隐私政策

1. Introduction #

This Privacy Policy explains how Eightcell Labs, Inc. ("Eightcell Labs", "we", "us") collects, uses, stores, shares, and protects information in connection with the Tesseract application and related services (the "Service"), and the choices and rights you have. It forms part of, and should be read together with, our Terms of Service.

Eightcell Labs is the data controller for the personal data we process to provide the Service. A guiding principle of Tesseract is that much of your data stays on your device by default; this Policy is explicit about what stays local and what is sent to our servers or to third parties.

2. Information We Collect #

We collect the following categories of information. For each, we indicate whether it stays LOCAL on your device or is sent to our servers or third parties (CLOUD).

• Account information (CLOUD): your name, email address, account type (individual or organization), organization name, and plan. Used to create and manage your Account.
• Age (CLOUD, only when one of our apps asks for it): if you give the month and year you were born in one of our apps, or your app store tells the app your age range, we keep that month, the age group it puts you in (13 to 17, or adult) and where it came from, with your account — the same account in every Tesseract app. We use it to keep teenagers’ accounts safe: someone we know is under 18 gets no personalised ads. An age under 13 is never kept. Tesseract itself does not ask your age.
• Usage data (CLOUD): we may collect pseudonymous, content-free data about how the apps are used, only in order to improve our services, and nothing more. It comes from every Tesseract app — desktop, web, phone, the standalone Atrium, Remote Desktop and Private Network (Mesh) apps, the browser extension and the command line — and covers when you install, open, update and close the apps, how often and for how long you use them, which screens and features you open, the AI models, frameworks and tools you use, token counts and costs, error and crash indicators, the app version, your operating system, device model and screen size, your language and time zone, and your approximate country (derived from your IP address, which is not stored with this data), associated with a pseudonymous device identifier and, when you are signed in, your account. In the web app (app.tesseract.dev) it also covers the sign-in pages before you sign in (as an anonymous device), how a sign-in went (its method and, when it did not complete, the reason code — never what you typed), and where the visit came from (the referring website’s address, the link’s campaign parameters, and the source and website our website remembered); events not yet delivered wait in your browser’s storage until they are. It never includes voice recordings or transcripts of what you say, the text of your messages or files, the pages you visit, or the names of your files, channels, contacts, devices or networks.
• Language on first start (LOCAL): the first time the app starts on a device — the desktop app, or the web app in a browser — it asks our server which country your network is in (worked out from your IP address, which is not kept). When your device’s language is only English and you have chosen none, the app is then shown in that country’s language. Only that language choice is kept on your device, with which of the accounts signed in there were already set up; a new account that finishes setting up in it keeps it as its language setting, stored with your settings (see "Settings, session, and workspace data"). You can change it in Settings at any time.
• Crash and error diagnostics (CLOUD, on by default — you can turn this off in Settings, separately from usage data): when the app fails, a diagnostic report describing the failure. This includes the error type and message, the stack trace, a short excerpt of the application log leading up to it, and the app version, operating system and device type, associated with the same pseudonymous device identifier. Before anything is written to disk or transmitted, the report is automatically scrubbed: credentials and access tokens are removed, and file paths containing your account name are rewritten. Unlike usage data, a stack trace is not content-free by construction — it can name files you had open and may include text from a log line — which is why it has its own control you can switch off without also disabling usage analytics. Reports are retained for up to 90 days.
• Conversation content (CLOUD, only if you enable cloud sync): the text of your assistant conversations (main-thread user and assistant messages — not tool calls, reasoning, or file diffs) and per-project statistics. Used to sync across your devices and to generate summaries and aggregate statistics.
• Content you send to AI Model Providers (CLOUD / third party, inherent to using the assistant): to answer you, the Service sends your prompts and the content the agent works with to the AI Model Provider you or we have selected (see "AI Model Processing"). In computer-control mode this includes screenshots of your screen; in voice mode this includes your audio.
• Settings, session, and workspace data (CLOUD, when signed in): your application settings, certain provider credentials, your list of recently opened projects, your last open view, and per-project workspace layout.
• Password vault (CLOUD): if you use the built-in password manager, your vault syncs across your devices as ciphertext. If you set a master password, it is end-to-end encrypted and we cannot read it. If you do not set one, your vault key is also kept on our servers, so that a new device of yours can unlock itself without you typing anything — which means we are technically able to decrypt that vault. The app always shows you which of the two you are on, and you can set a master password at any time (see "Storage, Security & Encryption").
• Saved logins and integrated-browser cookies (LOCAL only): passwords you save for autofill and cookies in the built-in browser are stored on your device and are not uploaded to us.
• App-habit and clipboard/paste history (LOCAL only): if enabled, these are stored on your device and are never synced, uploaded, or logged off your device.
• Device identifiers (CLOUD/LOCAL): a pseudonymous analytics identifier (sent only with usage data), a stable device identifier and public device key registered to your account so your devices can connect, and diagnostic logs (LOCAL only).
• Payment information: handled by our third-party payment processor; we receive billing metadata (such as plan and status) but do not store your full card details.

