Tessera privacy notice and tester terms (draft)

Tessera never records your screen, window titles, page titles, page text, or what you type. It never asks for Screen Recording.

For each session: the sentence you write, which app was in front and when, the website host in the browser in front (for example github.com, never the full address or the page), when you were away, the sites you chose to block, how long the session ran, and the mark you stored (Shipped, Made progress, or Stalled; until that ships, Yes or No). Your lists, your daily streak, and your rest shields also stay on your Mac. Nobody else can see this unless one of the cases below applies.

1. Your account. Tessera creates an anonymous account so circles and the AI limit work. If you sign in with Google, we also keep your Google email address, and the app sends Google's access token to our server once, only to link the two. If you sign in with Apple, we also keep the email address Apple shares (a private relay address if you hide yours), and the app sends Apple's access token to our server once, only to link the two. From version 0.1.0 your account, and everything below that we store for it, is on Amazon Web Services in us-east-1: a sign-in account (Amazon Cognito) and a database table (Amazon DynamoDB). We do not use another database provider.
2. Circles, only if you join one. The people in that circle see your display name and, for each session, whether you are in a session, your sentence, how long it ran, and your answer. They never see apps, sites, away time, or blocked attempts. Each request the app makes for your circles carries your account's access token, so our server knows it is you, and so does the live update connection. Those requests send only what the action needs: the circle's name and goal, your display name, the join code, your share setting, your status, an ended session's times and answer, a cheer, or a sprint's goal, minutes and invited people. This is stored in our database on Amazon Web Services in us-east-1.
3. AI features, only if you turn them on. These are the coach, chat with Tessie, and the judge. When you turn one on, the session’s sentence, app names, site hosts, times, and your answer go to our server on Amazon Web Services. From there they go to the model that answers (Amazon Bedrock) and to TypeSafe’s Jev, which classifies sites and screens coach replies. Chat also sends what you type and up to 14 recent sessions (sentence, answer, minutes, start time). Our server passes this on and does not store it. From version 0.1.1 our server stores a count of AI calls per day for that anonymous account (no content), deleted with the account. Amazon’s documentation says Bedrock does not keep requests to the model we use, and that model providers never see them. TypeSafe says it does not train on what we send, keeps data as long as it needs to provide its service, and hosts it in the United States. Each person has a daily limit on AI use; from version 0.1.1 each AI call carries the anonymous account’s access token from Amazon Web Services (us-east-1), so our server can count it.
4. Weekly counts, only if you say yes. Tessera asks once when you first open it, and the switch stays off until you turn it on. Once a week the app then sends us how many sessions you ended with a sentence, how many you answered yes and not yet, and how many “not yet” sentences you came back to within 7 days. It also sends the app version and the start date of the week. It sends no sentences, apps, sites, or times. You can turn this off in the app at any time.
5. Feedback you send us. If you email us, we keep the email. If you use the Feedback form in the app, what you write, the images or videos you choose to attach, the app version and the macOS version go to our server on Amazon Web Services in us-east-1, with your account's id, and we get an email with your text, the file names, types and sizes, the app and macOS versions, and your account's id, through Amazon's notification service. Tessera never takes a screenshot or a recording for this: it sends only files you pick, and an image or video can show whatever was on your screen when you made it, so check it before you send. A build of Tessera without our cloud settings opens a message in your own mail app instead, with your words and the files you attach; you send it from there, and Tessera sends nothing itself.
6. The habit layer, once it ships. A friend streak sends the pair and whether today counted or a shield was spent, not the session. A circle quest sends that a qualifying session happened, not what was in it. The daily line stays on this Mac. It may name a host or an app on the screen, and that name is not saved and not sent. If you have turned weekly counts on, we also receive one daily bucket: new, current, back after a week, back after a month, at risk, or dormant. That bucket has no sentence, no app, and no site. Circle members also see the shape of the session: focused, neutral, distraction, and away, each as wide as it lasted, with no app name, no site name, and no clock time. They already see your sentence, your mark, how long it ran, and the week.
7. A page for a friend who is not on a Mac, once it ships. That page can show a card and a streak count. It cannot show your sentence, an app name, or a site.

The site is hosted on Amazon Web Services. It sets no cookies and runs no analytics. The app downloads come from GitHub, under GitHub’s own privacy policy.

The front page counts how long you spend on each part of it, and how long its tab was hidden, to show you. That count stays in your browser. It is not stored, and it is not sent to us or to anyone else.

You can save a seat for someone by typing a first name. That name stays in your browser unless you send it: if you send them the link, the name is in that link, and if you answer our questions, it goes with your answers.

The front page lets you ask for an invite. When you do, your email goes to our database on Amazon Web Services, in us-east-1, with the link that sent you, if any. Any answers you give, the places you tapped and the first names you saved go with it. We get an email with the same details through Amazon's notification service, so we can write back. We use all of this to write to you about your invite and to set you up, and for nothing else. We delete it a year after you asked, or sooner if you ask us. To limit abuse, our server counts requests per hour against a scrambled form of your network address that changes every hour and is deleted within two days. It does not keep the address itself.

Circle data, weekly counts, the daily AI counts and your account stay until you delete them or leave. AI requests are not stored by us after the answer comes back. Feedback sent from the app, and the files attached to it, are deleted 30 days after you send it. The email copy we receive stays in our inbox until we delete it; ask us and we will.

• Delete my data in the app deletes your record on this Mac and, on Amazon Web Services, your account, circle data, weekly counts and AI counts, and the feedback you sent from the app (attached files still go 30 days after you sent them). It deletes the Amazon Cognito account itself too.
• The AI features and the weekly counts stay off until you turn them on, and you can turn them off at any time. You can leave any circle.
• Under the Philippine Data Privacy Act of 2012 you can ask what we hold about you, ask us to correct it, or ask us to delete it. Email tesserafocus@gmail.com.

If Tessera starts sending anything new, this notice changes first and the app tells you.