Privacy policy.

This policy covers the Tandem app — the web app at go.tandemapp.xyz, the desktop apps for macOS, Windows and Linux — and this marketing site at tandemapp.xyz. It applies to both sides of your account: everything on the Personal side and everything on the Business side is handled the same way, under the same rules.

When we say Tandem, we or us, we mean Tandem App LLC, the company that operates the service. When we say you, we mean anyone with an account, and anyone who visits this site.

Most of what we hold is what you put into Tandem to use it.

• Account details. Your email address, password (stored only as a hash), and the display name, avatar and status you set for each side. Personal and Business personas are stored separately; nothing on one side references the other.
• Google account, if you choose. Signing in with Google gives us your Google email address, name and profile picture. It is optional — an email address and password work just as well — and it is covered in full under Signing in with Google.
• Content you create. Messages, attachments, reactions, clips, voice and video calls while they are in progress, space and desk settings, and the rooms you create or join.
• Translation, if you use it. On Tandem+ you can choose a language to read in. Messages written in another language are then sent to our translation provider and shown to you translated, with the original a tap away — what the author wrote is never changed. Translation works for the reader, so a message you write can be translated for someone who reads in another language even if you don't use translation yourself. We keep each translation so the same message isn't translated twice.
• Working hours and quiet hours. The schedule you set so Tandem knows which side is on duty, and your timezone so that schedule survives clock changes.
• Billing. If you subscribe to Tandem+ or a space owner buys Desk+, our payment processor handles the card. We keep the plan, the dates, and the last four digits — never the full card number.
• Device and log data. IP address, browser or desktop app version, operating system, and timestamps of requests. The desktop app also reads whether you are idle so it can set your status; that signal stays on your device and only the resulting status (Online, Away) is sent.
• Reports. If you report a message, space or person, we receive the report and the content it refers to.

On this marketing site we collect nothing beyond standard server logs. There are no analytics scripts, no advertising pixels and no tracking cookies here. The bot check described under Spam and bot protection runs on the app’s account and security forms.

• To run Tandem. Deliver messages, ring calls, keep spaces and desks in sync, and route calls to the region nearest you.
• To keep the two sides apart. Enforce, in the database, that a space belongs to exactly one side and that a persona on one side is never visible from the other.
• To honour your schedule. Silence the off-duty side during quiet hours, switch you when the boundary arrives if you've asked us to, and let genuinely urgent messages through if you've allowed that.
• To bill you. Charge subscriptions, apply Backer Credits, and unlock what a space has earned.
• To keep people safe. Act on reports, enforce our rules, and detect abuse such as spam or account takeover.
• To talk to you. Service emails about your account, security and billing. We don't send marketing email unless you opt in, and you can leave at any time.

We do not sell your data, and we do not use the content of your messages to build advertising profiles.

Google user data is narrower than this. If you sign in with Google, what we receive from Google is used only to run the account it belongs to and to provide or improve that feature. It is never used for marketing, never for advertising, and never for anything else on the list above. See Signing in with Google for the full limits.

• The people you talk to. Your messages go to the rooms and people you send them to. Your Personal persona is visible to Personal spaces; your Business persona to desks. A Connect room guest sees that one room and the people in it — nothing else.
• Service providers. Hosting, call infrastructure, payment processing, email delivery, a translation provider for readers who have turned translation on, and Cloudflare for the bot check described under Spam and bot protection — each under contract to handle data only on our instructions.
• When the law requires it. To comply with a valid legal request, or to protect the rights and safety of Tandem and its users. We push back on requests that are overbroad.
• If Tandem changes hands. In a merger or acquisition, your data would transfer under this policy, and we would tell you first. Data received from Google APIs is the exception: it transfers only with your explicit prior consent, as that section sets out.

Tandem offers one optional Google feature: signing in with your Google account. It is not required to use Tandem — you can create an account with an email address and password instead. This section sets out exactly what Google user data it accesses, how we use it, where it is stored, and who it is shared with.

Google user data is used only to provide or improve the user-facing feature described in this section. We do not use it for any other purpose. We never use it for advertising or marketing, never sell or rent it, never use it to build a profile of you, and never use it to develop, improve or train artificial-intelligence or machine-learning models — ours or anyone else's.

This section governs Google user data. Where anything else in this policy describes a use, a disclosure or a retention period broader than the limits set out here, it does not apply to data received from Google APIs. The narrow exceptions are the ones Google itself permits: acting on a security or abuse investigation, and complying with a valid legal obligation.

What it accesses

• What we access. When you choose “Continue with Google”, Google sends us your Google account email address, your name and your profile picture — the basic profile scopes only. We do not request access to anything else at sign-in.
• How we use it. To create your Tandem account the first time, and to recognise you when you sign in again. Your Google email becomes the email on your Tandem account; your name and picture pre-fill your profile, which you can change.
• Where it is stored. As part of your account record in our database, encrypted at rest. We do not keep a Google password — Google handles the sign-in and tells us it succeeded.
• Who it is shared with. Nobody. It is not shared with other users, not sold, and not used for advertising.