3. How We Use Information #

We use the information above to:

• provide, operate, maintain, and secure the Service, including syncing your data across your devices where you enable it;
• generate responses and, where you enable cloud features, summaries of your conversations and aggregate or statistical insights;
• develop, improve, and evaluate the Service and its features;
• detect, prevent, and respond to fraud, abuse, security incidents, and technical problems;
• process payments and manage subscriptions;
• communicate with you about the Service, including service and administrative messages. We send product tips by email, with an unsubscribe link in every one: a few to a new Account, each once, and which tip you get depends only on whether the app has already answered you. You can opt out of these and any other optional promotional messages at any time (for example, via the unsubscribe link) while still receiving essential service messages; and
• comply with legal obligations and enforce our Terms.

4. Legal Bases (EEA / UK) #

Where the EU or UK GDPR applies, we process personal data on these bases: (a) performance of our contract with you, to provide and sync the Service; (b) our legitimate interests in securing, analyzing, and improving the Service, balanced against your rights; (c) your consent, where we rely on it (which you may withdraw at any time); and (d) compliance with a legal obligation.

For the processing of the content of your conversations for analytics, summarization, and product improvement, and for routing your Content to AI Model Providers located outside the EEA/UK, we rely on your consent — which you give by accepting these documents and enabling the relevant cloud features, and which you may withdraw at any time as described in "Your Rights and Choices".

For product tips by email, we rely on our legitimate interest in helping you get started with the Service you signed up for. You may object at any time with the unsubscribe link in each email; we then send you no more of them.

For sending conversation content and device information to our advertising partner to choose and measure sponsored messages (see "Sponsored Messages on the Free Allowance"), we rely on our legitimate interest in funding the free use of Tesseract, and on our contract with you for that free use. In the EEA, the UK and Switzerland those ads are chosen from the conversation alone, and no identifier for you is sent. You may object to this processing by contacting support@tesseract.dev; with a paid plan or a balance none of it takes place.

5. AI Model Processing #

To generate responses and summaries, the Service sends your Content to third-party AI Model Providers. Tesseract is model-agnostic and supports a range of engines and providers. Which provider processes your Content depends on the engine and model selected by you or by us, and may include, among others, Anthropic, OpenAI, Google, OpenRouter, DeepSeek, and Moonshot (Kimi), as well as any provider you configure with your own account or API key. If you run a fully local model (for example via Ollama), that Content is processed on your device and is not sent to a third-party provider.

Some Model Providers are located outside the United States and the European Economic Area, including in jurisdictions such as China. When you or we select such a provider, your Content is transferred to and processed by that provider under its own terms and privacy practices. Where you bring your own provider, that provider acts as an independent controller or your processor, as applicable. Where you are in the EEA or UK and your Content is routed to a Model Provider outside those areas, we do so on the basis of your consent (see Section 4) and apply the safeguards described in Section 9.

