Effective May 1, 2026
Tandem (“we”, “us”, “our”) operates tandemplan.xyz. This policy explains what personal data we collect, how we use it, and the choices you have. We process data minimally — we only collect what's necessary to provide the service.
When you sign up, we collect your email address and, if you use Google OAuth, your name and profile picture from Google. We use this to authenticate you and personalise your experience.
All content you create in Tandem — plans, outcomes, tasks, milestones, stakeholders, notes — is stored in our database and associated with your account. This data is yours.
We collect anonymised product analytics via PostHog (page views, feature usage) to improve the product. We do not sell this data and it is not linked to identifiable individuals.
When you use Claude-powered features (plan generation, QBR draft, nudge composer), your input is sent to Anthropic's API. We log token counts and costs for rate limiting. We do not retain your prompts beyond what Anthropic's standard API terms cover.
We use Sentry to capture application errors. Error reports may include partial page URLs and browser information but are stripped of personal content where possible.
We do not use your data for advertising. We do not sell your data to third parties.
Your data is stored in Supabase (PostgreSQL), hosted on AWS infrastructure in the US. We use row-level security policies so that each user can only access their own data. Connections are encrypted in transit via TLS. Service credentials are stored as environment variables and never committed to source control.
We retain your data for as long as your account is active. If you delete your account, your plan data is deleted within 30 days. Anonymised usage analytics are retained indefinitely.
Support messages submitted via the contact form are stored in our database and used only to respond to your inquiry. They are retained for 12 months from submission and then deleted, unless there is an ongoing issue that requires the history. Support messages are never shared with third parties beyond Resend (our email delivery provider).
You have the right to access, correct, export, or delete your personal data. To exercise any of these rights, email privacy@tandemplan.xyz. We will respond within 30 days.
If you are in the EEA or UK, you have additional rights under GDPR/UK GDPR, including the right to lodge a complaint with your supervisory authority.
We use a single session cookie for authentication (Supabase auth token). We do not use tracking or advertising cookies. The analytics we collect via PostHog use a first-party cookie scoped to tandemplan.xyz.
We may update this policy as the product evolves. We will notify you by email or in-app notice when we make material changes. Continued use of Tandem after changes take effect constitutes acceptance.
Questions about this policy: privacy@tandemplan.xyz