Privacy

Tandu splits group expenses. That takes some data, but no more than needed. This page says which, what for, where it lives and how it goes away. Short version: no tracking, no analytics, no ads.

Who is responsible

Dominik Chwalisz
Donarstraße 17
14482 Potsdam
Email: dom.chwalisz@gmail.com

What data there is and what for

• Names: Group name, member names and their emoji. Purpose: show the group and do the math. You pick them yourself, they do not have to be real names.
• Expenses: Amounts, currencies, titles, notes, splits, receipt line items and the history of changes. Purpose: calculate balances and the working-out, and show them to everyone in the group.
• Payment details: IBAN, PayPal.me name, Wero. Only if you enter them and share them with the group. Purpose: the others can pay you with a tap. If you would rather not, leave them empty.
• Receipt photos: Only if you attach a photo to an expense. Purpose: a receipt for the group. A receipt you only scan and do not attach stays on your device.
• Device ID: A random identifier for your iPhone, plus a secret of which the server stores only a hash. Plus the language of the device. Purpose: let the server know which device belongs to which group, and send notifications in your language. There is no username and no password.
• Apple user ID: Only if you sign in with Apple. Tandu gets a stable identifier from Apple, not an email address. Tandu also stores a token from Apple that lets it revoke your Apple sign-in when you delete your account. Purpose: find your groups again on several devices and on a new iPhone.
• Push token: The address of your iPhone at Apple for notifications, including Live Activities. Purpose: notify you when something happens in a group. If you do not allow notifications, there is none.
• Purchases: Tandu Pro and Trip pass. The server checks the transaction signed by Apple and stores the product, purchase date, expiry and, for a Trip pass, the group. Tandu never gets payment details, only Apple has them. The server also counts how many cloud scans you used this month.
• Web link: Anyone opening a group in the browser gets a technical cookie that recognises the browser (so that “That’s me” sticks). It holds nothing about the person and lasts up to 400 days. The server forgets the browser's connection to the group after 400 days without a visit. The IP address is only used as a salted hash for abuse limits and deleted after one day at most.
• Exchange rates: Every day the server fetches the reference rates of the European Central Bank. No personal data goes to the ECB.

Server logs

The hosting provider's web server writes an access log, as web servers usually do: IP address, time and requested address. For a web link, the requested address can contain the secret group token or the join code. These logs are kept for 30 days and serve the operation and security of the server (Art. 6(1)(f) GDPR). Tandu itself writes no contents and no IP addresses to its log.

Where the data lives

Shared groups always live on the Tandu server, because the link needs them there. Groups you do not share stay on your iPhone. If you are signed in with Apple, Tandu also stores them as a backup under your account, without a link and for your own devices only.

The server is in the EU. The connection is encrypted with TLS. On the server the data is stored as plain text so the web link can work. The server does not read or analyse it. It does not write contents to its logs.

Who gets data

• Hosting provider: The server runs at a hosting provider in the EU. A data processing agreement is in place.
• Anthropic: Only for cloud scan ("Read more closely") and only with your consent. Then the photo of the receipt goes through the Tandu server to Anthropic (Claude), which reads the receipt. The Tandu server does not store the image. Anthropic is based in the USA, the transfer rests on your consent (Art. 49(1)(a) GDPR). You can withdraw it any time in Settings. Without consent no image ever goes to Anthropic, and scanning on the device still works.
• Apple: For Sign in with Apple, purchases and notifications. Apple's privacy terms apply there.
• European Central Bank: Only the rate lookup by the server, without personal data.
• Others in your group: Anyone with the link sees the group, including names, expenses and shared payment details.

Nothing else leaves. There are no analytics services, no tracking, no ads and no passing on for advertising.

Legal basis

Processing is needed so that the app does what you ask of it (Art. 6(1)(b) GDPR). Cloud scan rests on your consent (point a). The abuse limit rests on our interest in protecting the server from overload (point f).

Deleting

• Trash: Deleted expenses stay in the trash for 30 days. After that the server removes their details (title, amounts, notes, split) and their receipt photos, and only a note that they existed is left. The group's history, which records changes, stays until the group is deleted.
• Delete a group: The group admin can delete a group for everyone. Its data is removed from the server right away.
• Delete account: In the app under Settings, Account and sync. This removes your backups on the server and the link to Apple. Shared groups carry on for the others. The device ID with push token and language stays stored so that shared groups keep working on your iPhone. It cannot be tied to a person. If you want it gone too, write to the email address above.
• Anything else: Write to the email address above and we will take care of it.

Your rights

Under the GDPR you have the right to access, rectification, erasure, restriction of processing, data portability and objection. You can withdraw consent at any time with effect for the future. You can also complain to a data protection supervisory authority, for example the one of your federal state.

As of: November 2026