Privacy
What you write stays on your phone.
Last updated 29 October 2026
What you write in Tend stays on your phone. It is never uploaded, and no one — including us — can read it.
Tend is made by Tend App LLC (“we”, “us”). This page explains exactly what the app and this website do with information, in plain terms. It covers the TestFlight beta, the released app, and the waitlist at itstend.com.
Tend has no server and no account system. Everything below is written to your phone’s local storage and stays there:
Your first name, last name and email address
The stones you choose for your well, and what you’re aiming at for each one
Every check-in: your mood, what you hoped for, and anything you wrote
Your evening reflections — how the day left you, what went right, and anything you let go of
Your directions, Sunday resets, to-dos and their stone tags
Today’s events from any calendar you connect, and the stones you tag them with
Your reminder times
None of this is transmitted anywhere. It is not sent to us, not synced between your devices, and not readable by anyone but you. It is included in your iPhone’s own backup, so setting up a new phone from that backup brings your writing with it — that copy sits in your Apple account, never in ours. Delete Tend with no backup and no export of your own, and all of it is gone.
Tend sends anonymous usage measurements to PostHog, an analytics service, hosted in the United States. This exists so we can tell whether the app actually works — whether people finish setting up, and whether they’re still using it a week later.
How you are identified
By a random identifier created once when you install the app. It is not derived from your name, your email, your Apple ID or Google account, or anything about your device. It cannot be traced back to you, and deleting the app discards it permanently.
What is recorded
That an action happened — a morning check-in, an evening check-in, a stone tended, a direction set, a Sunday reset completed, onboarding finished
Counts and choices — which stones you selected, how many, how many days since you started, whether a written field was filled in, and which calendar you connected, if any (the phone’s, Google’s or both) — never anything from it
Never the content — the text of your notes and reflections is never sent, only whether you wrote something
App and device basics — app version and build, operating system name and version, device model (for example “iPhone 15 Pro”), manufacturer, screen size, language and time zone
App opens — when the app is installed, opened, or updated
No location — Tend instructs PostHog not to derive any location from your connection, so no country, city, postal code or coordinates are recorded. Your phone’s IP address is visible to PostHog for the instant it takes to receive the request, as it is for any connection to any server, and Tend’s PostHog project is set to discard it rather than store it.
Not collected by the app, ever: your name, your email address, your Apple ID or Google account, your calendar events, your mood values tied to you, the text of anything you write, your contacts, your photos, your location — precise or approximate — or any advertising identifier. Tend contains no advertising and no third-party trackers beyond the analytics and crash reporting described on this page.
Tend sends crash reports to Sentry, an error-reporting service, hosted in the United States. This exists so that an app which dies on your phone is something we can see and fix, rather than something we cannot tell apart from you deciding not to open it again.
A crash report contains the error and nothing around it: which line of code failed, the sequence of calls that led there, the app version, and the kind of phone and operating system it happened on. It carries the same random install identifier described above, so a crash can be matched to the session that produced it without naming you.
A crash report never contains what you wrote. Your notes, check-ins, reflections and Sunday highlights are stripped before anything leaves the phone, and Tend does not record your screen. Your IP address is not attached.
Signing in with Apple or Google
Signing in is optional — you can type your name instead, and the app works identically either way. Signing in does not create an account with Tend; there is no Tend account to create. It only fills in your name.
Apple. If you sign in with Apple, Apple gives Tend your name and email address, and a user identifier specific to this app. All three are stored on your device only. They are not sent to us or to anyone else. If you choose Apple’s “Hide My Email” option, Tend only ever sees the relay address Apple provides.
Google. If you sign in with Google, Google gives Tend your name, your email address, a link to your profile picture and an identifier for your Google account. Tend keeps your name, email address and the identifier, on your device only, and does not use the picture. Nothing is sent to us or to anyone else. Google’s own sign-in software keeps the sign-in itself in your iPhone’s keychain.
Tend’s reminders are scheduled locally on your phone at the times you choose. Nothing is sent from a server, and no notification service receives any information about you. You can turn them off in Tend’s settings or in iOS Settings at any time.
Tend can show today’s events beside your well, from either or both of two places. Both are optional, and Tend works without either.
The calendar on your iPhone. If you allow it, Tend reads today’s events from the calendars already on your phone — whichever accounts you have added in iOS Settings, whether that is iCloud, Google, Exchange or a subscribed calendar. It asks iOS for read access and nothing more, and this happens entirely on the phone.
Google Calendar, directly. If you connect it, Tend asks Google for read-only access to your calendars (two permissions, which Google describes as “see the list of Google calendars you’re subscribed to” and “view events on all your calendars”). Your phone then asks Google’s servers for today’s events, over an encrypted connection, from the calendars you have chosen to show in Google Calendar. The events travel from Google to your phone and nowhere else — there is no Tend server in between, and nothing is sent to us.
