Privacy Policy

Blue Line Advisory LLC ("we," "us," "Tendr") built Tendr to help busy households run more calmly. This policy explains, in plain English, what data we collect, why we collect it, where it lives, and what choices you have.

We don't sell your data. We don't run ads. We don't build advertising profiles. If that ever changes, this policy will change first and we'll tell you.

1. Who we are

Tendr is operated by Blue Line Advisory LLC, a limited liability company registered in New York, USA.

For any privacy questions, requests, or concerns, email nrolls@comcast.net. We aim to respond within 7 days.

2. The data we collect

Before you have a Tendr account (pre-launch waitlist)

If you sign up for early access on our website, we collect:

• Your email address
• Which interest list you signed up for (general waitlist vs. the "college / prep school" exploration list)
• The date and time of your signup

That's it. We use a service called Formspree to receive these form submissions. Formspree's privacy practices are at formspree.io/legal/privacy-policy.

We use your email only to (a) confirm your interest, (b) send you product updates and early-access invitations, and (c) ask you occasional short questions about what you'd want from Tendr. You can unsubscribe at any time by replying to any email or writing to nrolls@comcast.net.

When you use the Tendr app

When the Tendr app launches, it will collect and process:

• Account information: your name and email, provided through Sign in with Apple. If you use Apple's Hide My Email feature, we receive only the relay address.
• Household data: the household members, events, tasks, shopping list items, meal entries, and notes you create in the app.
• Calendar and Reminders data: if you grant permission, Tendr reads from and writes to your Apple Calendar and Apple Reminders. This data stays on your device and in your iCloud — we don't copy it to our servers.
• AI assistant inputs: text, voice transcriptions, and photos you send to the in-app assistant. See Section 4 for how this is handled.
• Subscription status: whether you have an active Tendr+ subscription. This is managed by Apple and shared with us in anonymized form.
• Device and diagnostic data: app version, iOS version, and crash logs, used to fix bugs. We use Apple's built-in crash reporting; we don't add third-party analytics SDKs.

We do not collect: your location (unless you explicitly opt in for location-based reminders), your contacts, your photos beyond ones you intentionally share with the assistant, your bank or payment data, or any biometric data.

3. Where your data lives

This is the most important part of how we built Tendr.

Almost all of your household data lives in your own iCloud account, not on our servers.

We use Apple's CloudKit framework, which means:

• Your calendar entries, tasks, shopping lists, meals, and household setup are stored in your private iCloud database
• When you share a household with a partner or other adult, the data is shared through CloudKit's private sharing — between your iClouds, not through ours
• We, Blue Line Advisory LLC, cannot see, copy, or analyze your household data because we don't host it

The only data that touches our infrastructure is:

• Waitlist signups (held by Formspree until you launch, then migrated to an email tool)
• AI assistant requests (see Section 4)
• Anonymized subscription and crash data via Apple

4. How we handle AI conversations

When you send a message, voice clip, or photo to the in-app assistant, the following happens:

1. Your input is sent to a request proxy we operate on Cloudflare Workers, which adds authentication and forwards it to Anthropic.
2. Anthropic (the company that builds Claude, the AI model) processes the request and returns a response. Anthropic's privacy practices are at anthropic.com/legal/privacy.
3. The response is returned to your device. The conversation is stored in your iCloud (Section 3), not on our servers.

We do not retain AI request content on our infrastructure beyond what's needed to deliver the response. We do not use your conversations to train AI models. Per our agreement with Anthropic, your conversations are not used to train Anthropic's models either.

For voice input, audio is transcribed using Apple's on-device Speech framework when possible, and the text (not audio) is sent to the AI.

For photo input (e.g., taking a picture of a school flyer to extract events), the image is sent to Anthropic for processing and is not retained after the response is generated.