We do not use your Content or personal data to make decisions that produce legal or similarly significant effects about you solely by automated means. The agent generates Output at your direction, and you remain responsible for the decisions you make using it.

6. How Information Is Shared — Service Providers and Sub-processors #

We do not sell your personal data for money. We share data only: with service providers and sub-processors that help us operate the Service, under confidentiality and data-protection obligations; with your consent or at your direction (including AI Model Providers and other integrations you enable); in connection with a merger, acquisition, financing, or sale of assets; and where required by law or to protect rights, property, safety, and security. Our sub-processors include (categories):

• AI Model Providers — process your Content to generate responses/summaries (see Section 5).
• Voice providers — where you use voice mode, your audio and/or transcript text is processed by the voice provider you select (for example OpenAI, Google, or ElevenLabs).
• Advertising partner — Gravity Labs receives the recent messages of a conversation where a sponsored message appears (on a screen with no conversation, and from the browser extension, only the name of the screen), your IP address, device and app information, and a random identifier (none when you turn personalised ads off), to choose and measure the sponsored messages shown there (see "Sponsored Messages on the Free Allowance").
• Payment processor — Stripe processes payments and subscription billing.
• Authentication — Google, if you choose Sign in with Google.
• Cloud infrastructure and hosting — providers that host our servers, databases, and object storage, and a content-delivery/DNS provider that fronts our domains.
• Security tooling — a privacy-preserving breach-check service used by the password manager, to which only a partial, irreversible hash of a password is sent (never the password itself); and Cloudflare Turnstile, which checks that a person, not an automated program, is using the sign-in, account-creation, password-reset and contact forms on our websites and web app — it receives your IP address and technical signals from your browser, sets no advertising cookies, and usually shows you nothing (a short challenge appears only when it suspects automation).

7. Storage, Security, and Encryption #

We use technical and organizational measures appropriate to the risk. Local secrets on your device (such as your session and stored credentials) are encrypted using your operating system’s secure storage. Data in transit is protected with TLS.

Conversation content and project data you sync to our servers are encrypted at rest using AES-256-GCM. Importantly, this is NOT end-to-end encryption: we hold the encryption key and can decrypt this content in order to provide the Service and to generate summaries and statistics as described.

The built-in password manager is different, and which way depends on a choice you make. If you set a master password, your vault is end-to-end (zero-knowledge) encrypted with a key derived from that password, which we never receive: we cannot read your vault, and if you lose both the password and your recovery key, nobody can recover it. If you do not set one, your vault key is escrowed on our servers so your other devices can unlock themselves; that vault is encrypted in storage and in transit, but it is NOT zero-knowledge and we are technically able to decrypt it. Setting a master password later re-wraps the key and deletes our copy.

Device-to-device connections use pinned device keys and can be additionally end-to-end encrypted. No method of storage or transmission is completely secure, and we cannot guarantee absolute security. If we become aware of a personal-data breach that affects you, we will notify you and the competent authorities as required by applicable law.

8. Data Retention #

You may request deletion of your data at any time (see "Your Rights and Choices"). We retain personal data for as long as your Account is active or as needed to provide the Service, and otherwise for the periods below:

• your synced conversations and account data are deleted within 30 days after you request deletion or close your Account;
• backups containing that data are purged within 90 days;
• content-free usage analytics are kept without a time limit, for analytics, unless you ask us to delete them (see "Your Rights and Choices");
• the records of visits to our websites, page views, downloads and the installs counted for a link described in "Cookies and Similar Technologies", which name no person, are kept without a time limit, for analytics;
• the short-lived entries kept there under a keyed hash of a network, to count a download’s install and an app’s sign-up for their link, are kept for at most two days (a day’s count of installs, up to three days from a click); and
• billing and transaction records are retained for as long as required by applicable law (typically up to 7 years).

