Tend privacy policy

Tend stores the information you give it in an encrypted database on your phone. The encryption key is kept in your phone's secure storage. This information never leaves your phone unless you choose to send it somewhere (see section 4). It can include:

• Your answers to the setup questions (for example who you live with, your work hours, and what makes daily life harder), which shape your routine.
• Your routines, what you've logged (such as water, food, meds, sleep and mood), to-dos, reminders, notes, shopping lists and safe foods.
• Medications you add, with doses, times and what you've logged as taken.
• If you turn on the cycle tracker: period days, symptoms and, if you choose to log it, sexual activity. The cycle tracker has its own PIN or fingerprint lock.
• People you want to stay in touch with, and when you last talked.
• Your companion's name and look. If you use a photo to help design it, the photo is processed on your phone and only kept if you choose “Keep the photo”.
• Your companion's home: what you've arranged, wall colours, the people and pets you add, and any of your own pictures you put in frames or videos you choose for the TV. These are copied into Tend on your phone.
• Your settings and preferences.

Every permission is optional, and Tend asks only when you turn on the feature that needs it. You can turn any of them off in your phone's settings.

• Notifications: to show the reminders and check-ins you choose.
• Alarms and reminders (Android): so reminders arrive on time.
• Microphone and speech recognition: so you can talk to your companion. Tend asks your phone to turn speech into text on the phone itself. Tend does not record or keep your voice.
• Calendar: to show your events and remind you before them. Tend reads your calendar on your phone and does not change your events.
• Camera: only if you use a photo to help design your companion, or to scan a Neighbor's QR code. Tend doesn't record or keep camera images when scanning.
• Photos and videos: only when you choose a picture for your companion's home or a video for its TV. The one you pick is copied into Tend on your phone.
• Fingerprint or face unlock: to unlock the app or the cycle tracker. This is handled by your phone. Tend never receives your fingerprint or face data.
• Steps and sleep (Android, through Health Connect): if you turn this on, Tend reads your step count and last night's sleep on your phone to fill your companion's needs.
• Usage access (Android): if you turn on screen time, Tend reads how many minutes you've used your phone today, on your phone.
• Notification access (Android): if you turn on “Notice messages from your people”, Tend notes the sender's name and the time of new messages, only to remind you about people on your list. Tend never reads or stores what a message says. Turning it off stops it immediately, and you can clear what was noticed.

On Android, Tend can check whether music or an audiobook is playing, so your companion can put on headphones. It only learns “something is playing”, never what or from which app, and needs no permission. You can turn it off in Settings.

The current version of Tend does not use your location.

We do not collect personal information through Tend, except what Neighbors and Friends needs if you turn it on (section 5). The app has no advertising, no analytics and no tracking tools, and it blocks the advertising ID on Android. Tend does not send your routine, logs, notes, health or cycle information to us or to anyone else.

Your companion's voice is recorded ahead of time and built into the app, so hearing it speak doesn't send anything over the internet. If a line isn't pre-recorded, your phone's own text-to-speech reads it.

When you download Tend, the app store you use (Google Play or Apple's App Store) may collect information such as install counts and, if you've allowed it, crash reports, under that store's own privacy policy. We may see summary statistics from the store, such as how many people installed the app, but not what you put into Tend.

• Accountability buddy: if you turn this on, Tend writes a short update (for example how your companion is doing) and you send it through your own messaging app. You see the text before it goes. It never includes your answers, tasks, health details or cycle data.
• Backups and exports: you can save a backup file or an export and choose where it goes, using your phone's share options. Backups are encrypted with a password you choose. Cycle data is left out unless you choose to include it. Your phone's automatic cloud backup is turned off for Tend, so your data only leaves the phone in files you save yourself.
• Help: “Share setup details” in Help and fixes lets you send how Tend is set up (such as the app version and which features are on) to someone helping you. It never includes anything you've logged, named or written.
• Links you tap: for example a crisis helpline website opens in your browser, or a music or audiobook app opens.
• YouTube on the TV: if you paste a YouTube link for your companion's TV, the video plays from YouTube using its privacy-enhanced mode, so YouTube can see that the video was played from your phone, under YouTube's own privacy policy. Videos you choose from your phone stay on your phone.

