Privacy
Last updated 3 September 2026
Tandem is a travel app. You plan trips with people you know, and you keep a record of where you went. This page says exactly what it collects, where that goes, and what it never does.
It is written to be accurate rather than broad. Where something is not collected, it says so plainly, because a policy that reserves every right it can imagine tells you nothing about the app you are actually using.
The short version
- There is no advertising and no tracking. No analytics, no advertising identifiers, no third-party trackers, no profiling.
- Nothing is sold or shared for marketing. Not to anyone, ever.
- Your location never leaves your phone.
- Every photograph is private by default and stored in a bucket that is not publicly readable.
- There is no password, because Tandem never asks for one.
What Tandem collects
Your account
You sign in with Apple, with Google, or with an email address. Whichever you choose, Tandem receives an identifier for that account and, usually, your email address and name.
Tandem then asks for two things of its own:
- A name, which appears in your passport and to people you travel with.
- A date of birth, which is used for one purpose only — checking that you are eighteen or over. It is never shown to anyone and never appears on any screen other than your own.
You also choose a handle. This is public: it is how people find you and invite you to trips.
Tandem never stores a password, because it never asks for one. Signing in is always through Apple, Google, or a six-digit code sent to your email.
What you put in
Everything below exists because you typed, photographed or chose it:
- Trips — names, dates, cities, and who is on them.
- Itineraries — places, times, addresses, flight numbers, confirmation numbers and any contact phone number you add to a booking.
- Money — what was spent, in what currency, who paid, who owes whom, and photographs or PDFs of receipts.
- Packing lists.
- Pages — photographs, videos, spoken narration, place names, dates, notes, and answers to questions about a place.
- Documents you attach to a trip, such as boarding passes or bookings.
- Social activity — who you follow, pages you save, questions you ask other travellers, tips you leave on a trip, and anyone you block or report.
Forwarded booking emails
If you forward a booking confirmation to Tandem, it keeps the sender's address, the subject, the contents, and any attachment, so the booking can be placed on the right trip. It is then read by Google's Gemini so the hotel, dates and confirmation number can be pulled out — see Google below.
Your device
If you turn on notifications, Tandem stores a push token for that device so Apple can deliver them. It identifies the device, not you personally, and it is deleted with your account.
What Tandem does not collect
- Your location. The map can show where you are standing so you can judge how far the next stop is. That blue dot is drawn by iOS from Core Location directly — no coordinate of yours is ever stored in the app, written to the database, or sent anywhere. Permission is asked when in use only, never in the background.
- Your photo library. Tandem reads it only to show you a grid to choose from. Nothing is uploaded until you pick it and file a page.
- Contacts, calendars, health, or advertising identifiers. None of these are requested or read.
The camera is used to photograph receipts and to record a recap; the microphone is used to narrate a page. Both only when you start it.
Who else sees any of it
Tandem uses a small number of services to work at all. It does not use any service for advertising, analytics or profiling.
Supabase
Hosting, database, sign-in and file storage. All of your data is held here, in Canada. Every storage bucket is private; images are served through short-lived signed links that expire, rather than public URLs.
Apple
Sign in with Apple, if you choose it; push notifications through Apple Push Notification service; and Apple Maps, which draws the maps and suggests places as you type.
Three separate things, and only these:
- Sign in with Google, if you choose it.
- Google Places, asked one question — the weekly opening hours of a place you are adding to a plan — so Tandem can warn you if you are planning to arrive when it is shut. Only the place name and its rough location are sent.
- Gemini, Google's AI service. If — and only if — you forward a booking confirmation email to Tandem, the contents of that email are sent to Gemini so the hotel, dates and confirmation number can be read out of it. If you never forward a booking, nothing of yours is ever sent to an AI service.
AeroDataBox
Flight information. When you enter a flight number, that number and the date are sent to look up the airports, times and terminal. Nothing about you is sent with it.
Resend
Sends the six-digit code, if you sign in by email. It receives your email address and the code.
Who can see what, inside Tandem
- A trip is visible to the people on it. Its itinerary, its money and its packing list are not visible to anyone else.
- Pages you file are visible according to the visibility you set on them.
- Your handle, your name, your picture and your pages are what another traveller can see of you.
- Your date of birth and your email address are never shown to anyone.
These rules are enforced by the database itself, not only by the app.
Deleting your account
You can delete your account from Settings inside the app. It is immediate and it cannot be undone.
What is removed: every file you uploaded — photographs, videos, narration, receipts, documents — your profile, your pages, the questions you asked, the tips you left, your packing lists and your sign-in identity.
One thing survives, and it is worth understanding. If you shared a trip with other people, what you contributed to that trip stays — the expenses you logged and the stops you added — because deleting them would silently break the trip for everyone else on it, and change what they owe each other. Your name on that trip is replaced with “Someone who left”, and nothing links it back to you.
How long things are kept
What you put in stays until you remove it or delete your account. Sign-in codes expire in ten minutes and are stored only as a hash, never as the code itself. Answers cached from Google Places and AeroDataBox are kept briefly so that four people opening one trip do not each cost a fresh lookup; they describe places and flights, not people.
Children
Tandem is for people aged eighteen and over. This is checked when you sign up and enforced by the database. If you believe someone under eighteen has an account, write to us and it will be removed.
Your rights
You can see and change what is in your passport from inside the app, and you can delete everything at once. If you want a copy of your data, or you have a question about any of the above, write to hello@tandemtravel.online.
Depending on where you live you may have further rights over your data — to access it, correct it, or object to its handling. Ask and they will be honoured.
Changes
If this policy changes in a way that affects what is collected or who sees it, the app will say so rather than quietly updating this page.
Who to write to
Tandem
hello@tandemtravel.online