Privacy Policy

This policy explains how Tend handles your information. It is written to be honest and minimal: Tend is built to collect as little as possible.

Controller and scope

For personal data Tend controls, the controller is learnhubplay (KVK 97741825), trading as Tend, at Tervurenpad 4, 1066 JV Amsterdam, Netherlands. VAT: NL005285187B56. Contact: admin@learnhubplay.nl. Most app processing occurs solely on your Mac and Tend does not receive that local data.

Short version

• The app runs on your computer. No accounts, no analytics, tracking, telemetry, or ads.
• System information Tend reads (disk, memory, battery, files, etc.) stays on your device.
• Data leaves your device only when you use the AI Assistant or manually request an update check (below).
• Those voluntary contacts are recorded in a bounded, clearable local Privacy Ledger containing fixed labels only, never the transmitted values.
• Tend is free at launch. There is no checkout, paid tier, advertising, or payment-data collection.

What we collect

1. Nothing, by default

Using Tend to clean, monitor, or manage your Mac involves no data collection by us. The app makes no background calls home and has no usage analytics. Resilience checks read local Time Machine, snapshot, and FileVault status without changing those settings or transmitting the results.

Tend Timeline stores up to 180 local state baselines for change comparison. Baselines contain bounded system metadata such as app/startup/storage-source names and states, disk and battery figures, device-reported SMART/NVMe fields, and backup/FileVault status. Inventory identifiers are hashed. Timeline never reads or stores file contents, never uploads its history automatically, and records at most one background baseline per 24 hours.

Timeline change explanations are derived locally from the two selected baselines and existing bounded cleanup/automation logs. Tend generates at most six explanations per comparison and labels direct action records, observed metadata, and timing correlations separately. Alternatives come from fixed local rules. Explanations are not stored as a new history and are included only when you view or explicitly export that comparison.

Early Warnings are computed locally from retained Timeline baselines and Health history. Fixed rules cover accelerating startup-disk growth, worsening device-reported drive evidence, backup gaps, recurring high crash-report counts, sustained battery-capacity decline, and stale evidence. Warnings are capped at eight, expose minimum-sample coverage, create no new history, read no file contents beyond existing bounded scans, and are never uploaded automatically.

The Drive Health page reads current capacity, filesystem/protocol, SMART status, and device-reported wear, media-error, and unsafe-shutdown counters on demand. The current response stays in memory. The page can show up to 30 matching observations already retained in Tend Timeline; clicking Capture Baseline explicitly adds the same bounded drive metadata to Timeline. Drive Health reads no file contents and makes no network request.

The user-triggered filesystem benchmark creates one hidden temporary file only in the writable local folder you select, writes 128, 256, or 512 MB of generated bytes, flushes and reads that file, and attempts removal in a final cleanup path after success, failure, or cancellation. Up to 60 completed results are stored locally with timestamp, storage-source name/type/evidence, test size, throughput/timing, free-space counters, and temporary-file cleanup status. The selected folder path and generated bytes are not retained; failed or cancelled tests are not added. History can be cleared from Drive Health or About, is compared only for the same source and size, and is never uploaded automatically. No user file is opened, and the benchmark never runs automatically or in the background.

The Apps page reads local bundle metadata, Mac App Store receipt presence, declared Sparkle feed hostname, fixed Homebrew/Setapp path markers, and code-signing/team identity to explain likely update provenance. These live scan results stay in memory. This provenance scan makes no network request, does not read receipt contents, and does not determine whether an update is available.

The Resilience Center reads the current APFS and Time Machine snapshot inventory on demand. Snapshot names, UUIDs, XIDs, and purgeable/container-shrink flags are shown in memory and are not persisted in full. Existing bounded Health and Timeline records retain only summary evidence such as local snapshot counts and the latest visible Time Machine timestamp. Snapshot sizes remain unknown unless macOS directly reports a numeric size.

The Startup page reads macOS Background Task Management records on demand using sfltool dumpbtm. Names, identifiers, bundle IDs, executable paths, developer/team identifiers, type, scope, flags, and enabled/disabled/unknown disposition remain in memory and are not persisted in full or sent anywhere. Tend excludes Spotlight, Quick Look, and Dock plug-in registrations from this view and does not use diagnostic BTM output as a toggle API.

Startup-disk forecasting is calculated locally from those same retained baselines and creates no additional history. It uses at most one valid storage sample per UTC day and withholds a countdown when trend evidence is insufficient or noisy.

