Privacy Policy

Effective date: November 4, 2026 · Previous version: February 1, 2026

This Privacy Policy explains how personal data is processed when you use the Tandem mobile app (iOS and Android), the website tandem-app.eu, and related emails and notifications (together, the "Service"). We wrote it to be read, not skimmed: it lists every category of data we process, why, on what legal basis, with whom it is shared, how long it is kept, and what rights you have.

1. Who is responsible (controller)

The controller under the EU General Data Protection Regulation (GDPR) is:
Bruno Petković, independent developer of Tandem, Croatia
(Tandem is currently operated by an individual developer, not a company. Our postal address is provided on request to the email below, including for legal notices.)
Email: privacy@tandem-app.eu · Support: support@tandem-app.eu

We have not appointed a data protection officer because we are not legally required to. Questions about privacy go to the email above.

2. What data we process

Account data: email address; password (stored only as a hash by our authentication provider) or, if you use Sign in with Apple or Google, the identifier and email the provider shares with us (Apple may give us a private relay email).
Profile data: display name, optional profile photo, language, currency, week start, theme, notification, haptics and widget settings, time zone.
Couple and pairing data: which account is paired with which, invite codes and links, pairing status and dates.
Content you create: to-dos and lists (including optional images), calendar events and reminders, expenses and income entries (amounts, currency, categories, split, dates, who paid), recurring items, custom categories, Weekly Sync answers and notes, reactions and activity history.
Device calendar data (only if you turn on calendar sync): for the calendars you choose, the event title, description, start and end time, all-day flag, calendar name and colour are uploaded so that your partner can see them in Tandem. You can turn this off at any time in Settings; synced events are then removed.
Subscription data: whether you or your partner has Premium, product, trial and renewal status, store (App Store / Google Play), purchase and expiry dates and an anonymous app user ID. We never receive your card or payment details; payment is processed by Apple or Google.
Notification data: push notification tokens, delivery status, quiet hours and your notification preferences.
Email data: service and reminder emails sent to you (for example trial-ending or Founding offer reminders) and their delivery status.
Feedback and support: what you write to us, screenshots or files you attach, app version and device platform. Feature ideas you post on our public feedback board (Featurebase) are visible to other visitors.
Usage analytics: app events (for example "expense added", "paywall shown"), screen names, app version, device model, operating system, language, country derived from IP, and a pseudonymous user ID. We do not use session recording, advertising IDs or cross-app tracking.
Diagnostics: crash reports and error logs (stack traces, device and app version). We configured crash reporting not to send IP-based personal data, screenshots or default personal information.
Website data: anonymous page and click statistics on tandem-app.eu (see section 10).

We do not ask for and do not want special categories of data (such as health, religion or sexual orientation). Please do not enter them into free-text fields. Finance entries are your own records; Tandem is not connected to your bank.

3. Why we process it and on what legal basis

Providing the Service (account, sync, pairing, sharing with your partner, reminders you set, widgets, calendar sync, Premium features) — performance of a contract (Art. 6(1)(b) GDPR).
Subscriptions and the Founding offer (checking entitlement, granting Premium to both partners, trial and renewal handling) — contract (Art. 6(1)(b)).
Service messages (security, account, pairing, trial-ending and subscription notices) — contract and legal obligation where consumer law requires notice (Art. 6(1)(b), (c)).
Offers by email to existing users (for example the Founding Couple offer) — legitimate interest in telling existing users about our own similar services (Art. 6(1)(f) GDPR and the e-privacy "existing customer" rule). You can object at any time by replying to such an email or writing to us, and we will stop sending them.
Push notifications — your consent given in the operating-system prompt (Art. 6(1)(a)); you can withdraw it in system settings or per type in Tandem.
Product analytics and diagnostics (understanding which features are used, fixing crashes) — legitimate interest in a reliable and useful product (Art. 6(1)(f)). You can object at any time by emailing us; we will then exclude your account from analytics.
Support and feedback — contract and legitimate interest in improving Tandem.
Security and abuse prevention, enforcing our Terms, legal claims — legitimate interest (Art. 6(1)(f)).
Accounting and tax records (where they exist) — legal obligation (Art. 6(1)(c)).

We do not sell personal data, do not use it for advertising profiles and do not make decisions with legal or similarly significant effect based solely on automated processing.

