent;
  • to withdraw consent: for location, take the permission back in Android's settings or switch GPS off in Lolly's Settings; for a log or crash report you already sent, the upload itself cannot be undone, but you can withdraw your consent to keeping it at any time by writing to tomst@tomst.com or app@tomst.com, and we then delete it. Withdrawing does not affect what was done before, and every new send asks you again;
  • to ask us to explain this policy or how we handle your information;
  • for the close relatives of a deceased user, to exercise these rights on the deceased person's own information, unless the person arranged otherwise.

Under the GDPR you have, for what TOMST holds about you, the right of access (Article 15), to rectification (Article 16), to erasure (Article 17), to restriction of processing (Article 18), to receive what you sent with your consent in a portable form (Article 20), to object at any time to processing based on TOMST's legitimate interest, such as the update check (Article 21), and to withdraw a consent at any time without affecting what was done before (Article 7(3)). TOMST makes no decision about you by automated means alone and does no profiling (Article 22).

How to make a request: write to tomst@tomst.com or to our contact in mainland China (section 1). Because the app has no accounts, please tell us the reference number of an uploaded log, or the date and app version of a crash report (Settings, "Crashes and logs" shows them), so that we can find it. We ask only for what we need to find the information and to be reasonably sure that the request concerns your own data, and we charge nothing for a reasonable request. We act on a request without undue delay and reply within 15 working days. A request under the GDPR is completed at the latest within one month of receipt; where it is complex or one of many, the GDPR allows up to two further months, and we then tell you within the first month why it takes longer. If we cannot do what you ask, we tell you why and how you can complain (section 23).

20. Security

Sends to TOMST and uploads to your own server travel over encrypted connections, and server passwords and SSH keys are protected on the device as section 13 describes. On TOMST's servers, access to logs and crash reports is limited to the TOMST staff who handle support and development, and they are deleted on schedule.

Your measurement files are ordinary files in your data folder: anyone who can open that folder can read them, and so can apps you have allowed to read your files. Their safety depends on your device's lock, on where the folder is and on the services you sync it with. No system is completely secure. If a security incident affects information you sent us, we inform the authorities as the law requires, and we inform you by the contact you gave us where we have one, or otherwise by a notice on tomst.cn.

21. Children under 14

The app is made for professional, scientific and technical work by adults and is not for children under 14; the app does not check anyone's age. We do not knowingly collect personal information from children. If you are a parent or guardian and believe that a child has sent us something through the app, write to tomst@tomst.com and we will delete it.

22. Changes to this policy and earlier versions

When this policy changes in substance, TOMST publishes the new text on tomst.cn together with an app update, and at the first start after that update the app shows the new text and asks for your agreement again. Until you agree, the app neither checks for updates nor sends anything to TOMST, apart from fetching these two texts; an Auto export you set up earlier keeps uploading to your own server. You can read both texts at any time on the app's About page; the app fetches them from tomst.cn each time, so this needs an internet connection, and it keeps no copy on the device. The version date stands at the top.

The current version is published at https://tomst.cn/TOMSTLolly-china/Android/legal/privacy/. TOMST keeps the earlier versions with their dates and, on a reasonable request, provides you with the version that applied to you, at tomst@tomst.com.

23. Complaints and contact

If you are unhappy with how we handle your information, please write first to tomst@tomst.com or to our contact in mainland China (section 1), so that we can put it right. You also have the right to complain to the Cyberspace Administration of China (reporting hotline 12377, www.12377.cn) and, for matters about the app's permissions and behaviour, to the reporting centre of the Ministry of Industry and Information Technology (12321, www.12321.cn). Under the GDPR you can also complain to a data protection supervisory authority, in particular to the one responsible for TOMST, the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, Pplk. Sochora 27, 170 00 Praha 7, Czech Republic, www.uoou.gov.cz).

Privacy: tomst@tomst.com. Support: app@tomst.com. Mainland China contact: SHANGHAI SAFE BIOTECH CO LTD, email 1364685620@qq.com.