Tandem — Privacy
last updated september 2026 · operated by kirke labs · this policy covers the Tandem iOS app; the readings and albums sold on this site are covered at /legal
The short version. Tandem works out your charts, your calendar and your day pages on your phone. Your birth date, birth time, birthplace and diary entries never leave it. The one exception is the writing: when you ask for a letter or a question about a day, the facts needed to write it are sent away and an answer comes back. Nothing is sent until you ask, and nothing you send is stored.
What stays on your phone
Everything that identifies you. Your birth date, time and place, and your partner's. Every chart, bond and composite computed from them. Your diary entries and prompt responses. Every letter and answer you have received. These live in your phone's own storage. There is no account, no sign-in, and no copy on any server of ours.
What leaves it, and when
Birthplace search. When you type a place name while adding a person, that text goes to open-meteo.com to become coordinates. Only the text you typed — not your location, not your identity, not the person's other details.
Letters, day readings and questions. Only when you ask for one. What is sent: your name, because the letter is addressed to you; derived facts about the sky — which planets meet which points in your chart, in which houses, on which dates; and the words you wrote, if you wrote any. Not your birth date, birth time or birthplace. Those stay on the phone, and only what the engine computed from them is sent.
Who writes it. The request goes to the Circe's Shadow letter service, which passes it to the writer you chose: Google (Gemini), Anthropic (Claude), or OpenAI (GPT). You choose which on every request, and the app names the choice and its cost before you make it. None of them receives anything until you tap.
Nothing is kept. The letter service holds an API key and a daily request counter. It has no database of briefs, notes or questions. The finished letter is stored on your phone, not on the server.
Purchases and credits
Apple takes the payment. Tandem is bought once, and the writing is paid for in credits. Payment is handled entirely by Apple; we never see a card number.
An anonymous identifier, and a number. RevenueCat confirms with Apple what you bought and gives us an identifier tied to your App Store account — not to your name, your email, or you. That identifier and a credit balance are the only things we store on a server. There is no name against it, and no way for us to work out whose it is. It is also why credits survive a reinstall: they belong to the store account, not to the app.
Crash reports
Stack traces, and nothing else. If the app crashes, a report goes to Sentry so it can be fixed. It carries the stack trace and your device and OS version, under a random installation identifier. It is deliberately stripped of everything else: no user record, no console logs, no navigation details, and the text of any failed letter is replaced with “redacted” before sending — because that text could contain statements about you.
What we never do
No tracking. No advertising identifiers, no ad networks, no analytics toolkit, no profiles built or sold. Nothing about you is shared with anyone for marketing, by us or by anyone we use.
No accounts. There is nothing to sign up for, so there is nothing to leak.
No selling of data. Not to anyone, at any price.
Where things are
London, and the writers' own machines. The letter service and the credit ledger run on Supabase in London. The three AI providers named above are US companies and process each request on their own infrastructure.
Your rights
Deleting the app deletes your data. Because it is held on your own device, there is no server copy to request or erase.
The one exception. The anonymous purchase identifier and its credit balance sit on a server. To have it removed, write to steve@kirkelabs.com — though with no name or email attached to it, you will need to tell us the identifier before we can find it. Removing it also removes any unspent credits.
Children. Tandem is not directed at children and collects nothing knowingly from anyone under 13.
questions · steve@kirkelabs.com · material changes to this policy will be noted here with a date