Neighbors and Friends lets you connect with people you know. It is off until you turn it on, it is only for people aged 18 and over, and you can turn it off at any time. To make it work, Tend creates an anonymous account on our server (we use Supabase, a database service, to run it). There is no email address, phone number or password.

What the server holds while it's on:

• The name you choose for Neighbors, and a code that lets people add you.
• Your companion's look and voice choice (never a photo), so others can see it.
• Only while you've invited a Friend over: how your living room is set up in the app (paint, furniture and where things are), and a YouTube link if one is playing on its TV, so they see your room. It's removed when the visit ends, and Neighbors never see it. Your own video files never leave your phone.
• If you allow it, a word for what your companion is doing (such as “Working” or “Resting”), and when you last opened Tend.
• Who you've connected with, and whether you're Neighbors or Friends.
• Cheers, check-ins and messages you send, and invitations to do things together (such as watching TV or a focus session).
• People you block, and any report you make.

It never includes your routine, logs, needs, notes, reminders, medications, health or cycle information, answers, contacts, location, or anything else in Tend.

Who sees it: only people you've connected with see your name, your companion and your status, and only the people in a conversation see its messages. Someone who has your code can see your name and companion before asking to connect. Messages are protected in transit and on the server but are not end-to-end encrypted. We do not read messages, except the text included in a report you send us, which we use only to keep people safe. Our staff can access the server to run and protect the service.

Keeping and deleting it: it stays until you remove it. Removing someone deletes your connection and messages with them. Turning off Neighbors and Friends in the app deletes your account, connections and messages from the server straight away. Reports are kept for up to one year so we can deal with them, without your name attached once your account is deleted.

Safety: only people you accept can contact you, Neighbors can only send set phrases, and you can block, report or remove anyone at any time.

Tend for iPhone is a preview of Tend that runs in Safari from our website. The app itself is loaded from www.thewelcomepdx.org, like any web page, and then runs on your phone. What you put into it is saved in your browser's storage on that phone and is never sent to us or anyone else.

A few things are different from the Android app:

• Your information is kept in the browser's storage rather than in Tend's encrypted database, so keeping your phone locked matters even more.
• Your iPhone may clear a web app's saved data if it isn't used for a while. Saving a backup is the way to keep a copy.
• The preview doesn't use notifications, your microphone, your calendar, Health Connect, usage access or notification access.
• Like any website, our hosting provider may keep standard technical records when your phone loads the preview (such as the time of the request, your IP address and the type of device). These are not linked to anything you put into Tend. Our website's privacy policy, on our Policies page, covers these records.

Your information stays on your phone until you delete it. In Tend, Settings → Privacy, lock and backup lets you delete your health answers or delete everything. The cycle tracker has its own “Delete all cycle data”. Uninstalling Tend also deletes everything it stored on your phone.

Because we never receive your information, we can't recover it if it's deleted or your phone is lost, and there's nothing for us to delete on our side. Saving a backup is the way to keep a copy. If you use Neighbors and Friends, turning it off deletes what's held on the server (see section 5), and you can also email us to ask us to delete it.

Your information is stored in an encrypted database on your phone. You can add an app lock (a PIN or your fingerprint or face), and the cycle tracker has its own lock. You can hide what notifications and the home-screen widget show. No method of storage is perfectly secure, so please also keep your phone itself locked.

Tend helps with everyday routines. It is not a medical device and isn't a substitute for professional care. Because health information you enter stays on your phone and isn't sent to us, we don't hold any health records about you.

Tend is meant for adults aged 18 and over. It is not directed to children, and we don't knowingly collect information from children. Neighbors and Friends asks you to confirm you're 18 or over before it can be turned on; if we learn an account belongs to someone under 18, we delete it.

If we change how Tend handles information, we'll update this page and the date at the top before the change takes effect. If a change means information would leave your phone in a new way, the app will ask you first.

Questions about privacy in Tend: Support@Thewelcomepdx.org, (971) 213-8101, or The Welcome PDX, 310 SW 4th Ave., Portland, OR 97204.

This policy covers the Tend app. Our website has its own privacy policy on our Policies page.