Privacy policy

1. Who we are

Tandem is operated by [company name, registered address and registration number, to be added before launch] (“Tandem”, “we”). We are the controller of the personal data described in this policy.

For any privacy question or request, write to [email protected].

2. Who this policy covers

• Members who use the Tandem apps for iPhone and Android and the web app, with or without an account.
• Visitors to the tandem.app website, including people who open an invite link.

A household in Tandem is shared by its members. What you add to a shared household (expenses, settlements, comments) is visible to the other member by design. Your income and your account details are not.

3. What data we process

Account

• Your name, email address and, if you set one, a password. We store passwords only as a hash (Argon2), never in readable form.
• If you sign in with Apple or Google: the account identifier and email address they share with us.
• Passkeys: the public key and identifiers of each passkey you register. The private key never leaves your device.
• Your language and time zone, and whether you’ve verified your email address.

Joining without an account

When your partner invites you, you can join without an account. We then keep the name you enter, a random identifier of your device or browser, and a session bound to it. Invite links are single-use and expire after 14 days; we store only a fingerprint (hash) of the link’s secret, not the secret itself.

Your household

• The household’s name, currency and time zone, and each member’s display name and role.
• Expenses: amount, currency, description, date, category, who paid and how it is split, and whether it repeats.
• Settlements between members, comments and emoji reactions on expenses, and your own categories.
• A history of changes (who created, edited or deleted what, and when), so both of you can see what happened.

Income and payment details

• Income: if you enter your monthly net income, we store it encrypted and show it to no one but you. Your partner sees only the resulting split ratio.
• Payment details: if you save a Revolut tag, PayPal.me name, Venmo name or IBAN, we store it encrypted and show it to your partner so they can pay you when settling up. Tandem never moves money.

Receipts

When you scan a receipt, we store the photo or PDF and what we read from it (shop, date, total, line items, category). Before it is read, every image is converted to a plain JPEG without metadata, so no location data is sent.

Imports and exports

• If you import a Splitwise CSV export, we read the expenses and settlements in it into your household.
• When you request an export, we generate a file with your household’s data and send you a download link.

Devices, notifications and security

• For each sign-in session: a random device identifier, the browser or app (user agent) and a hashed refresh token.
• For push notifications: the push token of your device, its platform and language.
• Server logs (IP address, time, request) that we need for security and to keep the service running.
• Records of AI usage (which feature, how many tokens, the cost), without the content, for cost accounting.

Error reports and product analytics

• Error reports (Sentry): a technical description of an error, the app version, the browser or device. Form contents are not included.
• Product analytics (PostHog), in the web app: a short list of events such as “household created” or “expense created”, tied to a random identifier and, once you sign in, to your internal user ID. Events never include amounts, descriptions, shop names, names or email addresses. The web app keeps the identifier in your browser’s local storage. The mobile apps don’t send analytics.

The tandem.app website

The website sets no cookies, runs no analytics and loads no third-party scripts; our fonts are hosted on our own server. When you open an invite link, the page reads the invite from the address in your browser and sends it only to our own API, to show who invited you. Requests to invite links are not written to our server logs.

4. Why we process it and on what legal basis

Purpose	Legal basis (GDPR Art. 6(1))
Providing Tandem: accounts, households, expenses, balances, receipts	Contract (b)
Invites and joining without an account	Contract (b)
Sending emails you need: verification, password reset, export links	Contract (b)
Push notifications about your household	Contract (b); you can turn each type off in the app
Security, abuse prevention and rate limiting	Legitimate interests (f): keeping accounts and data safe
Error reports	Legitimate interests (f): finding and fixing faults
Product analytics in the web app	Legitimate interests (f): learning which features help
Keeping records the law requires	Legal obligation (c)

We don’t use your data for advertising, we don’t sell it, and we don’t make decisions about you based solely on automated processing.

5. Who receives your data

Your partner. Members of a household see its shared data: expenses, settlements, comments, member names, the income ratio and the payment details a member saved for settling up.

Service providers that process data on our behalf, under a data processing agreement:

Provider	What for	Data
Our hosting provider (EU)	Servers, database, file storage, backups	All data described above
Anthropic	Reading receipts you scan	The receipt image; never your name, email or income
Expo (with Apple and Google push services)	Delivering push notifications	Push token, notification text (for example who added an expense)
Unsend	Sending email	Email address, email content
Sentry (EU region)	Error reports	Technical error data, device and browser details
PostHog (EU region)	Product analytics in the web app	Events and identifiers as described in section 3
Apple, Google	Sign in with Apple or Google, if you use it	What you authorise them to share

Anthropic processes receipt images under its commercial terms, which do not allow using them to train its models.

We may disclose data when the law requires it, for example to a court or authority with a valid order.

6. Transfers outside the EU

We host your data in the European Union. Some providers above (for example Anthropic and Expo) are based in the United States and may process data there. Such transfers rely on the EU–US Data Privacy Framework where the provider is certified, or on the European Commission’s standard contractual clauses.

7. How long we keep data

Data	Kept
Account and household data	While your account or household exists
Deleted expenses, settlements and comments	30 days, then permanently deleted
Receipts	With their expense; discarded or unreadable ones for 30 days
Export files	7 days
Server logs	30 days
AI usage records (no content)	24 months
A household no member uses any more	30 days after the last member leaves, then deleted
Backups	Deleted data ages out of backups on their rotation

8. Deleting your account

You can delete your account in the app at any time. Your account, sign-in methods, sessions, devices, income and the recurring expenses you pay are deleted right away. If your partner stays in the household, the expenses you shared stay with them and show your name as plain text, because they are part of their history too. If you were the last member, the household and everything in it are deleted within 30 days.

9. Your rights

You have the right to access your data, to correct it, to have it deleted, to restrict or object to its processing, and to receive it in a portable format. Most of this you can do yourself in the app: edit your details, export all household data as CSV or JSON, or delete your account. For anything else, write to [email protected]; we reply within one month.

If you believe we process your data unlawfully, you can complain to a supervisory authority. In Slovenia that is the Information Commissioner (Informacijski pooblaščenec, www.ip-rs.si); you can also contact the authority where you live.

10. Security

Data travels only over encrypted connections. Incomes, payment details and other sensitive fields are encrypted in the database. Files are private and reachable only through short-lived links. Access by our team is limited, logged, and used only for support and security.

11. Age

Tandem is meant for adults. You must be at least 18 to use it.

12. Changes to this policy

When we change this policy, we update the date at the top. If a change affects you materially, we tell you in the app or by email before it takes effect.