4. What your partner sees

Tandem is a shared app. Once you pair, your partner can see shared content: shared to-dos and lists, shared calendar events (including events synced from your device calendar, if you turn that on), shared expenses and balances, Weekly Sync answers you share, and your display name, photo and Premium status. Personal (private) items are not shown to your partner. Tandem has no separate "unpair" button: a pairing ends when one partner deletes their account. Then the content that person created (to-dos, events, expenses, Weekly Sync answers, photos) is deleted, and their name is removed from shared activity history. Content the other partner created stays in their account, except to-dos that were assigned to the person who deleted their account.

If you enter information about your partner or other people (for example in an expense note), you are responsible for having a right to do so. Please keep such notes minimal.

5. Who we share data with

We use these service providers (processors) under data processing agreements. They may only use data to provide their service to us.

Supabase Inc. — authentication, database, file storage, server functions. Data is stored on cloud infrastructure; where it is processed outside the EU/EEA, the safeguards in section 6 apply.
RevenueCat Inc. (USA) — subscription status and receipts validation.
PostHog Inc. — product analytics, hosted in the EU (eu.posthog.com).
Functional Software Inc. (Sentry) — crash and error reporting, hosted in the EU (Germany).
Resend Inc. (USA) — sending emails.
Expo / 650 Industries Inc. (USA), Apple and Google — delivering push notifications.
Google LLC (Google Workspace) — our support mailbox.
Featurebase — public feature-request board (only what you post there).
Apple and Google — as app stores they process purchases, refunds and sign-in as independent controllers under their own privacy policies.

We may disclose data if we are legally required to (for example a court order), to protect the rights and safety of users or others, or as part of a sale or restructuring of the Service, in which case this policy continues to apply.

6. International transfers

Some providers are based in, or access data from, the United States. Where data leaves the EU/EEA we rely on the EU–U.S. Data Privacy Framework for certified providers and/or the European Commission's Standard Contractual Clauses, plus the provider's additional safeguards. You can ask us for a copy of the relevant safeguards.

7. How long we keep data

Account, profile and content: as long as your account exists. When you delete your account, your personal data and the content you created are deleted from our live systems within 30 days; shared items that also belong to your partner are anonymised (your name removed) or deleted.
Device calendar data: until you turn off calendar sync, remove the calendar, or delete your account.
Backups: deleted data may remain in encrypted backups for up to 30 days until they are overwritten.
Analytics: up to 24 months, then deleted or aggregated.
Crash reports: up to 90 days.
Support emails and feedback: up to 24 months after the conversation ends.
Email delivery logs and push logs: up to 12 months.
Records we must keep by law: for the statutory period.

8. Your rights

Under the GDPR you have the right to:

access your data and get a copy;
correct inaccurate data;
delete your data ("right to be forgotten") — in the app via Settings → Delete account, or on the web at tandem-app.eu/support.html#delete-account;
restrict processing;
data portability (receive your data in a common machine-readable format);
object to processing based on legitimate interest, including analytics and offer emails, and to direct marketing at any time (email us and we stop);
withdraw consent at any time, without affecting earlier processing;
lodge a complaint with a supervisory authority — in Croatia the Agencija za zaštitu osobnih podataka (AZOP), Selska cesta 136, 10000 Zagreb, azop.hr — or the authority where you live or work.

Email privacy@tandem-app.eu. We answer within one month (extendable by two months for complex requests) and may ask you to confirm your identity from the email linked to your account.

California and other US residents: we do not sell or share personal information for cross-context behavioural advertising. You can use the rights above regardless of where you live.

9. Security

Data is encrypted in transit (TLS) and at rest by our hosting provider. Access to your content is limited by database row-level security to you and your paired partner. Administrative access is limited to the operator. No system is perfectly secure; if a personal data breach is likely to put you at risk, we will notify you and the supervisory authority as the law requires.

10. Website and cookies

The website tandem-app.eu uses privacy-friendly analytics (PostHog, EU hosting) configured without cookies and without storing anything on your device, with no session recording and no advertising. It counts page views and clicks on store buttons in a way that does not identify you. The mobile app does not use cookies.

11. Children

Tandem is for adults (18+). We do not knowingly process data of children. If you believe a child has created an account, contact us and we will delete it.

12. Changes

We will update this policy when the Service or the law changes. For material changes we will tell you in the app or by email before they take effect. The effective date above shows the current version.