Last updated: 1 October 2026
TandemTab ("we", "us") is a personal budgeting app that helps you track spending, budgets and savings. All the data in the app is what you choose to enter or import yourself — for example from a bank statement file (CSV, Excel, OFX, QIF or XML). What you import, and whether you import anything at all, is entirely up to you. This policy explains what personal data we process and why. It is written to comply with the EU/UK General Data Protection Regulation (GDPR).
TandemTab is operated by TandemTab Company, Sofia, Bulgaria. For any privacy question or to exercise your rights, contact us at admin@tandemtab.com.
Instead of connecting a bank, you can import a statement file you export from your bank yourself. The app reads the transactions locally to prepare draft entries; nothing becomes a budgeting entry until you review and confirm it. You decide what to import and what to leave out.
TandemTab has an assistant that logs expenses, answers questions about your money and takes you to the right screen. It works on your device. The app already holds your account, so it answers what it can locally, and those answers send nothing anywhere.
Some questions it cannot answer on its own. For those — and only those — it can send the question to
Anthropic (model claude-haiku-4-5) to be interpreted. That step is off
unless you turn it on: the first time it would happen, the assistant stops and asks, and nothing is
sent unless you agree. That is a separate, explicit consent you can withdraw at any time by not using it.
Sending is not switched on for most accounts yet. While we are still testing it, only a small number of accounts can send a question at all; on every other account the assistant works on the device only, and nothing described below about Anthropic happens. We are telling you how it works now rather than when it reaches you.
When a question is sent, it is not sent as you typed it.
Your words are taken out first, on your device. The names of your categories, goals,
wallets and journeys are replaced with numbered placeholders, and every number is removed. A
question like “how is my Car fund doing after the 250 I put in at Lidl” leaves as
“how is my {1} doing after the ### I put in at Lidl”, with a separate note saying only that
{1} is a goal. If a word looks personal and the app does not recognise it, the question is
not sent at all — the assistant tells you so instead of guessing.
What this means in practice: no balance, amount, category, goal, wallet or journey name is ever sent, and no part of your account, its history or its documents is sent. Only the reshaped sentence above and the list of placeholder types go. Each question is sent on its own — no earlier questions, answers or conversation history travel with it. We keep the reshaped question only if the assistant could not answer it (see Questions it could not answer below).
Any figure the assistant reads back to you was worked out on your own device from your own data. The model is never given a number and never returns one, so it cannot get one wrong.
Where it goes. Anthropic is based in the United States, so this step involves a transfer outside the EU. It is limited to the reshaped question described above. Anthropic processes it to produce the answer and handles it under its own terms as our processor; we do not authorise it to be used to train models. If you would rather nothing left your device at all, do not turn sending on — the assistant's on-device answers and everything else in TandemTab work exactly the same.
Richer answers (a second, separate consent). You can also turn on richer answers. With them, a question the device cannot answer is sent as you typed it, together with the last few messages of the conversation and a summary of the account you are viewing — balances, budgets, the period's expenses and their notes, goals, wallets and bills (in a shared account, everyone's entries) — so the model can work out the answer. To answer, it may also ask our server to look up expenses or totals for a date range in that account. The same transfer, processor and no-training terms as above apply. The assistant asks before turning this on, it is off by default, and you can turn it off in the assistant at any time.
Questions it could not answer. When a sent question comes back unanswered, we keep that question — the reshaped version, or with richer answers the question as you typed it — together with the date and the app's language, for up to 90 days, so we can teach the assistant to answer it. We do not keep the answer, the account summary or the conversation, and the question is deleted with your account.
A TandemTab account can be shared: the owner may invite other people, who then become members and can see and edit that account's contents. The owner can remove a member, transfer ownership, or leave the account at any time; a removed member immediately loses access. A shared account may contain another person's financial information, so we recommend members keep its contents confidential and enable two-factor authentication.
TandemTab's free plan needs no payment details at all. Pro starts with a free trial: you enter your card on Stripe's page when you upgrade, nothing is charged during the trial, and Stripe takes the first payment when it ends unless you cancel before then. We record that you have had a trial, so it can't be started twice.
If you buy Pro, the payment is handled by Stripe. You enter your card on Stripe's own secure page, not in TandemTab, so we never see or store your card number. Stripe processes what it needs to take the payment: your email address, your payment details, your billing country or address (so the right VAT is charged — as the seller, we owe VAT at your country's rate), and the record of each payment. Stripe also processes some of this as an independent controller, for fraud prevention and its own legal obligations, under its privacy policy.
What we keep is only what the app needs to know whether you have Pro: the plan, monthly or yearly, the dates it started and renews or ends, whether it will renew, and Stripe's reference for your subscription. You can update your card, see your invoices or cancel at any time from Manage billing in your plan settings, which opens Stripe's billing page; a cancelled plan stays Pro until the period you paid for ends.
Where it goes. For customers in Europe, Stripe's services are provided by Stripe Payments Europe, Limited (Ireland). Stripe may transfer data to Stripe, Inc. in the United States; such transfers are covered by Stripe's safeguards, such as the European Commission's Standard Contractual Clauses.
We do not sell your data. We share it only with service providers who help us run TandemTab:
Off unless you turn it on. Trip Mode keeps a copy of one account on the device you turn it on for, so the app still opens and still takes an expense when you have no connection — on a flight, or abroad. Until you switch it on, nothing about your account is stored on the device.
While it is on, that copy lives in your browser's or your phone's own app storage. It is not encrypted the way our servers are, so it is protected by your device rather than by us — which is the honest reason it is opt-in and per device. Expenses you add with no signal are held there too, and sent the next time the app has a connection.
Turning Trip Mode off deletes the copy, and so does signing out. If you lose the device, removing your access to it is the right first step — nothing in it can be reached from our side.
Your data is hosted in the European Union, transmitted over encrypted (HTTPS) connections, and encrypted at rest. The keys that protect it are held separately from the database itself, so access to the database alone does not reveal your data. Access credentials are held server-side and protected. We keep your data for as long as your account exists. If you leave or delete an account it is archived and permanently deleted after 30 days. You can delete your data at any time by removing your accounts. Diagnostic / error reports live in our server logs and are kept only for a short period (typically up to 30 days) before rolling off automatically.
One exception: billing records. If you have paid for Pro, invoices and payment records must be kept for as long as tax and accounting law requires — in Bulgaria, up to 10 years — even after you delete your account. They are held by Stripe and in our accounting records, and are used for nothing else.
Under the GDPR you may request access to, correction or deletion of your data, restrict or object to processing, request portability, and withdraw consent at any time. To exercise any right, email admin@tandemtab.com. You may also lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP) or your local authority.
We use only the storage strictly necessary to keep you signed in and remember preferences (such as your theme and language). We do not use advertising or third-party tracking cookies.
We may update this policy; material changes will be reflected by the "last updated" date above.