How to stop

• Disconnect it whenever you like. You can revoke Tandem's access from your Google Account permissions page, and set a password on your Tandem account so you can sign in without Google. Deleting your Tandem account removes what we hold either way, as How long we keep it describes.
• Tandem no longer connects to Google Drive. An earlier version of Tandem could read file names from Google Drive to label links. That feature has been removed, and Tandem no longer requests any Google Drive permission.

Limits that apply to all Google data

• Only to provide or improve the feature above. Google user data is put to no other use — not advertising, not marketing, not analytics about you, not profile building, and not training artificial-intelligence or machine-learning models.
• Never for marketing. Signing in with Google makes your Google address the email on your Tandem account, so essential service messages go there — a security alert, a billing receipt, a password reset — because that is part of running the account. It is never used to send you marketing, and never added to a marketing list.
• Never transferred with the business. If Tandem is ever merged, acquired or sold, data received from Google APIs transfers only after we have asked you and you have explicitly agreed. Telling you is not enough on its own.
• No person at Tandem reads your Google data except with your explicit permission, to resolve a support issue you raised, for security or abuse investigations, or where the law requires it.
• Tandem's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

We use Cloudflare Turnstile to tell a real person from an automated script on the actions worth attacking — creating an account, signing in, resetting a password, and submitting a report. It is what stops a bot from registering thousands of accounts or guessing its way into yours.

It runs invisibly. There is no puzzle, no checkbox and nothing to click. You will almost never know it ran, and it asks nothing of you.

To make that judgement, Turnstile runs a script in your browser and sends Cloudflare signals about the request and the device making it — your IP address, user agent, and characteristics of your browser and how it behaves — then returns a token saying the check passed. It may keep a short-lived token or cookie in your browser so you aren’t re-checked at every step. That token exists to prove you passed a bot check and nothing else; it is not an advertising or analytics cookie.

We only learn whether the check passed. The underlying signals go to Cloudflare, not to us. We never receive them, and they are never joined to your messages, your spaces or your personas.

Cloudflare’s handling of that data is governed by the Cloudflare Turnstile Privacy Addendum. We reference it here as a condition of running Turnstile in invisible mode. Under it, Cloudflare processes this data on our behalf to run the bot check, and does not use it to build advertising profiles or to track you across unrelated sites.

Passing the check is a condition of the actions above, so it cannot be switched off — but it looks only at whether a request appears automated, never at what you write.

Messages stay as long as the space or desk exists. On the Business side, a desk's plan sets how far back its members can scroll — 90 days on Desk Starter, 12 months on Desk+, everything on Desk+ Pro. History outside that window is veiled, not deleted, and comes back when the desk upgrades.

Direct-message attachments are kept for 90 days on a free account and a year on Tandem+ and Tandem+ Pro.

Calls are not recorded unless someone in the call starts a recording, and that recording belongs to the room it was made in.

Deleted accounts go straight away, and in any case within 30 days. Your messages and direct messages are deleted with the account rather than left behind — see how to delete your account for what happens to spaces you created and to a plan you pay for.

Logs are kept for up to 90 days for security and debugging, then discarded.

Everything travels over TLS. Passwords are hashed. Access to production is limited to the people who need it, and logged. Calls run over encrypted transport between you and the nearest region.

No system is perfectly secure. If we discover a breach that affects you, we will tell you without unreasonable delay and say what happened.

• See and change it. Account details, both personas, schedules and notification settings are all editable in the app.
• Take it with you. Ask us for a copy of your data. Owners of a desk on Desk+ Pro can export the whole desk from inside the app.
• Delete it. Delete your account yourself in Settings → Privacy & Security, or ask us to — how to delete your account covers both. See how long we keep it for what happens to messages in shared rooms.
• Object or restrict. Where the law gives you the right to object to a use of your data, or to restrict it, you can — write to us.
• Complain. If you're in the EU, UK or another place with a data-protection authority, you can complain to them. We'd rather hear from you first.

To exercise any of these, email privacy@tandemapp.xyz. We'll verify it's you and respond within 30 days.

Tandem is for people aged 13 and over — 16 where local law sets that age. We don't knowingly collect data from anyone younger. If you think a child has an account, tell us and we'll remove it.

Tandem runs in more than one region so calls and messages reach you quickly. That means your data may be processed in a country other than the one you live in. Where it leaves the EU or UK, we rely on standard contractual clauses or an equivalent lawful mechanism.

When we change this policy we'll update the date at the top. If the change matters — a new use of your data, a new kind of sharing — we'll tell you in the app or by email before it takes effect.

Questions about privacy go to privacy@tandemapp.xyz.