Privacy Policy

This policy explains how Tend handles your information. It is written to be honest and minimal: Tend is built to collect as little as possible.

Controller and scope

For personal data Tend controls, the controller is learnhubplay (KVK 97741825), trading as Tend, at Tervurenpad 4, 1066 JV Amsterdam, Netherlands. VAT: NL005285187B56. Contact: admin@learnhubplay.nl. Most app processing occurs solely on your Mac and Tend does not receive that local data.

Short version

• The app runs on your computer. No accounts, no analytics, tracking, telemetry, or ads.
• System information Tend reads (disk, memory, battery, files, etc.) stays on your device.
• Data leaves your device only when you use the AI Assistant or manually request an update check (below).
• Those voluntary contacts are recorded in a bounded, clearable local Privacy Ledger containing fixed labels only, never the transmitted values.
• Tend is free at launch. There is no checkout, paid tier, advertising, or payment-data collection.

What we collect

1. Nothing, by default

Using Tend to clean, monitor, or manage your Mac involves no data collection by us. The app makes no background calls home and has no usage analytics. Resilience checks read local Time Machine, snapshot, and FileVault status without changing those settings or transmitting the results.

Tend Timeline stores up to 180 local state baselines for change comparison. Baselines contain bounded system metadata such as app/startup/storage-source names and states, disk and battery figures, device-reported SMART/NVMe fields, and backup/FileVault status. Inventory identifiers are hashed. Timeline never reads or stores file contents, never uploads its history automatically, and records at most one background baseline per 24 hours.

Timeline change explanations are derived locally from the two selected baselines and existing bounded cleanup/automation logs. Tend generates at most six explanations per comparison and labels direct action records, observed metadata, and timing correlations separately. Alternatives come from fixed local rules. Explanations are not stored as a new history and are included only when you view or explicitly export that comparison.

Early Warnings are computed locally from retained Timeline baselines and Health history. Fixed rules cover accelerating startup-disk growth, worsening device-reported drive evidence, backup gaps, recurring high crash-report counts, sustained battery-capacity decline, and stale evidence. Warnings are capped at eight, expose minimum-sample coverage, create no new history, read no file contents beyond existing bounded scans, and are never uploaded automatically.

The Drive Health page reads current capacity, filesystem/protocol, SMART status, and device-reported wear, media-error, and unsafe-shutdown counters on demand. The current response stays in memory. The page can show up to 30 matching observations already retained in Tend Timeline; clicking Capture Baseline explicitly adds the same bounded drive metadata to Timeline. For external/removable drives, a local free-space trend is calculated only when macOS provides a stable volume ID, the latest baseline includes that volume, at least seven daily measurements span seven days, reported capacity stays within 1%, and the latest valid measurement is no more than 14 days old. Tend stores a one-way hash of that volume ID to match baselines; it does not store the raw UUID or serial number. The trend reads no file contents and makes no network request.

The user-triggered filesystem benchmark creates one hidden temporary file only in the writable local folder you select, writes 128, 256, or 512 MB of generated bytes, flushes and reads that file, and attempts removal in a final cleanup path after success, failure, or cancellation. Up to 60 completed results are stored locally with timestamp, storage-source name/type/evidence, test size, throughput/timing, free-space counters, and temporary-file cleanup status. The selected folder path and generated bytes are not retained; failed or cancelled tests are not added. History can be cleared from Drive Health or About, is compared only for the same source and size, and is never uploaded automatically. No user file is opened, and the benchmark never runs automatically or in the background.

The Apps page reads local bundle metadata, Mac App Store receipt presence, declared Sparkle feed hostname, fixed Homebrew/Setapp path markers, and code-signing/team identity to explain likely update provenance. These live scan results stay in memory. This provenance scan makes no network request, does not read receipt contents, and does not determine whether an update is available.

The Resilience Center reads the current APFS and Time Machine snapshot inventory on demand. Snapshot names, UUIDs, XIDs, and purgeable/container-shrink flags are shown in memory and are not persisted in full. Existing bounded Health and Timeline records retain only summary evidence such as local snapshot counts and the latest visible Time Machine timestamp. Snapshot sizes remain unknown unless macOS directly reports a numeric size.

