Privacy Policy

Your privacy is the foundation of Tessera. This policy describes what we collect, how we use it, who we share it with (almost nobody), and the choices you have. Plain language, no legalese where we can avoid it.

What we collect

• Account info: your first name and email (only if you provide them during onboarding), plus your anonymous Apple ID via Sign in with Apple.
• Self-reported health data: symptoms, cycle entries, meals, supplements, mood, voice notes — only what you log.
• Photos: plate scan and face scan images. Plate photos are sent transiently to our AI provider. Face scan photos are encrypted on-device and never leave the device unless you choose to.
• Face data: when you use the Face Scan feature, your face photo is processed by our AI provider (Anthropic) to analyze skin condition (acne, redness, oiliness, jawline markers). Face data is sensitive biometric information. It is encrypted at rest on your device with a per-user key stored in the iOS Keychain. It is sent transiently to Anthropic for scoring and deleted from their systems within 30 days. It is never used for AI training, never shared with third parties other than Anthropic for scoring, and never used for facial recognition, identity verification, or biometric identification. You can delete all face scan data at any time in Settings → Privacy & Data → Delete Account.
• Apple Health data: only the categories you explicitly grant access to (menstrual flow, sleep, HRV, weight, BBT, mindful minutes).
• Device identifiers: an anonymous identifier for subscription management and (only with your consent) anonymized product analytics.
• AI-processed data: when you use AI features (plate scan, face scan, Maya coach, voice journal), the relevant data (photos, chat messages, logged meals/symptoms, audio) is sent to our AI providers as described in the "AI Data Sharing" section below.

What we do with photos

When you take a photo for a plate scan, we send the image to our AI provider (Anthropic, PBC) for analysis. We do not store the image on our servers. The image data leaves Anthropic's servers within 30 days per their enterprise retention policy and is never used to train AI models.

Face scan photos are encrypted with a per-user key stored in your iOS Keychain and only leave your device transiently for AI scoring. The local files remain encrypted at rest and are wiped when you delete your account.

Face data is used only for skin condition analysis — never for facial recognition, identity verification, or biometric identification.

AI Data Sharing

Tessera uses third-party AI services to power certain features. Before any data is sent, the app discloses what data will be shared and asks for your consent during onboarding. You can revoke consent anytime in Settings → Privacy & Data.

What data is sent:

• Plate Scan: your meal photo → Anthropic for food identification and nutrition analysis.
• Face Scan: your face photo → Anthropic for skin condition scoring.
• Maya (AI Coach): your chat messages and relevant logged data (meals, symptoms, cycle entries) → Anthropic for generating coaching responses.
• Voice Journal: your audio recording → OpenAI (Whisper) for transcription.

Who it's sent to:

• Anthropic, PBC — AI inference for plate scan, face scan, and coach features. No training. No retention beyond 30 days.
• OpenAI, Inc. — voice transcription (Whisper) only. Audio is not retained or used for training under our enterprise terms.

Your consent: The app asks for your explicit permission before sending any personal data to these AI services. You can decline and still use the app's manual logging features. You can change your choice anytime in Settings → Privacy & Data.

Retention: Data sent to AI providers is processed in-memory and deleted within 30 days per our enterprise agreements. It is never used to train AI models.

Who we share data with

• Anthropic, PBC — transient AI inference for plate scan, face scan, and coach features. No training. No retention beyond 30 days. Data is sent only after you consent in-app.
• OpenAI, Inc. — voice transcription (Whisper) only. Audio is not retained or used for training under our enterprise terms. Data is sent only after you consent in-app.
• Apple, Inc. — app distribution, payments, and Sign in with Apple.
• RevenueCat, Inc. (when enabled) — subscription state only, keyed to your anonymous user ID.
• Product analytics provider (only if you opt in) — anonymized event data, never your health logs or photos.

What we never do

• We never sell your data to advertisers, data brokers, employers, or insurers.
• We never share your data with law enforcement without a valid legal demand.
• We never use your photos, voice notes, or symptoms to train AI models.
• We never track you across other apps without your explicit ATT consent.

Reproductive health data — special protection

Given recent legal changes affecting reproductive healthcare in the United States, we take additional steps with cycle, fertility, and reproductive data:

• This data is never shared with third parties under any circumstance.
• It is stored encrypted at rest on your device.
• We will resist any legal demand for this data to the maximum extent permitted by law and notify you of any such demand to the extent legally permitted.
• You can delete every reproductive data point with one tap from Settings → Privacy & Data → Delete Account.

Your rights (GDPR + CCPA + state laws)

• Access: export your data anytime as JSON from Settings → Privacy & Data → Export My Data.
• Delete: one-tap account deletion in Settings purges everything from your device and from our subscription provider.
• Correct: edit any log directly in the app at any time.
• Portability: the JSON export is yours to take anywhere.
• Object: cancel your subscription and delete your data anytime, no questions asked.
• Opt out of analytics: Settings → Privacy & Data → Analytics toggle.

Children

Tessera is not intended for users under 13. Users aged 13–17 should use Tessera only with parental consent.

Changes to this policy

We'll notify you of material changes via in-app banner and email at least 14 days before they take effect. The effective date at the top of this page will always reflect the current version.

Contact

Questions, requests, or concerns? Email hello@tesserapmos.com.