Security

Your calendars hold sensitive things. We treat them that way.

Tandem reads only what it needs to show one agenda, keeps it for a short window, encrypts the keys to your accounts, and only ever changes events it created itself.

Read the Privacy Policy Report a security issue

How we protect your data

Practical safeguards, not badges

These are the things Tandem actually does today. We don't hold security certifications yet, so we don't claim any.

Encrypted Google tokens

The refresh token Google gives Tandem for each account is encrypted with AES-256-GCM before it's stored, and decrypted only at the moment Tandem calls Google. It is never logged or sent to your browser.

TLS everywhere

Every connection, from your browser to Tandem and from Tandem to Google and our providers, is encrypted with TLS (HTTPS).

Metadata only, for a short window

Tandem caches event metadata (title, time, location, busy/free, your RSVP) for about 7 days back and 60 days ahead. Each sync re-reads that window and deletes anything deleted in Google or outside it.

Descriptions aren't stored

Event descriptions, attendee lists and attachments are never saved. If a cross-posting rule copies descriptions, Tandem reads the text from Google at copy time and writes it straight to your other calendar.

Only touches what it made

Bookings, cross-post copies and reserve holds are tagged with a private marker. Tandem only updates or deletes events it created; it never edits or deletes anyone else's.

Copies are private by default

Cross-post copies default to a plain "Busy" title, private visibility, no attendees and no notifications. You choose per account pair whether more detail is shared.

A locked-down database

Every table has row-level security switched on with no public access. Only Tandem's servers can reach the data, and every request is scoped to the signed-in person.

No passwords to steal

You sign in with a one-time link sent to your email. Only addresses linked to a Tandem profile can sign in.

Google permission

Why Tandem asks for full calendar access

When you connect an account, Google shows one checkbox: permission to see and edit your calendars. We ask for that single permission, rather than read-only access, because Tandem needs to write to your calendar for three things: the meetings people book with you, the cross-post copies you set up, and optional holds for times you've offered.

The permission is broad, so we hold ourselves to a narrow rule: Tandem only creates, updates or deletes events it created and tagged. It never edits or deletes anyone else's events, and it doesn't access Gmail or any other Google service.

You stay in control

Pick calendars. Colleagues' shared calendars and subscriptions start switched off; Tandem doesn't sync calendars you exclude.
Disconnect any time. Disconnecting asks Google to revoke Tandem's access and deletes that account's cached calendars and events.
Revoke from Google. Remove Tandem at myaccount.google.com/permissions.

Our promises

No ads. No selling. No trackers.

We never sell your data or use it for advertising.
No third-party analytics, tracking pixels or advertising cookies, in the app or on this website. Only essential sign-in cookies.
No AI training. Data from Google is never used to train generalised AI or machine-learning models.
Google's Limited Use rules apply. Our use of Google data follows the Google API Services User Data Policy. Details are in the Privacy Policy.

Subprocessors

The providers that run Tandem for us.

Google: Calendar API, Google Meet links and account authorisation
Supabase: Database and sign-in, United States (us-west-2)
Vercel: Hosting for the website and app, United States
Inngest: Background jobs (sync, cross-posting, reminders), United States
Resend: Automation emails, only once email is switched on, United States

Responsible disclosure

Found a vulnerability?

Please email hello@tandem.page with the details and steps to reproduce. We'll acknowledge your report, keep you updated, and credit you if you'd like.

While investigating, please don't access or change other people's data, run denial-of-service or automated scanning, or use social engineering. Give us reasonable time to fix an issue before sharing it publicly.