The Startup page reads macOS Background Task Management records on demand using sfltool dumpbtm. Names, identifiers, bundle IDs, executable paths, developer/team identifiers, type, scope, flags, and enabled/disabled/unknown disposition remain in memory and are not persisted in full or sent anywhere. Tend excludes Spotlight, Quick Look, and Dock plug-in registrations from this view and does not use diagnostic BTM output as a toggle API.

Startup-disk forecasting is calculated locally from those same retained baselines and creates no additional history. It uses at most one valid storage sample per UTC day and withholds a countdown when trend evidence is insufficient or noisy.

Timeline change reports are generated locally only when you click Export Report. A report covers the two baselines you selected, contains bounded metadata and human-readable change evidence, and includes no file contents or raw inventory identifiers. It is saved only where you choose and is not retained separately by Tend.

Timeline annotations stay on this Mac. Tend keeps up to 300 annotations, each tied to an exact retained baseline pair and change identifier with one fixed label and a single-line note capped at 280 characters. Annotations are presented as user context, not measured evidence. They can be edited or removed individually, are included only when you export that annotated range, and are deleted when Timeline history is cleared.

Aggregate growth checkpoints stay on this Mac. A user-triggered, cancellable scan measures allow-listed cache/log and developer-data locations, then retains only aggregate byte totals and coverage states, never raw paths or file contents. Tend keeps up to 120 daily checkpoints, replacing same-day observations. Only complete measurements can influence a forecast. Clearing Timeline history also removes these checkpoints.

The hierarchical Storage explorer reads names, paths, file metadata, and one-level folder-size estimates only inside a folder you explicitly choose. Explorer results and selected paths stay in memory and are not added to Timeline, diagnostics, analytics, or requests made by Tend. Symlinks are listed but not traversed. Native Quick Look runs only when you request it. Folder estimates sum reported file sizes, not allocated disk usage. File Provider placeholders can expose a remote file size while the contents are dataless locally, so reported sizes are not local disk usage or total cloud usage. Listing provider-managed folders may cause macOS or the provider to supply folder metadata; Tend does not read file contents or transmit workspace data to its services.

Quick Look previews are user-initiated. Clicking Preview asks macOS Quick Look to open only the selected local item; Tend does not upload, index, or persist the preview or its contents.

Similar Photos runs only after you choose a folder and start a scan. Tend inventories up to 50,000 local files without following symlinks, selects at most the 300 largest supported images, and asks macOS sips to render each as a temporary 9×8 BMP. It computes a 64-bit grayscale difference hash, deletes each thumbnail immediately, removes the private temporary directory after completion, failure, or cancellation, and keeps paths, metadata, fingerprints, and up to 100 matching pairs in memory only. Nothing is uploaded or added to history. Similarity can be a false positive and never triggers automatic deletion.

A local Maintenance Plan stores at most eight current Health issue steps, including issue identifiers, titles, details, owning Tend pages, safety labels, status, and up to five verification attempts per step. Starting and verifying a step adds the bounded Health and Timeline records already described above. The plan never runs a fix and can be cleared from Health.

The optional Workflows page (in development; not yet a packaged-release promise) stores your General, Developer, or Creator profile on this Mac. If you add a workspace, Tend retains the name and absolute folder path you chose, its cleanup-protection setting, profile, and policy thresholds so it can remeasure the same folder and enforce protection. In the Mac App Store build, Tend also stores the macOS security-scoped bookmark granted by the folder picker so it can reopen that user-selected permission for later measurements; the bookmark stays local and is removed with the workspace. A measurement runs only when you click Measure. It records aggregate reported file sizes, not allocated disk usage, five aggregate category byte totals, file/folder counts, volume capacity, timestamp, a one-way hash of the persistent volume UUID when macOS provides one, a local filesystem device-number fallback, and partial-coverage reasons. Tend does not store the raw UUID; these identities are used only to keep comparisons and forecasts on the same volume and remain on this Mac. The scan does not retain file names, file paths below the selected root, file contents, or a file list. Scans stop after 25,000 entries or 15 seconds, skip symlinks, and label permission/time/entry gaps. Up to eight folders and 60 measurements per folder are retained. Removing a workspace deletes its local measurements. Growth and minimum-free-space policies are checked after a measurement; Tend does not scan workspaces in the background or transmit workspace measurements to its services. File Provider placeholders can report remote file sizes while their contents are dataless locally, so workspace totals are not local disk use or total cloud usage. Scanning provider-managed folders may cause macOS or the provider to supply folder metadata; Tend does not read file contents or transmit workspace data to its services.