Timeline change reports are generated locally only when you click Export Report. A report covers the two baselines you selected, contains bounded metadata and human-readable change evidence, and includes no file contents or raw inventory identifiers. It is saved only where you choose and is not retained separately by Tend.

Timeline annotations stay on this Mac. Tend keeps up to 300 annotations, each tied to an exact retained baseline pair and change identifier with one fixed label and a single-line note capped at 280 characters. Annotations are presented as user context, not measured evidence. They can be edited or removed individually, are included only when you export that annotated range, and are deleted when Timeline history is cleared.

Aggregate growth checkpoints stay on this Mac. A user-triggered, cancellable scan measures allow-listed cache/log and developer-data locations, then retains only aggregate byte totals and coverage states, never raw paths or file contents. Tend keeps up to 120 daily checkpoints, replacing same-day observations. Only complete measurements can influence a forecast. Clearing Timeline history also removes these checkpoints.

The hierarchical Storage explorer reads names, paths, file metadata, and one-level folder-size estimates only inside a folder you explicitly choose. Explorer results and selected paths stay in memory and are not added to Timeline, diagnostics, analytics, or network requests. Symlinks are listed but not traversed. Native Quick Look runs only when you request it. File Provider estimates reflect locally available filesystem data and may not represent total cloud storage.

Quick Look previews are user-initiated. Clicking Preview asks macOS Quick Look to open only the selected local item; Tend does not upload, index, or persist the preview or its contents.

Similar Photos runs only after you choose a folder and start a scan. Tend inventories up to 50,000 local files without following symlinks, selects at most the 300 largest supported images, and asks macOS sips to render each as a temporary 9×8 BMP. It computes a 64-bit grayscale difference hash, deletes each thumbnail immediately, removes the private temporary directory after completion, failure, or cancellation, and keeps paths, metadata, fingerprints, and up to 100 matching pairs in memory only. Nothing is uploaded or added to history. Similarity can be a false positive and never triggers automatic deletion.

A local Maintenance Plan stores at most eight current Health issue steps, including issue identifiers, titles, details, owning Tend pages, safety labels, status, and up to five verification attempts per step. Starting and verifying a step adds the bounded Health and Timeline records already described above. The plan never runs a fix and can be cleared from Health.

2. AI Assistant (optional)

If you are at least 18, accept the current disclosure, add a key from a billing-enabled Google Cloud project, and use the Assistant, Tend sends a summary of your system status (disk/memory/battery figures, cache sizes, detected issue names, the latest Timeline change summaries when available, and your questions) to Google's Gemini API, authenticated with your own key. It does not send your file contents. Shared context builds a local preview without transmitting it; submitting sends a fresh snapshot plus at most 16 visible chat messages. Requests can be cancelled and are time-bounded. Your key stays local on your device and is encrypted with macOS Keychain-backed storage when available; we never receive it. Google's current terms require Paid Services for API clients offered in the EEA, UK, and Switzerland. Review the Gemini API Terms, logging policy, and Google Privacy Policy. If you never enter a key, nothing is sent. Gemini validation and assistant requests add fixed-label entries to the local Privacy Ledger.

Every response and export is labelled AI-generated - Google Gemini. Output may be inaccurate and requires human review. The assistant is limited to Mac maintenance and is not for medical, legal, financial, employment, credit, insurance, education-admission, law-enforcement, migration, or other high-impact decisions. Tend makes no solely automated decision with legal or similarly significant effects. See the AI Transparency Notice.

Optional Dictate starts only after you click it and requires Apple's on-device Speech recognizer, with no network fallback. A session lasts at most two minutes and produces at most 8,000 transcript characters. Audio is processed in memory, never written to a recording file, and never sent to Tend, Google, or another service. The transcript remains editable and is sent to Gemini only if you explicitly click Send.

3. Update checks (optional, only when requested)

Tend does not check for updates in the background. If you click Check for Updates, Tend makes a time-bounded request to the fixed GitHub Releases API for this project. It sends the installed Tend version in its User-Agent; GitHub also receives normal connection information such as your IP address. No system-health data, file names, local histories, or AI key are included. Tend shows the result and does not download or install anything automatically. Each manual request adds a fixed-label entry to the local Privacy Ledger.

On the Apps page, Check Update appears only for an app that locally declares a Sparkle feed. After confirmation, Tend re-reads the declaration from the installed app and makes one cancellable, time- and size-bounded request to a public HTTPS endpoint. HTTP feeds, credentials, local/private hosts, unsafe redirects, oversized responses, XML entities/DOCTYPE, unstable channels, and releases incompatible with the current macOS version are rejected. The provider receives normal connection information and a Tend-version User-Agent; no app inventory, health data, file contents, histories, or AI key are sent. Results stay in memory, Tend never downloads or installs the update, and the Privacy Ledger does not retain the app name, feed hostname, or URL.

