Privacy notice

Tandm holds what you log about your cycle so it can show it back to you, and so it can write a short daily note for your partner. Your partner never sees what you logged — only that written note, and only while you are sharing. You can stop sharing, or delete everything, at any time and without giving a reason.

Tandm is the data controller for the information described here. If you want to ask anything about your data, or make any of the requests below, email privacy@tandm-cycle.com.

Tandm is in private beta. It is a small product run by a small team, and this notice describes exactly what it does today rather than what a larger company might eventually do.

Your account. Your email address, the display name you choose, your timezone, and the date you agreed to this notice and confirmed you are 16 or over. There is no password — signing in is by a link emailed to you.

What you log. The dates your period starts, and for any day you check in: mood, energy, pain, libido, sleep, the symptoms you tap, flow, and anything you type in the note field.

What Tandm writes. The short daily notes generated for your partner, the weekly outlook, and your own monthly review.

Usage events. That you signed in, that a page was viewed, that a log was saved. These record that something happened and never what it contained.

Information about your cycle is health data. Under UK GDPR that makes it special category data (Article 9) and it gets the strongest protection the law provides.

Our lawful basis for holding it is your explicit consent — Article 9(2)(a), together with Article 6(1)(a). That is the box you ticked when you signed up. Consent means you can withdraw it, and withdrawing it is not supposed to be difficult: delete your account from Settings and it is done.

We do not sell your data. We do not share it with advertisers. We do not use it to build a profile of you for anything other than showing you your own cycle and writing your partner’s note. There are no third-party analytics or advertising trackers in this app.

He sees a short piece of written copy each day — a heading, a couple of sentences, and a few suggestions — plus a label for roughly where you are in your cycle and how confident Tandm is about it.

He never sees what you logged. Not your moods, not your symptoms, not your flow, and never your notes. His side of the app is not given that data to display: the information sent to his screen contains the written copy and the labels, and nothing else. That is enforced in code and checked by our tests on every change.

He is also never told the name of any life stage you might be in, never told that your cycle looks harder to predict, and never told that a period is late. Those are yours to say, not an app’s.

Nothing reaches your partner unless sharing is switched on. Every request his side makes is checked against that switch first, and it only passes when sharing is actively on.

Pausing stops his access immediately and can be undone. Ending sharing is permanent and also deletes every note that was ever written for him.

If you delete your account, his access ends with it and his side shows him that it has come to an end. His own login continues to exist; nothing of yours remains inside it.

The copy is generated using Anthropic’s Claude API. What gets sent for your partner’s note is: which day of your cycle it is, which phase that falls in, your average cycle length, how confident Tandm is, and the name you chose to be called.

Once you have logged enough for patterns to mean anything, it also includes averages across each phase and the symptoms you tap most often. Averages and symptom names only — never an individual day, and never anything you have written.

Your own monthly review is different: it is written for you, it is never shown to your partner, and it may draw on the notes you wrote that month.

Anthropic processes this on our behalf as a data processor and does not use it to train models.

Your logs and cycle history stay until you delete them or delete your account. Sign-in links expire after 15 minutes and can only be used once.

When you delete your account, everything personal to you goes with it: your logs, your cycle history, your reviews, your feedback, and any notes written for your partner.

Usage events are the one thing kept, and they are not kept as you. Every record of yours is re-labelled with a random marker that has never identified anyone and is not stored anywhere else, so what remains is a count of something that happened on a day — with no way back to a person, including by us.

You can get a copy of your data at any time — Settings has a button that downloads the lot as a file, with no need to ask us.

You can delete everything from the same screen. It happens immediately and cannot be undone.

You also have the right to correct what is wrong, to object to or restrict what we do, and to withdraw consent at any time. To ask for any of these, email privacy@tandm-cycle.com.

If you are unhappy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk. We would rather you told us first so we can put it right.

There are no passwords to steal. Sign-in links are stored only as a one-way hash, so the value emailed to you is not recoverable from our database. Your session is held in a cookie that scripts cannot read, sent over HTTPS only.

Data is stored in the UK and EU. Generating your partner’s note involves sending the limited information described above to Anthropic, which may process it outside the UK under the safeguards required by UK GDPR.

Tandm is for people aged 16 and over, and we ask you to confirm that when you sign up.

If we change how any of this works we will update this page and change the date at the top. If a change materially affects what happens to your data, we will tell you rather than quietly editing it.