What Tend accesses
Messages (macOS)
On the Mac, Tend reads Apple’s local Messages database to measure cadence, balance, timing, and related signals. Message bodies are processed locally.
Contacts
Tend asks for Contacts permission so numbers and emails can be matched to names and shown cleanly across your devices.
Full Disk Access
macOS requires Full Disk Access for Tend to read ~/Library/Messages/chat.db. That permission is used for local analysis tied to the app.
Relationship notes
Relationship notes are written by a small AI model that runs entirely on your Mac. Tend never sends message text, prompts, or excerpts to a cloud AI provider — there is no cloud-AI path.
What syncs and what does not
What can sync through your iCloud
Paraphrased AI outputs can move through your private iCloud to your own iPhone: memory paragraphs, storyline labels, open-loop descriptions, editable reconnect drafts, vector metrics, display names, timestamps, tiers, and preferences. Raw message text and transcripts do not sync.
What does not leave the Mac
Your full iMessage archive, message bodies, attachments, and the local scan index are not uploaded to a Tend-hosted backend.
What Tend cannot see
Tend keeps no central database of your conversations, and there is no admin console with your message graph in it. Sign-in (see Identity below) establishes who your devices belong to — it never gives Tend your messages.
What we do not sell
We do not sell your personal information or use your Messages or Contacts for ad-broker targeting.
Your privacy rights
You can access, correct, export, or delete Tend data and turn anonymous analytics off separately on each device. Contact blake@tendapp.io for an account-level request.
EU and UK
Where GDPR applies, you may request access, rectification, erasure, restriction, portability, or object to processing. Tend relies on consent for optional features and legitimate interests to provide the service you requested.
California
We do not sell or share personal information for cross-context behavioural advertising. California residents may request access, correction, or deletion without discrimination.
How you sign in
Tend uses Sign in with Apple, and only Sign in with Apple — no Tend password, no email-and-password login, and no third-party identity providers. One Apple prompt during setup creates the private Tend account link.
What the sign-in establishes
It identifies which Mac and iPhone are yours so your paraphrased summaries reach the right device, and — if you applied to the beta — links your install to your application. That is its entire job.
What Apple shares with Tend
An opaque per-app identifier that is specific to Tend and cannot be used to track you across other apps. It is not your Apple ID and not your password. If you choose Hide My Email, Apple relays a private address and Tend never sees your real one.
Where it is kept
That identifier lives in Tend's authentication store (Supabase Auth) solely to recognise you on return. During Mac web sign-in, the callback relay holds the Apple identity token encrypted behind a single-use, client-bound exchange. The exchange expires after five minutes; a five-minute cleanup job means an abandoned encrypted row may remain for up to about ten minutes. The app stores the resulting Supabase session in Keychain and uses a server-generated opaque analytics/support id for PostHog, Intercom, and admin joins. No message content, contact graph, or AI output passes through sign-in.
Deleting it
Use the in-app account control or revoke Tend in your Apple ID settings. In-app deletion removes the Supabase Auth account and app profile, then uses the shared opaque support id to purge matching PostHog and Intercom records.
App-quality services
A small, deliberately narrow set of third-party services helps us run the beta. None of them ever receives your message content, contact graph, AI outputs, or free-text fields you didn't write to them yourself.
Product analytics (PostHog)
The Swift apps emit a strict allowlisted set of categorical events through a Cloudflare Worker proxy at stneve.tendapp.io, which drops anything not on the allowlist before reaching PostHog. The PostHog API key never lives on your device. The Swift apps emit a small set of categorical product and engagement events — app launch, onboarding progress and completion, setting a cadence, opening the daily list and tapping through it, handing a drafted message to Messages, opening a contact's profile, and local-model version / load-failure diagnostics — carrying only counts, buckets, and enumerated values. Telemetry never includes message content, names, phone numbers, friend identifiers, AI outputs, or free-text fields, and is gated on-device by an analytics-consent control (iPhone: Settings → Privacy → "Anonymous analytics"; Mac: Settings → Privacy) — declining stops all analytics emission. After Sign in with Apple, PostHog uses the server-generated opaque analytics/support id. Legacy beta installs may use their original beta analytics id until they sign in.
Customer support & lifecycle emails (Intercom)
Tend uses Intercom for in-app support chat, the public help center, and a small set of categorical lifecycle emails (Day 0 welcome, Day 7 check-in, optional Day 14 survey nudge, beta-end, GA-launch — each one-click unsubscribe). Intercom never receives your message content, contact graph, AI outputs, or substantive survey free-text. Support conversations exist only because you initiated them. Intercom receives categorical support attributes like app version, OS, onboarding state, contact-count bucket, and the opaque support id; no custom events are sent today. We have explicitly disabled Intercom Fin AI Agent, session recording, and co-browsing.
Diagnostics (Apple MetricKit)
Crash and performance reports are collected by your operating system through Apple's MetricKit framework and stored locally under Application Support/Tend/Diagnostics/ with a rolling cap of 10 reports. Tend does not automatically transmit any of them. You may share a diagnostic report with support via Settings → Send debug info to support; if you do, the report leaves your device only because you picked a destination yourself in the system share sheet. We do not ship a third-party crash SDK.
Deletion across services
In-app account deletion completes only after PostHog accepts deletion of the matching person/events and the matching Intercom user record is deleted using the shared opaque analytics/support id. PostHog processes event deletion asynchronously after accepting the request. MetricKit reports remain on your device unless you've already chosen to share one — those copies are then governed by your email provider, not by us.
Beta website data
What we collect
When you apply for the beta, we collect the form fields you submit, plus basic abuse-protection metadata such as hashed IP and user agent.
Where it is stored
We store beta application data, Sign in with Apple app-profile state, survey responses, and help-center helpful/not-helpful feedback in Supabase. We send onboarding or invite email through Resend.
Analytics
The website uses narrow, opt-in product analytics for funnel shape. Free-text is not sent as analytics payload.
Why we keep it
We use beta-site data only to operate the waitlist, abuse controls, and beta communications.
Retention, changes, and contact
- Local data on your Mac or iPhone remains under your device controls until you remove the app or delete data through normal OS mechanisms.
- Beta waitlist data is retained only as long as needed to run invites and beta communications.
- Account deletion removes the Supabase Auth account, app profile, app-linked survey responses, and matching PostHog and Intercom records. An opaque deletion receipt containing no account content resolves lost network responses. While deletion is pending it temporarily includes the internal Supabase user id; completion clears that id. A daily cleanup removes receipts after expiry, so a row may remain for up to about 31 days. The original beta application and consent record are managed separately; contact us to request access, correction, or deletion of those records or support/help-center submissions.
- Tend is not intended for children under 13, and we do not knowingly collect personal information from children under 13 in a targeted way.
- We may update this policy. When we do, we will change the last-updated date at the top.
Questions about privacy? Send us a message and we'll reply within 72 hours.
Want the technical architecture? Read Local-first for how the signal layer stays tied to your own devices.