# Security & app lock

## App lock

Under **settings → security**, **require device owner authentication to
unlock** gates the whole app behind Face ID (with device-passcode fallback).
You choose when it engages:

- on launch, when enabled at all,
- **lock when backgrounded** — turning this on also enables the
  owner-authentication requirement, so the setting can't be half-configured,
- **auto-lock after idle** — never, 1, 5, or 15 minutes, or 1 hour.

While locked, Tessera also stops broadcasting
[handoff](https://bambouville.com/docs/continuity/) sessions, and an incoming continuation waits for
Face ID.

The lock screen shows "— locked —"; tap to unlock with Face ID or the device
passcode.

Locking is not cosmetic: it revokes every cached key-use authorization and
cancels in-flight SSH handshakes. Even with app lock off, backgrounding the
app always invalidates the 30-second
[key authorization bursts](https://bambouville.com/docs/keys/#authorization-bursts).

## Keys

Private keys live in the iOS Keychain; P-256 Enclave keys never leave the
Secure Enclave and can require biometrics per use. See [keys](https://bambouville.com/docs/keys/), and
for the full detail the public
[private-key security audit](https://github.com/bambouville/tessera/blob/main/docs/private-key-security-audit.md).

## Host keys

Every server is pinned on first contact and re-verified on every connection;
changed keys raise a loud warning. See [host key verification](https://bambouville.com/docs/host-keys/).

## Privacy

Tessera has no backend, no account, no analytics — connections go directly
from your device to your machines. Cross-device features are just as direct:
[nearby setup](https://bambouville.com/docs/nearby-setup/) is device-to-device on your LAN, and
[continuity](https://bambouville.com/docs/continuity/) never moves credentials. The
[privacy policy](https://bambouville.com/docs/privacy/) has the details.

## Diagnostics

**settings → diagnostics** can write a local log (`tessera-diagnostics.log`,
capped at 20 MB, redacted) to help with troubleshooting, with **verbose
diagnostics** and **scroll diagnostics** toggles for deeper captures.

- **send to developer** — opens a pre-addressed mail (dev@bambouville.com)
  with the log attached. Nothing goes anywhere until you review the message
  and tap send; without a mail account on the device, Tessera points you to
  export instead.
- **export log** — sends it through the iOS share sheet, to a destination you
  choose.
- **upload log** — sends it to one of your own servers through the
  Upload-to-host sheet.
- **refresh** / **clear**.

The log never leaves the device automatically — every path above is you,
explicitly, choosing to send it. Bug reports go to
[GitHub Issues](https://github.com/bambouville/tessera/issues).