# Tessera privacy policy

_Last updated: August 18, 2026_

Tessera is an SSH, Mosh, and tmux terminal for iPhone and iPad. This policy
explains what data Tessera handles. The short version: **Tessera does not
collect any personal data.**

## No data collection

Tessera has no backend servers, no analytics, no tracking, no advertising, and
no third-party data-collection SDKs. The developers do not receive any
information about you or your use of the app.

## Data stored on your device

Everything you enter or create stays on your device (and in your own device or
iCloud backups, if you have those enabled):

- Host connection details (addresses, ports, usernames) you enter.
- SSH keys you generate or import. Keys are stored in the iOS Keychain. Secure
  Enclave–backed keys never leave the device.
- Known-host fingerprints, app preferences, and per-host settings.

This data is never transmitted to the developers. SSH and Mosh connections go
**directly** from your device to the servers you specify — there is no Tessera
infrastructure in between, because none exists.

## Network connections

Tessera connects only to the servers you configure, and connects to them
directly. Your credentials, keystrokes, and session data are not routed through
any Tessera-operated service.

The cross-device features work the same way. **Nearby setup** transfers your
configuration directly between your own devices over your local network,
end-to-end encrypted after an on-screen code comparison; passwords and
private keys are never transferred, and no cloud or relay is involved.
**Handoff** shares a pointer to a session through Apple's Handoff mechanism —
never credentials. The optional **agent status hook** reports only status
metadata (provider, lifecycle event, state, reason, session/turn identifiers,
notification type, permission mode, timestamp, and local process ID) from your
own server to your device — never prompts, responses, source code, or
credentials.

## Permissions Tessera may request

- **Local Network** — to reach SSH/Mosh servers on your local network, to
  forward local ports to them, and to find your other device during nearby
  setup.
- **Face ID / biometrics** — to unlock biometric-protected SSH keys and the
  app lock. Evaluated on-device by iOS; Tessera never sees your biometric data.
- **Microphone & Speech Recognition** (optional) — used only if you enable
  on-device dictation into the terminal. Speech is processed on-device; audio
  is not sent to the developers or any third party.
- **Notifications** (optional) — local notifications for the terminal bell /
  turn-complete signal, generated on-device.

## Purchases

Tessera's optional one-time purchase is processed entirely by Apple through
the App Store. Tessera receives only the resulting entitlement from Apple's
StoreKit — no payment details, and no account is created. See
[free & unlimited hosts](https://bambouville.com/docs/unlimited-hosts/).

## Diagnostic logs

Tessera can write a local diagnostic log (Settings → Diagnostics) to help with
troubleshooting. This log is redacted (credentials, addresses, and endpoints
are stripped) and stored on your device. It leaves your device only through
an action you take yourself: exporting it through the system share sheet,
uploading it to one of your own servers, or choosing **send to developer** —
which composes an email to dev@bambouville.com in your mail app, with the
log attached, that is sent only if you review it and tap send. Tessera never
uploads the log automatically, and the developers receive it only if you
choose to email it.

## Data retention & deletion

All data Tessera handles lives only on your device, so retention and deletion
are entirely under your control:

- Hosts, identities, preferences, known-host fingerprints, and the diagnostic
  log persist on-device until you delete them in the app (or delete the app).
- **SSH keys are stored in the iOS Keychain.** iOS may retain Keychain items
  even after an app is uninstalled, and (for non–Secure-Enclave keys) they can
  be carried into encrypted device backups. To remove keys completely, delete
  them in the app (Keys page) **before** uninstalling Tessera.
- No deletion request to the developers is possible or necessary: the
  developers hold no data about you.

## Children's privacy

Tessera does not collect data from anyone, including children.

## Changes to this policy

If this policy changes, the updated version will be posted at this page.

## Contact

Questions about this policy? Open an issue at
<https://github.com/bambouville/tessera/issues>.