tend
Local-first

Your contact graph never leaves your devices.

Message content stays on the Mac. A thin relationship layer — names, cadence, timing — flows through your own iCloud to your iPhone. Tend doesn't operate a server that sees your data.

What stays on your Mac

Message bodies
Tend reads chat.db locally with Full Disk Access and never copies the text anywhere else.
Contacts
Names, numbers, and emails are read from Contacts.app on the Mac. No contact upload; the iPhone gets display names only.
Attachments
Photos, links, and files inside iMessage are never opened by Tend.
The scan index
The per-thread cadence index is written to the Mac's Core Data store — never uploaded.

What syncs through CloudKit

The iPhone needs a thin slice: who the contact is, when you last exchanged messages, and a few derived signals (cadence, balance, timing). That's what flows through your own iCloud to your own iPhone. Tend has no account, no central database, no way to read it.

Display name
First name + last initial. Never the handle, number, or email.
Last-talked timestamps
A handful of dates per contact. Not the messages.
Tier signal
Close / connected / cooling off / missing you / lost touch — a small enum, not a score.
Your preferences
Whether a contact is muted, pinned, or set to "not this one."

What Tend can't see

I don't run a server that stores your graph. There's no admin console with your contacts in it. If Apple subpoenas Tend for your data, I have nothing to hand over. If you turn off iCloud, Tend stops syncing and the Mac keeps working.

The analytics, narrowly

I use PostHog for funnel shape — installs, permissions granted, first card tapped. Free-text is never sent. The proxy is allowlist-enforcing: only the event names I ship make it through. Analytics is opt-in at signup and a single toggle in the app.

Apply for the beta Read the privacy doc →