Your space is yours

• Your email address, your display name, and your photo if you set one. We use the email to sign you in and to send you things about your account.
• The things you and your partner create inside your space: habits and streaks, photos and their captions, love letters, chats, playlists, lists, events, ideas, and the games you play.
• Your time zone, so a nudge meant for your morning arrives in your morning and not your partner's.
• If you turn on notifications, a push subscription from your browser. That is what lets us send a heart or a gentle nudge to your device.
• If you buy Tandem Pro, your order: the plan, the amount, and the payment receipt you upload. We do not see or store your card or GCash credentials.

You can sign in with a one-time link sent to your email, with a password you set yourself, or with your Google account. If you use Google, we receive your email address and name from them. We never receive your Google password, and we do not read anything else in your Google account.

Everything you create lives inside your household, which is just the two of you. We use database row level security on every single table, so one couple can never read another couple's data. Your space is walled off in the database itself, not only in the app, which means it holds even if the app has a bug.

Your photos, your letters and their attachments, and your payment receipts live in private storage. They are not on the public internet. When you open one, we mint a short-lived link just for you.

Two things are stored in public buckets so they load fast: your profile photo and any custom background you upload. Their web addresses contain a random id that nobody can guess, so they are not listed or searchable anywhere, but a person you personally handed the link to could open it. We would rather tell you that than let you assume otherwise.

Tandem is not end-to-end encrypted. Your data is encrypted in transit and encrypted at rest on disk, which is the same standard Instagram, Google Photos, Notion, and Slack hold themselves to. But it is not encrypted in a way that locks us out. We hold the keys to our own database.

In practice that means we do not read your space, we have no reason to, and nothing in how Tandem makes money depends on it. But we could, and any app that lets you recover your account after losing your phone is telling you the same thing, whether or not they say it out loud. We would rather say it.

If you want something truly unreadable by anyone but the two of you, use an end-to-end encrypted messenger for that particular thing. We will not pretend to be one.

Free apps that hold your private life usually pay for themselves by mining it. Tandem does not have an ads business, an analytics product, or a data partner, so there is no version of this company where reading your letters makes us money. The Pro plan is how Tandem pays for itself. You are the customer, not the inventory.

A short list, and this is the whole list. Each one only handles what it needs to:

• Supabase stores your data and runs the sign-in system, on Amazon Web Services in the United States.
• Mailgun delivers your sign-in links, invites, and account emails.
• Vercel serves the app and the website.
• Google, Apple, and Mozilla pass along push notifications to your device, the same way they do for every app you have. They carry the notification, not your space.

Our marketing pages, meaning the home page and the pricing, privacy, and terms pages you are reading now, load a search-optimisation script from SearchAtlas. It is not loaded anywhere inside the app, and it never runs on a page that shows anything from your space.

We count visits with Sonar, an analytics tool we wrote ourselves and run on our own server. The numbers come to us and stop there. There is no Google Analytics on Tandem, no advertising pixel, and nothing about your visit is sold, rented, or handed to anyone else.

It runs on the marketing pages and inside the app. It records the address of the page you opened, never what is on it. Your habits, photos, letters, chats, and lists are not part of this and never pass through it.

It keeps one thing on your device: a random ID, stored in your browser under the name sonar_pid. It is 28 random characters, made on your first visit. There is no name in it, no email, and nothing from your space. Its only job is to tell us that whoever is reading this is the same person who clicked one of our links or ads a week ago, so we can see which of those were worth doing.

That ID stays until you clear it, which makes it a persistent identifier. Tandem used to keep nothing at all on your device, and we would rather say that plainly than let the word "cookieless" do quiet work for us.

Alongside it we record the page address, the site or ad you arrived from, any campaign tags on that link, your country, and the broad type of device, browser, and operating system you use. Your IP address is used for an instant to build a scrambled fingerprint that changes every day, which is how we count you once instead of six times. The IP itself is never stored.

If you would rather not be counted, open your browser console on any Tandem page and run localStorage.setItem('sonar_ignore', '1'). We will skip that browser from then on. Clearing this site's data from your browser removes the random ID too.

Our optional Chrome extension, Tandem: Watch Together, lets the two of you see and hear each other while you browse and keeps Netflix playing in sync. Here is exactly what it does:

• Camera and microphone. When you start a presence call, your camera and microphone stream directly to your partner over an encrypted peer-to-peer (WebRTC) connection. We do not record it, and it never touches our servers.
• Netflix sync. On Netflix pages the extension reads the player's play, pause, and seek position and sends only those events to your partner so your shows stay in step. It does not read the video itself or anything else on the page.
• Local pairing. The extension stores your Tandem space ID locally in the browser so it knows which partner to connect you to. Nothing else is stored, and it stays on your device.
• All-sites access. Because you choose which page to browse together, the presence overlay can appear on any site. It only activates after you pair your space, and it never reads, collects, or transmits the contents of the pages you visit.

We reach Supabase for the real-time signaling that connects the two of you, and the Tandem web app pages to pair your space. The extension is not required to use Tandem, and you can remove it at any time from your browser.

• We do not sell your data.
• We do not run ads.
• We do not share the things in your space with anyone outside your household.
• We do not train anything on your letters, photos, or chats.
• We do not let an outside analytics or advertising company watch what you do, on the site or in the app. We count visits ourselves, only in the way described above.

You can delete everything from Settings, and when you do it is genuinely gone: the database rows, the photo and letter files in storage, and both sign-in accounts.

Because a Tandem space belongs to two people, deleting it takes both of you. One partner asks, the other has 72 hours to confirm, and then we hold everything for seven more days before destroying it. Either of you can cancel at any point in that window. We do it this way so one person cannot erase the other person's memories in a bad moment.

If you and your partner have gone separate ways and they will not confirm, email us and we will handle it by hand.

We keep two things after a deletion. A record that an order was paid, stripped of your email and receipt, because it is a financial record. And your email address on our unsubscribe list if you asked us to stop emailing you, because deleting that would quietly opt you back in.

You can turn notifications off in your device or browser settings whenever you like, change your display name and photo in Settings, and unsubscribe from any email we send that is not about your account or your security.

Ask us for a copy of what we hold on you and we will put it together for you.

Questions about your privacy, or want your data? Email busqueneil@gmail.com and you will get a real person, because there are only two of us.