Privacy

Tandu splits group expenses. That takes some data, but no more than needed. This page says which, what for, where it lives, who gets it and how it goes away. Short version: no tracking, no analytics, no ads, no selling of data.

Who is responsible

Dominik Chwalisz
Donarstraße 17
14482 Potsdam
Germany
Email: dom.chwalisz@gmail.com

This policy covers the Tandu iPhone app, its widgets and extensions, and the web pages at tandu.life that friends without the app open through a group link. The former address tandu.zaunserv.de leads to the same server.

What data there is and what for

• Names: Group name, member names and their emoji. Purpose: show the group and do the math. You pick them yourself, they do not have to be real names.
• Expenses: Amounts, currencies, titles, notes, categories, dates, splits, receipt line items and the history of changes. Purpose: calculate balances and the working, and show them to everyone in the group.
• Payment details: IBAN, account holder, PayPal.me name, Wero link. Only if you enter them and share them with the group. Purpose: the others can pay you with a tap. If you would rather not, leave them empty. Tandu never makes payments itself and never holds money.
• Receipt photos: Only if you attach a photo to an expense. Purpose: a receipt for the group. A receipt you only scan and do not attach stays on your device.
• Device ID: A random identifier for your iPhone, plus a secret of which the server stores only a hash. Plus the language of the app. Purpose: let the server know which device belongs to which group, and send notifications in your language. There is no username and no password. The device ID is not an advertising ID and not an Apple identifier.
• Apple user ID: Only if you sign in with Apple. Tandu gets a stable identifier from Apple, not an email address. Tandu also stores a token from Apple that lets it revoke your Apple sign-in when you delete your account. Purpose: find your groups again on several devices and on a new iPhone.
• Push token: The address of your iPhone at Apple for notifications, including Live Activities. Purpose: notify you when something happens in a group. If you do not allow notifications, there is none.
• Purchases: Tandu Pro and trip pass. The server checks the transaction signed by Apple and stores the product, purchase date, expiry and, for a trip pass, the group. Tandu never gets payment details, only Apple has them. The server also counts how many cloud scans you used this month.
• Web link: Anyone opening a group in the browser gets strictly necessary cookies that recognise the browser (so that “That’s me” sticks), protect forms and remember an entered PIN. They hold nothing about the person and last 400 days at most. The server forgets the browser's connection to the group after 400 days without a visit. The IP address is only used as a salted hash for abuse limits and deleted after one day at most.
• Exchange rates: Every day the server fetches the reference rates of the European Central Bank. No personal data goes to the ECB.

You do not have to give Tandu any of this. Without it, only the features that need it are missing: no names, no group; no payment details, no pay button; no push token, no notifications.

Artificial intelligence

Tandu uses AI in three places. Two of them run only on your iPhone:

• Reading a receipt on the device: Apple's text recognition (Vision) reads the receipt right on the iPhone. Nothing leaves the device.
• Quick entry: A sentence like “Lea paid €30 for the cinema” is understood by Apple's on-device language model (Apple Intelligence), if it is available on your iPhone. Nothing leaves the device here either.
• Cloud scan (“Read more accurately”): Only when you tap it and only after your explicit consent in the app. Then the photos of that one receipt (up to four pages, downsized) and the language of the app go through the Tandu server to Anthropic (Claude), an AI company. Anthropic reads the receipt and sends back the shop, date, total and line items. No names, no amounts from the group and no other photos are sent. The Tandu server does not store the image.

Cloud scan in detail:

• Recipient: For customers in the EU the contracting party is Anthropic Ireland, Limited (Dublin, Ireland). The data is processed by Anthropic, PBC in the USA and possibly in other countries where Anthropic or its subprocessors run data centres.
• Legal basis: Your consent (Art. 6(1)(a) GDPR). The transfer to the USA is covered by the European Commission's Standard Contractual Clauses, which are part of the data processing agreement with Anthropic (Art. 46(2)(c) GDPR). In the USA, authorities may under certain circumstances access data without you being told or being able to effectively object. The app tells you this before you consent.
• No training: Under its terms, Anthropic may not use the receipt photos or results to train AI models.
• Retention at Anthropic: Anthropic usually deletes inputs and results within 30 days. Only content that Anthropic classifies as violating its usage policy may be kept longer (up to two years).
• What a receipt can show: Besides items and prices, sometimes the shop name, the name of a server, the last digits of a card or a customer number. If that bothers you, use on-device reading or cover that part when taking the photo.
• Check the result: AI can misread. Tandu shows the result for checking before anything is saved and tells you when the line items do not add up to the receipt. There is no automated decision with legal effect on you (Art. 22 GDPR) and no profiling.
• Withdrawing: Any time in the app under Settings. After that no photo goes to Anthropic, and on-device reading keeps working. What happened before you withdrew stays lawful.