Investigate a change filters existing Timeline comparisons by a symptom and an approximate 7-, 30-, or 90-day range. Optional feedback is stored locally: symptom, range and change identifiers, outcome, and a single-line note capped at 280 characters. Tend retains up to 200 entries, and Workflows provides a clear-feedback control. A support handoff report contains the selected symptom, date range, bounded Timeline evidence, suggested checks, and only the optional note you type into its preview. Tend shows the exact Markdown before you choose Save. The preview is held in memory for up to 15 minutes, is discarded when closed or saved, and is never sent to a service or added to feedback/history. Reports exclude private investigation feedback, system logs, file contents, and workspace file lists. Tend attempts to redact local paths, email addresses, IPv4 addresses, and labelled serial numbers; this is best-effort, so review every line before sharing. The report is saved only where you choose and is not retained separately by Tend.

2. AI Assistant (optional)

If you are at least 18, accept the current disclosure, add a key from a billing-enabled Google Cloud project, and use the Assistant, Tend sends a summary of your system status (disk/memory/battery figures, cache sizes, detected issue names, the latest Timeline change summaries when available, and your questions) to Google's Gemini API, authenticated with your own key. It does not send your file contents. Shared context builds a local preview without transmitting it; submitting sends a fresh snapshot plus at most 16 visible chat messages. Requests can be cancelled and are time-bounded. Your key stays local on your device and is encrypted with macOS Keychain-backed storage when available; we never receive it. Google's current terms require Paid Services for API clients offered in the EEA, UK, and Switzerland. Review the Gemini API Terms, logging policy, and Google Privacy Policy. If you never enter a key, nothing is sent. Gemini validation and assistant requests add fixed-label entries to the local Privacy Ledger.

Every response and export is labelled AI-generated - Google Gemini. Output may be inaccurate and requires human review. The assistant is limited to Mac maintenance and is not for medical, legal, financial, employment, credit, insurance, education-admission, law-enforcement, migration, or other high-impact decisions. Tend makes no solely automated decision with legal or similarly significant effects. See the AI Transparency Notice.

Optional Dictate starts only after you click it and requires Apple's on-device Speech recognizer, with no network fallback. A session lasts at most two minutes and produces at most 8,000 transcript characters. Audio is processed in memory, never written to a recording file, and never sent to Tend, Google, or another service. The transcript remains editable and is sent to Gemini only if you explicitly click Send.

3. Update checks (optional, only when requested)

Tend does not check for updates in the background. If you click Check for Updates, Tend makes a time-bounded request to the fixed GitHub Releases API for this project. It sends the installed Tend version in its User-Agent; GitHub also receives normal connection information such as your IP address. No system-health data, file names, local histories, or AI key are included. Tend shows the result and does not download or install anything automatically. Each manual request adds a fixed-label entry to the local Privacy Ledger.

On the Apps page, Check Update appears only for an app that locally declares a Sparkle feed. After confirmation, Tend re-reads the declaration from the installed app and makes one cancellable, time- and size-bounded request to a public HTTPS endpoint. HTTP feeds, credentials, local/private hosts, unsafe redirects, oversized responses, XML entities/DOCTYPE, unstable channels, and releases incompatible with the current macOS version are rejected. The provider receives normal connection information and a Tend-version User-Agent; no app inventory, health data, file contents, histories, or AI key are sent. Results stay in memory, Tend never downloads or installs the update, and the Privacy Ledger does not retain the app name, feed hostname, or URL.

The Privacy Ledger stores only fixed field-category names. It never stores prompts, responses, API keys, file paths, transmitted values, external URLs containing credentials, or arbitrary error text.

4. Free distribution

Tend is supplied free at launch with no checkout, paid licence, subscription, advertising, or payment provider. We collect no payment or order data. These notices will be updated before any paid tier, donation processor, affiliate tracking, or advertising is introduced.

5. Support

If you email us, we receive your email address and message, used only to help you.

6. Diagnostic report export (optional)

If you click Export report, Tend creates a local Markdown diagnostic report on your Mac. It summarizes quick system signals, skips deep file scans, redacts your home folder path to ~, and redacts the host name to <host>. The report is not sent anywhere unless you choose to share it.