5. Third parties

Tendr deliberately uses very few third-party services. Here's the complete list and what each one does:

We do not use Google Analytics, Facebook Pixel, Mixpanel, Amplitude, Segment, or any other third-party tracking or analytics platform.

We do not share or sell your data to advertisers, data brokers, or anyone else.

6. Children's privacy

Tendr is built for adults running households, including households with children. Adults can add their children as household members so that family events, tasks, and meals can be coordinated.

When a child is added as a household member, the only data stored about them is what the adult chooses to enter (typically a first name, age, and maybe a color). Children do not have their own Tendr accounts in version 1 of the app. Children cannot sign in, message the AI assistant, or be contacted through Tendr.

We do not knowingly collect personal information directly from children under 13. The app is rated 4+ on the App Store and is intended for adult use.

If you believe a child has somehow provided personal information directly to us, please write to nrolls@comcast.net and we will delete it.

7. Your rights

You have control over your data. Specifically:

Access — You can see all of your Tendr data inside the app at any time. You can also request an export by writing to nrolls@comcast.net.

Correction — You can edit or correct any data inside the app.

Deletion — You can delete individual items in the app at any time. To delete your entire account and all associated data, go to Settings → Account → Delete Account, or write to nrolls@comcast.net. We will process deletion requests within 30 days.

Withdrawal of consent — You can revoke Tendr's permission to access your Calendar, Reminders, Microphone, or Photos in iOS Settings at any time.

Marketing opt-out — You can unsubscribe from any non-essential email by clicking the unsubscribe link or writing to nrolls@comcast.net.

California (CCPA) rights — If you are a California resident, you have the right to know what personal information we collect, the right to delete it, the right to correct it, the right to opt out of any sale or sharing of it (we do neither), and the right not to be discriminated against for exercising these rights. To exercise any of these rights, write to nrolls@comcast.net.

EU/UK (GDPR/UK GDPR) rights — If you are in the European Economic Area or the United Kingdom, you have the rights to access, rectify, erase, restrict processing of, object to processing of, and port your personal data. You also have the right to lodge a complaint with your local data protection authority. To exercise any of these rights, write to nrolls@comcast.net.

We don't charge for any of these requests, and we don't require special forms.

8. Data retention

• Waitlist emails are kept until you ask us to delete them, or until 24 months after we launch (whichever comes first), at which point inactive addresses are removed.
• Household data in iCloud is retained by Apple per your iCloud account settings. If you delete the app, the data remains in your iCloud unless you delete it. If you delete your Tendr account, we remove the relevant CloudKit zones.
• AI request content is not retained on our infrastructure beyond the duration of the request.
• Subscription records are retained as required for tax and accounting purposes (typically 7 years in the US).
• Crash logs are retained for up to 90 days.

9. Security

We protect your data through these specific practices:

• All data in transit is encrypted using HTTPS/TLS.
• Calendar, household, and list data is stored in Apple's CloudKit infrastructure, which encrypts data at rest.
• AI requests pass through a Cloudflare Workers proxy that does not log request bodies.
• Our Anthropic API key is never embedded in the app — it lives only in our server-side proxy.
• We use Sign in with Apple, which means we never see or store passwords.

No system is perfectly secure. If we ever experience a data breach affecting your information, we will notify you and the relevant authorities within the timelines required by applicable law (72 hours for GDPR).

10. International transfers

Blue Line Advisory LLC is based in the United States. If you use Tendr from outside the US, your data may be transferred to and processed in the US.

For users in the European Economic Area or United Kingdom, we rely on Standard Contractual Clauses (where applicable) and on the privacy practices of our processors (Apple, Anthropic, Cloudflare) to maintain appropriate protections.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the "Last updated" date at the top
• Notify users by email if the changes affect existing users
• For significant changes, ask for renewed consent inside the app

Past versions of this policy are available on request.

12. Contact

For any questions about this policy or about your data, email nrolls@comcast.net.

Blue Line Advisory LLC
Available on request
New York, USA