The Privacy Ledger stores only fixed field-category names. It never stores prompts, responses, API keys, file paths, transmitted values, external URLs containing credentials, or arbitrary error text.

4. Free distribution

Tend is supplied free at launch with no checkout, paid licence, subscription, advertising, or payment provider. We collect no payment or order data. These notices will be updated before any paid tier, donation processor, affiliate tracking, or advertising is introduced.

5. Support

If you email us, we receive your email address and message, used only to help you.

6. Diagnostic report export (optional)

If you click Export report, Tend creates a local Markdown diagnostic report on your Mac. It summarizes quick system signals, skips deep file scans, redacts your home folder path to ~, and redacts the host name to <host>. The report is not sent anywhere unless you choose to share it.

Purposes, lawful bases, and recipients

Requested app functions and AI transmission rely on performance of the requested feature/contract. Sales and licence delivery rely on contract; tax records rely on legal obligations. Support and security correspondence rely on contract where applicable and otherwise our legitimate interests in answering you and securing Tend. Tend uses no marketing or non-essential analytics.

Recipients are limited to 20i Ltd/Stackmail for business support email, Google when you explicitly use Gemini, GitHub for a manual Tend release check, and an installed app publisher for a confirmed Sparkle-feed check. We do not sell personal data.

What we never do

• We do not sell or share your data.
• No advertising or third-party trackers.
• We do not collect your files, browsing history, or keystrokes.

Your rights

Under the EU/UK GDPR, where applicable, you may request access, correction, erasure, restriction, portability, or object to legitimate-interest processing, and withdraw consent where consent applies. We normally respond within one month and explain any lawful extension or refusal. Contact admin@learnhubplay.nl. You may complain to the data protection authority where you live, work, or believe an infringement occurred.

About & Updates provides individual controls and a native-confirmed Delete All Tend Data action for all app-managed local records, schedules, preferences, and the saved AI key. Exported files and items already moved to Trash remain under your control.

Data retention

Local app data stays on your Mac. Tend keeps up to 300 health history entries, 180 Tend Timeline baselines, 300 Timeline annotations, 120 aggregate growth checkpoints, 500 automation run entries, 500 cleanup run entries, and 200 Privacy Ledger entries, each clearable inside the app. Health history can include local Time Machine/FileVault evidence at scan time. Timeline contains the bounded metadata described above, never file contents. Cleanup and related automation entries can include reported moved bytes, point-in-time startup-disk free-space before/after values and their signed delta. Known cache cleanup entries can retain up to 24 per-source before/after measurements and the first observation after each 1, 7, and 30-day threshold; only Tend's built-in cache allow-list is sampled, and a newer cleanup supersedes pending checkpoints for the same root. Cleanup entries can also include original local source paths, actual Trash destination paths for tracked Undo items, and restore timestamps; those records are not uploaded or exposed to web content. Privacy Ledger entries contain only the fixed labels described above. Battery drain sessions stay in memory only and are discarded when Tend quits. Live network samples stay in memory only and are not persisted or uploaded. User-exported diagnostic and Timeline change reports are saved only where you choose and are not retained separately by Tend.

The active Maintenance Plan is a single local record capped at eight steps and five verification attempts per step. Replacing or clearing it removes that plan record, while its separately bounded Health and Timeline checkpoints follow their own retention controls.

Support correspondence is normally deleted or anonymized within 12 months after closure unless a legal claim or duty requires longer. Tend holds no purchase or payment records for the free launch.

International transfers

Business support email is processed by 20i Ltd/Stackmail. 20i states that its primary datacentres are in the EEA and that any subprocessors are subject to its data-processing terms. Gemini Paid Services process prompts and responses under Google's processor terms, while Google acts as controller for account, billing, security, and usage metadata. Google may process data globally; its Cloud Data Processing Addendum provides European transfer mechanisms including adequacy decisions and Standard Contractual Clauses.

Children

Tend is not directed at children under 16 and we do not knowingly collect their data. Gemini integration is restricted to users aged 18 or older.

Contact

learnhubplay (KVK 97741825), trading as Tend
Tervurenpad 4, 1066 JV Amsterdam, Netherlands
VAT: NL005285187B56
admin@learnhubplay.nl