Privacy Policy

Short version

Tesseract is designed so we can't read your messages, media, or contacts, and so we have as little to hand over to anyone as physically possible. No accounts. No phone numbers. No analytics. No third-party trackers. Message and media contents are end-to-end encrypted and stored on the server only long enough to reach the recipient. The entire codebase is public at github.com/keniprimo/SecretR00M if you want to verify any claim here against the actual code.

What runs where

Tesseract has two components: the iOS app on your phone, and a relay server that shuttles encrypted frames between devices. The relay is a single small Go binary running on a Lightsail VPS.

What the app stores locally on your device

• Your identity keypairs (Ed25519 signing + X25519 encryption), in the iOS Keychain, device-lock protected.
• Your friends list: their public keys and the emojis you picked for each other.
• Your message history for each friend, on disk with iOS completeFileProtection (unreadable while the phone is locked) and excluded from iCloud/iTunes backup.
• Pending friend requests (in-inbox), the current notification-disguise template, and app preferences.

Nothing on this list leaves the device unless you explicitly cause it to (by sending a message, adding a friend, etc.).

What the server stores

• Your public keys. Ed25519 and X25519. Needed to route incoming frames to you.
• Your APNs device token. Needed to wake your phone when a frame arrives. This is a token issued by Apple; the server does not know your Apple ID or phone number.
• Encrypted frames for offline recipients. When your friend is offline, their message is held in a mailbox as ciphertext (we cannot decrypt it). Deleted the moment their phone receives it. Hard TTL of 7 days (free) or 30 days (Plus) for anything that never gets picked up.
• Encrypted media blobs (photos / videos / GIFs). Stored as ciphertext only. Deleted on the first successful download. Hard TTL of 24 hours.
• Short-lived, single-use invite codes. Deleted on redemption or after 24 hours.

What the server does not store

• Message plaintext. We can't read it — we don't have the keys.
• Media plaintext. Same.
• Your contact list, address book, or which friends you have.
• Delivery history, read receipts, message metadata beyond routing.
• Analytics, telemetry, crash reports tied to your identity, ad IDs.
• Persistent IP address logs. HTTP request logs are ephemeral and rotate.

Push notifications

When mail arrives while your phone is offline, the server asks Apple Push Notification Service (APNs) to wake your phone. The push payload contains a generic message ("New message" or "New friend request") and no message content. If you enabled Notification Disguise, an on-device extension rewrites the visible text using the template you picked before iOS displays it — the server never sees the disguised text.

Subscriptions

Tesseract Plus is an auto-renewable subscription sold through Apple's App Store. Payment is processed by Apple; we never see your card, bank details, or Apple ID. Apple gives us only an anonymized entitlement receipt. Cancel any time from your Apple ID settings.

Third parties we rely on

• Apple — App Store distribution, APNs push delivery, StoreKit for subscription processing. Governed by Apple's own privacy policy.
• AWS Lightsail — hosts the relay server. AWS sees encrypted traffic to the server's public IP and standard cloud metadata.
• Cloudflare — used only for this website (tesseract's docs pages via GitHub Pages). Not involved in message delivery.

No third-party analytics, no ad networks, no marketing SDKs, no fingerprinting libraries.

Legal requests

The most we could disclose if compelled by a valid legal order is: your public keys, the device tokens we have on file for you, and any ciphertext currently sitting in your offline mailbox (which we can't read). We cannot produce message plaintext, media plaintext, or historical delivery records, because we don't have them.

Children

Tesseract is not directed at children under 13. If we learn a child under 13 has created a profile, we will delete the associated public keys and device token from the server on request.

Changes to this policy

Material changes will bump the "Last updated" date at the top of this page. For a full history of edits, see the commit log on GitHub.

Contact

For privacy questions or requests, see Contact. For security disclosures, prefer the GitHub security advisories flow.