Privacy notice for the Tandlo beta. Updated 19 September 2026.
Tandlo is operated by Darren Jones. For privacy questions, a copy of your information, corrections or a complaint, email darrenjones@me.com. This notice covers the Tandlo beta app, website, early-access list and invitation reply pages.
Tandlo is for adults managing family life. Children do not create accounts. Only add children and family information you are entitled to manage. A nickname and school year are usually enough; a child’s photo is optional.
When you sign in, Microsoft Entra External ID handles your email address, verification and sign-in activity. Tandlo receives an account identifier and display name; you can choose the name shown in the app. We do not receive your email verification code.
You can add children’s names, school and year groups, an optional colour or photo, family memberships, events, tasks, homework, venues, notes and calendar feeds. Your saved plans may include the original text or details you chose to import. Calendar feed links can contain access keys, so we treat them as private.
Photos, PDFs and text shared into Tandlo initially stay in the receiving device’s private intake. Reading sends the selected content for processing. Photos are resized first; PDFs are processed to extract text. A shared original kept on that device is not automatically copied to every family member’s device.
Forwarding is optional. Mailgun’s EU receiving service receives email sent to your private Tandlo address and passes it to our API. We keep the message, sender details, delivery checks and supported PDF attachments so you can review them. Unconfirmed senders wait for your approval. Your forwarded mailbox is private to your account.
We do not silently read WhatsApp groups or your whole email inbox. You choose what to share, forward or connect. An ICS connection retrieves the calendar behind the link you provide. Device-calendar permissions are requested separately when needed. Public school websites and newsletters are monitored as shared school information, rather than fetched separately for every parent.
To understand a request or read a selected email, image or document, Tandlo sends the relevant text or image and planning context to Microsoft Azure AI. This may include parent and child names, school years, dates, places and the content you selected. Image generation sends the invitation theme when you choose that feature. Venue lookup sends your search to Azure Maps.
AI can get details wrong. Check the proposed child, date, place and task before saving. The app does not use your family content to train its own AI model. Microsoft describes its model data handling here; service safety and operational processing may also apply. Do not include information the task does not need.
Approved family members see shared children, schools and family membership details. Personal plans, tasks, calendar feeds, forwarded messages and invitation replies are scoped to their adult account in this beta. Some information stays only on a device until you bring it across or sync it.
If you create an invitation reply link, anyone holding that link can see the event details you choose to publish. The organiser can see guests’ names, attendance and optional notes, including dietary information. Do not include sensitive details in a public invitation. You can stop replies and revoke the link. Sharing or exporting outside Tandlo creates copies we cannot retrieve.
We use account and family information to provide the service you ask for, keep access private, remember your plans and respond to support requests. Our legal bases are performance of the service agreement and legitimate interests in operating, securing and improving the beta. Optional permissions and early-access email sign-up are choices you can withdraw. We do not sell family information or use it for advertising.
The early-access form stores your email so we can tell you when a place is available. It does not create an app account. Ask us to remove it whenever you wish. Optional guest dietary notes can reveal health or other sensitive information: provide them only if needed and with the person’s permission; the organiser is responsible for how they use those notes.
Microsoft Azure hosts the development API and database in UK South. Mailgun receives forwarded email in its EU region. Sign-in, static hosting, service operations and your device’s platform services may involve processing in other countries. We do not promise that every service processes data only in the UK. Microsoft and Mailgun’s contractual safeguards apply where their services transfer information internationally.
Authorised operators may access information to resolve problems or fulfil privacy requests. Access is restricted, network traffic is encrypted and the database uses account and family access rules. Apple and Google may separately process app distribution, device services and feedback under their own privacy notices. The website loads fonts from Google Fonts, which receives normal connection information such as an IP address.
Saved account and family records remain until removed. Onboarding drafts expire after seven days without an edit. Forwarded messages are set to expire after 30 days if accepted and seven days if held; attached PDFs follow the message. Expired content is hidden, with physical removal performed by cleanup when the service runs. This beta does not yet guarantee an immediate scheduled purge at the exact expiry time.
Development database backups have a seven-day retention setting. Operational logs use a 30-day retention setting and should not contain message bodies, subjects or verification codes. Service providers may retain their own security and delivery records. Restoring a backup requires us to reapply deletion requests before opening access.
In Tandlo, open Connect, your account, then Delete my account. The option is also available during family setup. The confirmation explains what will be removed before you commit.
Deletion removes your private server records, forwarded messages and attachments, and closes your forwarding address and reply links. Families you created are removed too, including their children, school links and all members’ plans in those families. If you joined someone else’s family, your membership and private records are removed while their shared children and school information remain. Other adults’ accounts and public school information remain.
Your Microsoft sign-in identity is then removed by the operator within 30 days. A receipt in the app confirms when that step is complete; you do not need to call or email to initiate deletion. A minimal deletion record, with a one-way account identifier rather than family content, prevents old sign-in sessions from recreating the account. Device copies are cleared where the app can access them. Copies on other devices, exported calendars or recipients’ apps cannot be erased remotely.
You can correct family details, disconnect a source, delete individual items and request account deletion. Depending on your location, you can also request access, a portable copy, restriction of use or object to processing. Contact us using the address above; we may need to verify that the request is yours before disclosing information.
You can complain to your local data protection authority. In the UK, this is the Information Commissioner’s Office. We will update this notice as the beta changes and highlight material changes in the app or through an appropriate account contact.