Server logs

The hosting provider's web server writes an access log, as web servers usually do: IP address, time and requested address. For a web link, the requested address can contain the secret group token or the join code. These logs are kept for 30 days and serve the operation and security of the server (Art. 6(1)(f) GDPR). Tandu itself writes no contents and no IP addresses to its log.

Where the data lives

Shared groups always live on the Tandu server, because the link needs them there. Groups you do not share stay on your iPhone. If you are signed in with Apple, Tandu also stores them as a backup under your account, without a link and for your own devices only.

The server is in the EU, even if you use Tandu outside the EU. The connection is encrypted with TLS. On the server the data is stored as plain text so the web link can work. Only people in the group or with the link can access it. The operator does not read or analyse contents. The server does not write contents to its logs.

Who gets data

• Others in your group: Anyone in the group or with the link sees the group, including names, expenses, receipt photos and shared payment details. So only share the link with people who belong in the group. As admin you can set a PIN and renew the link at any time.
• Hosting provider: The server runs at a hosting provider in the EU. A data processing agreement is in place.
• Anthropic: Only for cloud scan and only with your consent, see “Artificial intelligence”.
• Apple: For Sign in with Apple, purchases and notifications. Notifications and Live Activities go through Apple's push service (APNs). The name, title and amount of the change Tandu tells you about go to Apple, which delivers them to your iPhone. Apple's privacy policy also applies to all of this. Apple is responsible for it itself.
• European Central Bank: Only the rate lookup by the server, without personal data.
• Authorities: Only where the law requires it.

Nothing else leaves. There are no analytics services, no tracking, no ads and no passing on for advertising. Data is not sold.

Legal basis

• Processing is needed so that the app does what you ask of it (Art. 6(1)(b) GDPR): groups, expenses, sync, backup, notifications, purchases.
• Cloud scan rests on your consent (point a), as do notifications, which iOS asks about first.
• Abuse limits and server logs rest on the legitimate interest in protecting the server from overload and attacks (point f).
• The cookies of the web pages are strictly necessary for the page to do what you ask (§ 25(2) no. 2 TDDDG, the German implementation of the ePrivacy Directive). They need no consent.

How long data stays

• Groups and expenses: As long as the group exists.
• Trash: Deleted expenses stay in the trash for 30 days. After that the server removes their details (title, amounts, notes, split) and their receipt photos, and only a note that they existed is left. The group's history, which records changes, stays until the group is deleted.
• Removing a member: When the admin removes a member for good, that member's devices lose access to the group right away.
• Delete a group: The group admin can delete a group for everyone. Its data and receipt photos are removed from the server right away.
• Delete account: In the app under Settings, Account and sync. This removes your backups on the server and the link to Apple. Shared groups carry on for the others. The device ID with push token and language stays stored so that shared groups keep working on your iPhone. It cannot be tied to a person. If you want it gone too, write to the email address above.
• Deleting the app: Whatever is only on your iPhone goes with the app.
• Anything else: Write to the email address above and we will take care of it.

Security

The connection to the server is encrypted. Devices sign in with a random secret of which the server only knows a hash. Group links are long and random, join codes and PINs are protected against guessing. Other devices cannot get into groups they are not in. Some risk remains with any online service. If you notice something that looks like a security hole, write to the email address above.

Children

Tandu is not aimed at children. Anyone under 16 needs a parent's consent for cloud scan. We do not knowingly collect data from children under 13. If we learn of any, we delete it.

Using Tandu outside the EU

Tandu is available worldwide. Wherever you are, the data lives on the server in the EU, and this policy applies with the rights of the GDPR. For people in California and other US states with their own privacy laws: Tandu does not sell personal information, does not share it for cross-context behavioural advertising and does not use sensitive information to infer characteristics about you. For people in the United Kingdom and Switzerland the local rules apply accordingly, and cloud scan uses the UK and Swiss addenda to the Standard Contractual Clauses.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection (Art. 21). You can change, export (PDF, CSV) and delete much of your data right in the app. For everything else an email to the address above is enough.

Right to object: Where we process data on the basis of a legitimate interest (abuse limits, server logs), you can object at any time on grounds relating to your particular situation.

Withdrawing consent: You can withdraw consent (cloud scan, notifications) at any time with effect for the future, in the app or in the iOS settings.

Complaints: You can complain to a data protection supervisory authority, for example the one where you live or the one responsible for us: Die Landesbeauftragte für den Datenschutz und für das Recht auf Akteneinsicht Brandenburg, Stahnsdorfer Damm 77, 14532 Kleinmachnow, Germany, lda.brandenburg.de.

Changes

If something about Tandu changes that affects privacy, we update this policy. The current version is always here and linked in the app under Settings. Where needed, we ask before using data for new purposes.

As of: November 2026