Website hosting and external resources

This static website is hosted on Vercel. Serving a page involves connection information such as an IP address, requested URL and browser information being processed by the hosting provider for delivery and operation. This is separate from Tend’s local app analysis. See Vercel’s Privacy Notice. We have not added analytics, tracking pixels, advertising scripts, cookies or browser storage to this website.

Guide searches run in the page’s memory. The help-request template does not submit or save a report. Following links to Apple, LearnHubPlay or another provider opens a separate website with its own privacy practices.

Purposes, lawful bases, and recipients

Requested app functions and AI transmission rely on performance of the requested feature/contract. Sales and licence delivery rely on contract; tax records rely on legal obligations. Support and security correspondence rely on contract where applicable and otherwise our legitimate interests in answering you and securing Tend. Tend uses no marketing or non-essential analytics.

Website delivery uses Vercel as described above. App and support recipients are limited to 20i Ltd/Stackmail for business support email, Google when you explicitly use Gemini, GitHub for a manual Tend release check, and an installed app publisher for a confirmed Sparkle-feed check. We do not sell personal data.

What we never do

• We do not sell or share your data.
• No advertising or third-party trackers.
• We do not collect your files, browsing history, or keystrokes.

Your rights

Under the EU/UK GDPR, where applicable, you may request access, correction, erasure, restriction, portability, or object to legitimate-interest processing, and withdraw consent where consent applies. We normally respond within one month and explain any lawful extension or refusal. Contact admin@learnhubplay.nl. You may complain to the data protection authority where you live, work, or believe an infringement occurred.

About & Updates provides individual controls and a native-confirmed Delete All Tend Data action for all app-managed local records, schedules, preferences, and the saved AI key. Exported files and items already moved to Trash remain under your control.

Data retention

Local app data stays on your Mac. Tend keeps up to 300 health history entries, 180 Tend Timeline baselines, 300 Timeline annotations, 120 aggregate growth checkpoints, 500 automation run entries, 500 cleanup run entries, 480 workspace measurements (up to 60 each for eight chosen folders), 200 investigation feedback entries, and 200 Privacy Ledger entries. These records can be cleared using their in-app controls or Delete All Tend Data. Workspace records include the folder name/path you selected and policies; measurement history contains aggregate metadata only, never file names, file contents, or a file list. Investigation feedback may contain your optional note. Health history can include local Time Machine/FileVault evidence at scan time. Timeline contains the bounded metadata described above, never file contents. Cleanup and related automation entries can include reported moved bytes, point-in-time startup-disk free-space before/after values and their signed delta. Known cache cleanup entries can retain up to 24 per-source before/after measurements and the first observation after each 1, 7, and 30-day threshold; only Tend's built-in cache allow-list is sampled, and a newer cleanup supersedes pending checkpoints for the same root. Cleanup entries can also include original local source paths, actual Trash destination paths for tracked Undo items, and restore timestamps; those records are not uploaded or exposed to web content. Privacy Ledger entries contain only the fixed labels described above. Battery drain sessions stay in memory only and are discarded when Tend quits. Live network samples stay in memory only and are not persisted or uploaded. User-exported diagnostic, Timeline change, and investigation reports are saved only where you choose and are not retained separately by Tend.

The active Maintenance Plan is a single local record capped at eight steps and five verification attempts per step. Replacing or clearing it removes that plan record, while its separately bounded Health and Timeline checkpoints follow their own retention controls.

Support correspondence is normally deleted or anonymized within 12 months after closure unless a legal claim or duty requires longer. Tend holds no purchase or payment records for the free launch.

International transfers

Business support email is processed by 20i Ltd/Stackmail. 20i states that its primary datacentres are in the EEA and that any subprocessors are subject to its data-processing terms. Gemini Paid Services process prompts and responses under Google's processor terms, while Google acts as controller for account, billing, security, and usage metadata. Google may process data globally; its Cloud Data Processing Addendum provides European transfer mechanisms including adequacy decisions and Standard Contractual Clauses.

Children

Tend is not directed at children under 16 and we do not knowingly collect their data. Gemini integration is restricted to users aged 18 or older.

Contact

learnhubplay (KVK 97741825), trading as Tend
Tervurenpad 4, 1066 JV Amsterdam, Netherlands
VAT: NL005285187B56
admin@learnhubplay.nl