Privacy

Last updated 17 September 2026

Tended is a spending app. It works best when it knows what you spend, so this page is about exactly what that means: what is kept, who else can see it, and how to get rid of it.

You can use Tended without an account

Open the app and start logging. In that mode everything — your spending, budgets, bills and categories — is stored on your phone and never sent to us. We do not know you exist. There is no sign-up, no email, no identifier that reaches our servers.

Two things to know about it. Device storage is not encrypted by us, so anyone who can unlock your phone can read it, and anything that needs a server — the coach, receipt scanning, shared budgets — is unavailable until you make an account. If you later sign up, what is on the device is uploaded to your new account and the local copy is cleared.

What we store when you do have an account

• Your account. Email address, and a display name if you set one. Your password is handled by our authentication provider and we never see it.
• Your spending. Amounts, merchants, dates, categories, any notes you write, and the individual items on a scanned receipt.
• Your plans. Budgets, recurring bills, wallet balances, monthly income if you enter it, and your chosen currency.
• Receipt photographs, if you scan them. These are held in private storage under your user id and are readable only through short-lived links issued to you.
• Shared budgets. If you invite someone, we store their email address so the invitation can find them.
• What the coach has told you — the insights and recommendations it has generated about your spending.
• Your avatar. This is a cartoon figure you build from a set of options. It is not a photograph and says nothing about how you look.

What we do not do

• We never connect to your bank. There is no open-banking integration, no card linking, no read access to any account of yours. Everything in Tended got there because you logged it or photographed it.
• We do not record your location. The app never asks for location permission and never collects it.
• We do not track you. There is no analytics SDK, no crash reporting, no advertising identifier and no third-party tracker in the app. We cannot see which screens you visit.
• We do not sell your data, and we do not share it for anyone else's advertising.
• Reminders are set by your phone. We hold no push token and cannot send you a notification from our servers.

Who else sees it

Running the app means some data passes through other companies. These are the only ones, and each gets only what its job needs.

• Supabase hosts the database, sign-in and receipt storage. They hold everything listed above, on our behalf.
• OpenRouter, which routes to Anthropic's Claude models, powers the coach and receipt reading. This is the one worth reading carefully — see below.
• Inngest runs background jobs, so receipt processing and coach reviews pass through it.
• Resend sends email. It sees the address a message goes to, and the household name on an invitation.

What the coach is actually sent

We want to be precise here, because “anonymised” would be untrue. When you ask the coach a question, the app builds a summary of your recent finances and sends it with your message. That summary contains real detail: your top merchants by name with totals, your largest recent transactions, your fifteen most recent entries with dates and amounts, itemised purchases where we have them, and your budgets against actual spending. It is a recent slice rather than your whole history, but it is not anonymous.

When you scan a receipt, the photograph itself is sent to be read. Your email address, your name and your user id are not included in any of this.

Deleting your account

Settings, then delete your account. The app tells you what you are about to lose before you confirm. Your spending, budgets, bills, wallets, coach history and profile are removed.

Two honest exceptions.

• Spending inside someone else's shared budget stays, because it is part of a household's totals that other people budgeted around. Those entries are detached from you: your notes, receipts and ownership are stripped, and the entry is reassigned to an anonymous “Former member”. The amount, date and category remain, as do the items on that entry.
• Receipt photographs are not yet removed from storage automatically. The link to them is destroyed, so nothing in the app can reach them. If you want the files themselves deleted, email us and we will do it by hand. We are fixing this.

Households you created are deleted for everyone in them, which the confirmation screen warns you about.

Your rights

Depending on where you live you may have the right to see a copy of your data, correct it, delete it, or object to how it is used. Deletion is built into the app. For anything else, email us and we will do it — there is no automated export yet, so expect us to send it to you by hand within a month.

Children

Tended is not intended for children under 13, and we do not knowingly collect their data. We do not currently ask your age, so this is a rule rather than something the app enforces. If you believe a child has given us data, tell us and we will remove it.

Keeping it

We keep your data while your account exists. Delete the account and it goes, with the two exceptions above. We do not have a scheduled purge for dormant accounts, so if you are finished with Tended, deleting it is the reliable way to be gone.

Changes

If this page changes in a way that affects you, we will say so in the app rather than quietly editing the date at the top.

Contact

Questions, requests, or a receipt you want erased: privacy@tendedapp.space.