Your space is yours

• Your email address, your display name, and your photo if you set one. We use the email to sign you in and to send you things about your account.
• The things you and your partner create inside your space: habits and streaks, photos and their captions, love letters, chats, playlists, lists, events, ideas, and the games you play. Daily moments also store your answers, photos, voice notes, quiz choices, and saved favorites.
• Daily answers remain in your private history until you delete them. Adding an exchange to Moments saves a favorite; removing the favorite leaves its history intact. Deleting an answer removes its content from both places. Voice notes are not transcribed.
• Your time zone, so a nudge meant for your morning arrives in your morning and not your partner's.
• If you turn on notifications, a push subscription from your browser. That is what lets us send a heart or a gentle nudge to your device.
• If you buy Tandem Pro, your plan and billing history. For a manual GCash order we also store the payment receipt you upload. Stripe or Apple handles card and App Store payment details; Tandem does not receive or store them.
• Small daily-moment activity records let us count completed exchanges, answer formats, favorite saves, and optional enjoyment feedback. These records contain account and activity IDs and short labels, never the text, photos, or audio of your answers.
• A small Pro journey event when you see or open a Pro feature, pick a plan, or start checkout. It contains your household and user IDs plus short catalog labels such as “games” or “settings.” It never contains names, messages, photos, letter text, captions, answers, or other things from your space.

You can sign in with a one-time link sent to your email, with a password you set yourself, or with your Google account. If you use Google, we receive your email address and name from them. We never receive your Google password, and we do not read anything else in your Google account.

Everything you create lives inside your household, which is just the two of you. We use database row level security on every single table, so one couple can never read another couple's data. Your space is walled off in the database itself, not only in the app, which means it holds even if the app has a bug.

Your photos, your letters and their attachments, and your payment receipts live in private storage. They are not on the public internet. When you open one, we mint a short-lived link just for you.

Two things are stored in public buckets so they load fast: your profile photo and any custom background you upload. Their web addresses contain a random id that nobody can guess, so they are not listed or searchable anywhere, but a person you personally handed the link to could open it. We would rather tell you that than let you assume otherwise.

In supported web browsers, Settings → Photo privacy lets you enable end-to-end encryption for new shared photos. The browser encrypts these images before upload and opens them locally on approved browsers. Supabase stores encrypted files; Tandem does not keep a readable copy of the photo key or your recovery code.

This covers new images in Moments, chat, photo letters, daily moments, booth and room snapshots, and saved paintings. Protected Moments captions and photo dates are also encrypted. After both partners approve a browser and save their recovery codes, supported existing photos encrypt automatically while you use Tandem. Older photos keep their previous protection until their conversion finishes. Messages, letter text, voice notes, profile images, custom backgrounds, and other app data are outside this first release. Account details, file sizes, upload times, and activity metadata remain visible to the service.

Each browser needs approval from a browser that already has access, using codes compared through a separate trusted channel, or your own saved recovery code. Signing in or resetting your account password alone cannot unlock protected photos. Your browser stores its photo key locally. Clearing site data can remove it. Keep the recovery code somewhere private: if all approved browsers and recovery codes are lost, Tandem cannot restore those photos.

You can convert existing shared photos from an approved browser after both accounts have saved recovery codes. Conversion preserves the original image bytes and photo records, verifies the uploaded encrypted copy, and then removes the old storage object. It can pause and resume. Private daily drafts may need conversion from their author’s browser; active paintings and recent temporary room images wait until later. Previously downloaded copies, browser caches and historical backups cannot be taken back.

Approved browsers show photos and slideshows normally. A person with access can still download, screenshot, or share a photo. Forgetting a browser clears local keys, but cannot take back copies or keys on another device. If space membership changes, protected uploads pause. Native-app key storage is outside this release.

This protects stored photo contents from being read without your key. It still depends on a trusted device and the Tandem app code running in your browser. Compromised devices or malicious browser code can expose content while it is open. Other Tandem content uses access controls and encryption in transit and at rest; it is not end-to-end encrypted and service administrators can technically access it.

Free apps that hold your private life usually pay for themselves by mining it. Tandem does not have an ads business, an analytics product, or a data partner, so there is no version of this company where reading your letters makes us money. The Pro plan is how Tandem pays for itself. You are the customer, not the inventory.

