Tessera privacy

What signing in sends to the hub

Choosing Sign in and sync in Tessera → Settings → Account enables automatic sync to the owner’s Personal Hub, hosted on Hetzner. The same private account is used on the iPhone and at tessera.stierhout.com.

Sync includes completed trips and their precise GPS route points, location timestamps, available accuracy and speed values, journey times, journey type (walk or drive), categories, place labels, purpose, client, notes, capture warnings and confidence, distance corrections and their audit history. A device UUID and device name identify the signed-in iPhone. These records are linked to the owner’s account.

Journey types may be inferred using Motion & Fitness activity signals and can be corrected in the iPhone app. The saved walking or driving classification is included in sync as part of the journey. Tessera does not collect step counts or workouts.

Offline changes stay queued on the iPhone. Tessera uploads after driving checks have settled, while the app is open and during background opportunities permitted by iOS. Low Power Mode, connectivity and iOS scheduling can defer uploads. There is no promised background-sync deadline, and the hub cannot make an unrecorded drive appear.

How the hub uses the records

The hub provides private walking and driving history, drive-only mileage summaries and optional car-road matching for drives. It runs OSRM against its own OpenStreetMap road dataset. Road matching is a separate estimate: it does not replace the captured points or your selected claim distance.

The browser uses locally hosted map software and the hub’s private road tiles. User routes are not sent to a public map or routing API. OpenStreetMap supplies road data, rather than receiving the owner’s trip records.

Tessera has no advertisements, advertising tracking, cross-company tracking or third-party behavioural analytics. It is not a real-time people-monitoring service. Tessera requires no subscription or paid mapping service.

Account and connection security

The private hub uses HTTPS with TLS. The server stores a salted password hash rather than the account password. After iPhone sign-in, the app keeps a device token in the iOS Keychain; the server stores a hash of that token. Browser sign-in uses a secure, HttpOnly session cookie and protects account actions against cross-site requests.

The owner administers the hub and can access its stored records. Transport security does not make these records unreadable to the owner’s server. Keep the account credentials, the iPhone and administrator access private.

Retention, sign-out and deletion

The hub retains original trip evidence, audit revisions and deletion tombstones. A trip deletion that syncs removes it from the current journey list while keeping those historical records. Deleting local app history does not permanently purge the server’s original evidence or audit history.

Sign out of this iPhone stops future uploads from that device. It does not delete trips already uploaded to the hub. Browser sign-out ends that browser session; it does not sign out a separately connected iPhone.

Permanently removing server history, including original records, audits, deletion tombstones and any server backups, requires an explicit purge by the owner acting as the hub administrator. Normal trip deletion, device revocation and sign-out do not perform that purge.

Your controls

• Use Tessera locally without signing in to the hub.
• Use Settings → Account on the iPhone to see sync status, request Sync now or sign out of that iPhone.
• Use Account in the browser to see signed-in devices and revoke a device’s access. Its existing synced trips are retained.
• Keep using the iPhone’s local JSON backup and CSV export. Exported files remain wherever you save or share them; the hub does not control those copies.
• Use the owner’s administrator access for an explicit server-data purge when permanent removal is required.

App privacy disclosure

For the optional signed-in service, Tessera declares Precise Location, Other User Content, User ID, Device ID and Fitness as linked to the user for app functionality. Fitness refers to the saved Motion & Fitness journey classification. These data are not used for Apple’s advertising or cross-company tracking category. Mileage recording itself still uses location, subject to the iPhone permissions you grant.