Tend never writes to your calendar. It does not create, change, move or delete anything, and it does not send invitations. Tags and ticks you add in Tend stay in Tend; they are never written back.
Event titles and times are held on your device the same way everything else is. They are never sent to us, never sent to the analytics or crash reporting described above, never shared with anyone, never used for advertising, and never used to develop, improve or train artificial intelligence or machine learning models.
You can withdraw access at any time: disconnect in Tend under App Settings; for the phone’s calendar, in iOS Settings → Privacy & Security → Calendars; for Google, at myaccount.google.com/connections. Disconnecting Google in Tend removes Tend’s access from your Google account, not just from the app.
Google user data
Everything above about Google — the sign-in and the calendar — is the whole of what Tend receives from Google, and the whole of what it does with it: show your name, and show today’s events beside your well, on your phone.
Tend’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
How your data is protected
Most of the protection is in what Tend leaves out: what you write, and everything Tend receives from Google, is never sent to us, so there is no copy of it on any server of ours to be breached or leaked. Beyond that:
On your phone — Everything Tend keeps is stored inside Tend’s own app container, which iOS walls off from every other app and, when your phone has a passcode, encrypts with keys tied to that passcode and to the device. The Google sign-in is held by Google’s own sign-in software in the iOS keychain, which iOS encrypts separately. Tend keeps no Google password and no stored copy of any Google token.
In transit — Every connection Tend makes — to Google for your calendar, to PostHog for analytics, to Sentry for crash reports — is encrypted with HTTPS (TLS). Calendar events travel only between Google’s servers and your phone.
Only what is needed — Tend asks Google for read-only calendar access and nothing broader, requests only the details of each event it shows (its title, time and status), and reads only the day in front of you. It has no permission to change your calendar.
Nothing sensitive in our services — Analytics and crash reports never contain anything you wrote or anything from Google. Writing is stripped from crash reports on the phone before they are sent, and both services are set not to store your IP address.
Who can see what we hold — The analytics, crash reports and waitlist addresses can be seen only by the people at Tend App LLC who need them to run Tend, through accounts protected by two-factor authentication. We never sell them or share them with anyone else.
Your iPhone backup — If your iPhone backs up to iCloud, Apple encrypts that backup, and with Advanced Data Protection turned on it is end-to-end encrypted.
If something goes wrong — If we learn of a breach affecting information we hold, we will tell the people affected, and the authorities where the law requires it, without undue delay.
This website and the waitlist
itstend.com is hosted by Framer. It sets no cookies, and carries no advertising or tracking pixels.
Visits. Framer counts visits for us: which pages were viewed, the site or link you arrived from, your device type, browser, operating system, language and country. Visitors are counted with an identifier that changes every day, so a visit cannot be followed from one day to the next, and none of it is tied to your name or email address.
The waitlist. If you join the waitlist, you give us your email address and nothing else. It goes from your browser straight to Loops, the email service that keeps the list and sends our letters, hosted in the United States. Loops records that you signed up on the website and when, sees your IP address with the request as any server does, and records whether each letter was delivered, opened and clicked, as email services do. Sign-ups from before 26 October 2026 were collected by Formspark and have since moved to Loops.
We use your address to tell you when Tend opens, to invite you to test it before then, and for occasional letters about what we’re building. Every letter has a link to unsubscribe. We never sell your address or share it with anyone else, and joining the waitlist connects nothing to anything you later do in the app.
To come off the list, use the unsubscribe link in any letter, reply to it, or write to info@itstend.com, and we’ll delete your address from Loops, and from Formspark if you signed up before then.
Take a copy — Settings → Your data exports everything you have written, as a readable file and as a full backup, to keep wherever you like.
Delete everything — Settings → Your data → Delete everything, or delete the app. Either removes all of your data, your scheduled reminders and the random analytics identifier. Delete everything also removes Tend’s access from your Google account, if you gave it any.
Reminders — turn them off in Settings, or revoke the permission in iOS Settings.
Your calendar — disconnect in Tend under App Settings, or revoke access in iOS Settings → Privacy & Security → Calendars (the phone’s calendar) or at myaccount.google.com/connections (Google). Tend keeps nothing from it.
Leave the waitlist — use the unsubscribe link in any letter, reply to it, or write to info@itstend.com, and your address is deleted.
Ask about your data — email us at the address below. Apart from a waitlist email address, we hold nothing that identifies you — analytics are tied only to a random identifier — so there is generally nothing personal to retrieve or delete, but we’ll answer honestly about anything you want to know.
Tend is not directed at children under 13, and we do not knowingly collect information from them.
If Tend starts doing something different with your information — adding accounts and cloud sync, for instance — this page will be updated before that ships, and the date at the top will change.
Questions, or anything here that doesn’t match what you’re seeing in the app: info@itstend.com.
Tend — live more meaningfully.