A short list, and this is the whole list. Each one only handles what it needs to:

• Supabase stores your data and runs the sign-in system, on Amazon Web Services in the United States.
• Resend delivers your sign-in links, invites, and account emails.
• Vercel serves the app and the website.
• Stripe and Apple process Pro subscriptions when you choose card checkout or an App Store purchase. They receive the payment and account details required to complete and manage that purchase.
• Google, Apple, and Mozilla pass along push notifications to your device, the same way they do for every app you have. They carry the notification, not your space.

Our marketing pages, meaning the home page and the pricing, privacy, and terms pages you are reading now, load a search-optimisation script from SearchAtlas. It is not loaded anywhere inside the app, and it never runs on a page that shows anything from your space.

We count visits with Sonar, an analytics tool we wrote ourselves and run on our own server. The numbers come to us and stop there. There is no Google Analytics on Tandem, no advertising pixel, and nothing about your visit is sold, rented, or handed to anyone else.

It runs on the marketing pages and inside the app. It records the address of the page you opened, never what is on it. Your habits, photos, letters, chats, and lists are not part of this and never pass through it.

It keeps one thing on your device: a random ID, stored in your browser under the name sonar_pid. It is 28 random characters, made on your first visit. There is no name in it, no email, and nothing from your space. Its only job is to tell us that whoever is reading this is the same person who clicked one of our links or ads a week ago, so we can see which of those were worth doing.

That ID stays until you clear it, which makes it a persistent identifier. Tandem used to keep nothing at all on your device, and we would rather say that plainly than let the word "cookieless" do quiet work for us.

Alongside it we record the page address, the site or ad you arrived from, any campaign tags on that link, your country, and the broad type of device, browser, and operating system you use. Your IP address is used for an instant to build a scrambled fingerprint that changes every day, which is how we count you once instead of six times. The IP itself is never stored.

If you would rather not be counted, open your browser console on any Tandem page and run localStorage.setItem('sonar_ignore', '1'). We will skip that browser from then on. Clearing this site's data from your browser removes the random ID too.

Our optional Chrome extension, Tandem: Watch Together, lets the two of you see and hear each other while you browse and keeps Netflix playing in sync. Here is exactly what it does:

• Camera and microphone. When you start a presence call, your camera and microphone stream directly to your partner over an encrypted peer-to-peer (WebRTC) connection. We do not record it, and it never touches our servers.
• Netflix sync. On Netflix pages the extension reads the player's play, pause, and seek position and sends only those events to your partner so your shows stay in step. It does not read the video itself or anything else on the page.
• Local pairing. The extension stores your Tandem space ID locally in the browser so it knows which partner to connect you to. Nothing else is stored, and it stays on your device.
• All-sites access. Because you choose which page to browse together, the presence overlay can appear on any site. It only activates after you pair your space, and it never reads, collects, or transmits the contents of the pages you visit.

We reach Supabase for the real-time signaling that connects the two of you, and the Tandem web app pages to pair your space. The extension is not required to use Tandem, and you can remove it at any time from your browser.

• We do not sell your data.
• We do not run ads.
• We do not share the things in your space with anyone outside your household.
• We do not train anything on your letters, photos, or chats.
• We do not let an outside analytics or advertising company watch what you do, on the site or in the app. We count visits ourselves, only in the way described above.

You can delete everything from Settings, and when you do it is genuinely gone: the database rows, the photo and letter files in storage, and both sign-in accounts.

Because a Tandem space belongs to two people, deleting it takes both of you. One partner asks, the other has 72 hours to confirm, and then we hold everything for seven more days before destroying it. Either of you can cancel at any point in that window. We do it this way so one person cannot erase the other person's memories in a bad moment.

If you and your partner have gone separate ways and they will not confirm, email us and we will handle it by hand.

We keep two things after a deletion. A record that an order was paid, stripped of your email and receipt, because it is a financial record. And your email address on our unsubscribe list if you asked us to stop emailing you, because deleting that would quietly opt you back in.

You can turn notifications off in your device or browser settings whenever you like, change your display name and photo in Settings, and unsubscribe from any email we send that is not about your account or your security.

Ask us for a copy of what we hold on you and we will put it together for you. Protected photos require your approved browser to open or export them.

Questions about your privacy, or want your data? Email busqueneil@gmail.com and you will get a real person, because there are only two of us.