Privacy policy

Effective October 3, 2026

Tandem is a to-do app for Android and Windows. You plan with Juniper, an AI coach, and Tandem keeps your lists. This policy explains what Tandem stores, what it sends and to whom, and the choices you have. Tandem is made by an independent developer, called "we" below. Questions: support@tandemtasks.app.

In short: your lists, chats and settings live on your devices. When you use Juniper with Claude or Gemini, what Juniper needs goes to that company with your own API key. If you turn on sync, your lists, tasks and memories are stored in Tandem's cloud database. The apps have no ads, no analytics and no tracking, and we don't sell your data.

What stays on your device

• Your lists, sections, tasks, tags, chats with Juniper, memories, photos you add to chats, and settings are stored in the app on each device.
• API keys you enter are encrypted on the device (Android Keystore on the phone, Windows data protection on the PC) and never leave it.
• On Android, Google's automatic backup and phone-to-phone transfer include the app's database and settings (not your API keys). Phone-to-phone transfer also includes chat photos. You control Android backup in your phone's settings.
• Voice mode recognizes your speech on the device. Audio never leaves it; only the recognized text is used, like a typed message.
• The on-device AI model runs entirely on your device; when Juniper uses it, nothing is sent anywhere.

What goes to AI providers

Juniper uses the AI model you pick in Settings → AI: Claude (by Anthropic), Gemini (by Google), or the on-device model. With Claude or Gemini, Tandem sends that company, using your own API key and account with them:

• your messages, and the photos you attach;
• the context Juniper needs: your lists and tasks, your memories, the date, time and time zone, and events from the calendars you chose to share with Tandem;
• the daily briefing request, if the briefing is on.

Their own terms and privacy policies apply to what they receive: Anthropic's and Google's. On Google's free tier of the Gemini API, Google may use your content to improve its products. By default each photo is uploaded once to your Anthropic account so replies stay fast; Settings → Privacy can send photos with each request instead. Those uploads are deleted when their chat is deleted. Web searches Juniper makes are run by the AI provider.

Calendar

On the phone, Tandem reads (never changes) only the calendars you pick in Settings → Calendar. On the PC, Tandem fetches the private calendar links you add. Events are used on the device and, as described above, sent to the AI provider as context when you use Claude or Gemini.

Accounts and sync (optional)

Signing in is optional; Tandem works fully without it. If you sign in with Google to sync between devices:

• Your account is created in Tandem's cloud database, run on Supabase. It holds your email address, your Google account ID and the name and picture Google provides.
• Your lists, sections, tasks, tags and memories (each group has its own switch) are stored there, along with a random ID for each of your devices. Chats with Juniper, undo history, photos, settings, API keys and voices are never synced.
• This data is encrypted in transit and at rest, but not end-to-end, so the developer could technically read it. We don't, except to fix a problem you ask us about or where the law requires it.

Reports

If you report one of Juniper's replies ("Report reply" in a reply's menu), Tandem sends the reply's text, the reason you chose, your optional note, the AI model, the app (phone or PC) and its version. A report contains nothing that identifies you, your account or your chat. We use reports to find and reduce harmful or wrong replies.

Downloads and updates

Tandem downloads the on-device model from Hugging Face, voice files from GitHub, and (on the PC) updates from Tandem's download server, downloads.tandemtasks.app. Like any download, these services see your device's IP address.

This website

This website and Tandem's downloads are hosted by Cloudflare, which handles visitors' IP addresses to deliver them. We count page views with Cloudflare Web Analytics, which uses no cookies and collects no personal data. The website sets no cookies.

What we don't do

• The apps have no ads, analytics, crash reporting or tracking.
• We don't sell your data or share it for advertising.
• Notifications are created on your device; nothing is sent to us to show them.

Your choices and deleting data

• On a device: Settings → Data deletes chats, tasks, or everything. Uninstalling removes the app's data from the phone. On the PC, uninstalling keeps your data; delete the folder %LOCALAPPDATA%\app.tandem.todo to remove it.
• Sync: each sync switch in Settings → Account & sync can be turned off. Signing out lets you keep or remove the data on that device.
• Your account: Settings → Account & sync → Delete my account deletes your account and everything synced to it. You can also ask us to delete it.

Keeping data

Synced data is kept until you delete it or your account. Deleting your account removes it from the database right away; copies in the database provider's backups, if any, expire on their own schedule. Reports are kept as long as we need them to review replies.

Children

Tandem is meant for adults (18 and over) and isn't directed to children.

Changes

If this policy changes, the new version will be posted here with a new effective date.

Contact

support@tandemtasks.app