TANDEM
Privacy Policy
Tandem is a private family application used by one household.
What Tandem reads
- Google Calendar: the events on the family's connected Google
accounts.
- One Google Doc and one Google Sheet: a parent's work agenda and the
nanny's schedule. Tandem reads no other file. The Google permissions it holds are
wider than that (read access to Drive, and to Sheets) and are used only for those
two.
- Email forwarded from the family's own Google accounts. Tandem holds no
Gmail permission and cannot open a mailbox. Mail from anyone else is turned away
unread; only its sender's address and the start of its subject line are logged, for
30 days. Sign-in codes and password-reset messages that arrive in a forward are kept
with their message text removed and are never shown to a model.
- What the family tells it: notes typed, spoken or photographed into
the app, and questions asked of the Assistant.
What Tandem writes
Tandem changes Google Calendar only when a family member asks it to in the app, by
confirming an event to add or by telling it what changed. It never writes to the Doc, the
Sheet or a mailbox.
How data is used
- To assemble the household's schedule and show it on the family's phones.
- To read the family's mail, documents and notes, and to write short summaries,
reminders and answers for the household.
- Nothing else. Data is never sold, rented, shared with advertisers, or used to train
any machine learning model.
Who receives it
- Anthropic, whose model does the reading: the text and attachments of
forwarded email, photos and screenshots captured in the app, the text of voice notes
(the recording stays on the phone), calendar, document and sheet contents, and
questions asked of the Assistant. Anthropic does not train models on API
inputs.
- Apple: the text of notifications on their way to the family's phones;
speech recognition for voice notes, on the phone when it has Apple's speech model and
otherwise through Apple's speech service; and drive times from Apple Maps.
- Google: the calendars, the document and the sheet, which already live
there.
- Cloudflare: hosting, the database, and the email routing that delivers
forwarded mail.
- Open-Meteo: the coordinates of the family's town, for the weather, and
nothing that identifies the family.
- People a parent sends a sitter or grandparent link to: what that page
shows, which for a sitter includes the home address and the parents' email
addresses, until the link expires.
No one else receives household data.
Storage and retention
Data is stored in Cloudflare D1, encrypted at rest.
- The calendar, the Family Book, decisions and Assistant conversations are kept until the
family deletes them or asks for deletion.
- Forwarded email is kept for 90 days, and longer while a calendar event or a Family Book
memory still points at it.
- Captured notes, and the deliveries, charges and notes read from email, are kept for
90 days.
- Operational logs are kept for 30 days, and the history of notifications sent for 180
days.
- Google refresh tokens are kept until the account is reconnected or deletion is
requested. A token revoked at Google stops working immediately. Access tokens are
requested per operation and never written to the database.
Revoking access
Access can be revoked at any time at
myaccount.google.com/permissions, which immediately and permanently ends
Tandem's ability to read or write anything. Deletion of all stored data can be requested by
contacting the address below.
Contact
rcwyatt107@gmail.com
Last updated 2026-10-03