With aap you are always on the safe (polite) side.
But close friends and others younger than you might expect to be called tum. Still, never use tum for anyone older or senior to you!
Sometimes this insecurity in addressing people comes from Panjabi habits where there is no 3-layer aap-tum-tuu, but 2-layer tusin-tuu being used. And it is easy to confuse the usage of tum and tusin.