9. International Data Transfers #

We are based in the United States, and we and our service providers may process your data in countries other than your own, which may have different data-protection laws. In addition, as described in Section 5, the AI Model Provider you or we select may be located outside your region, including outside the US and EEA. For transfers to our service providers, we use appropriate safeguards such as the European Commission’s Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable). For transfers of your Content to an AI Model Provider located outside the EEA or UK that you or we select, we rely on your explicit consent to that transfer (see Sections 4 and 5) and on that provider’s own safeguards.

10. Your Rights and Choices #

Depending on your jurisdiction, you have rights over your personal data. You can:

• access and download/export the data we hold about you — from within the app at Settings → Privacy, or by contacting us;
• delete your synced conversations and project data from our servers (erasure) — from Settings → Privacy;
• object to the processing for sponsored messages — by contacting support@tesseract.dev (sponsored messages themselves cannot be turned off, except by a paid plan or a balance);
• keep sponsored messages but turn personalised ads off — each is then chosen from the conversation alone, with no identifier sent — in Settings → Privacy;
• object to, or opt out of, processing of your content for analytics and product improvement, and withdraw consent where processing is based on consent — by contacting support@tesseract.dev;
• request rectification of inaccurate data, restriction of processing, and data portability; and
• lodge a complaint with your local data-protection authority, or, in the United States, exercise rights under applicable state privacy laws (see Section 13).

11. Consent and Product Analytics #

Product analytics and conversation sync are tied to your acceptance of these documents at first run: no usage data is sent before you accept, and conversation sync stays off until you turn it on. Crash and error diagnostics have their own control: they are on by default, and you can turn them off in Settings at any time (see "Information We Collect"). Analytics events are content-free by design. If you wish to object to analytics processing associated with your account, contact support@tesseract.dev and we will apply a suppression mechanism.

12. Children #

The Service is not directed to children under 13 — or the higher age of digital consent that applies where you live, such as 16 in some EEA countries — and we do not knowingly collect personal data from anyone below that age. If you believe a child below the applicable age has provided us personal data, contact support@tesseract.dev and we will take appropriate steps to delete it.

Sponsored messages appear for everyone old enough to use the Service. If we know you are under 18 — because you told one of our apps, or your app store says so — every ad is chosen from the conversation alone and no identifier for you is sent; if we don’t, turn off "Personalised ads" (Settings → Privacy) for the same (see "Sponsored Messages on the Free Allowance").

13. United States State Privacy Rights #

If you are a resident of California or another U.S. state with a comprehensive privacy law, you have additional rights, subject to that law, including the right to know and access the personal information we collect (the categories are described in Section 2), to delete it, to correct it, to obtain it in a portable form, to opt out of the "sale" or "sharing" of personal information and of certain profiling, and to limit the use of sensitive personal information. We do not sell your personal information for money. When sponsored messages are shown, the information described in "Sponsored Messages on the Free Allowance" is disclosed to our advertising partner to choose and measure them, which some state laws treat as "sharing" for advertising. You can opt out of that sharing at any time — turn off "Personalised ads" in Settings → Privacy: no identifier is sent, and every request tells our partner not to sell or share it. Sponsored messages themselves stay, chosen from the conversation alone; only a paid plan or a balance turns them off. We honour the Global Privacy Control (GPC) signal as that opt-out, and we treat an opt-out request under those laws the same way.

You may exercise these rights by contacting support@tesseract.dev, and you may use an authorized agent to submit a request on your behalf where the law permits, provided the agent provides proof of authorization. We will not discriminate against you for exercising your rights, and we verify requests before acting on them as required by law. Where required by law, we honor recognized browser opt-out preference signals, such as Global Privacy Control (GPC), as a request to opt out of the sale or sharing of personal information.

14. Cookies and Similar Technologies #

The Tesseract apps on your computer and phone do not use advertising cookies; where you get personalised sponsored messages, they keep an advertising identifier on your device instead (below; on an iPhone or iPad only if you allow tracking). The built-in browser stores cookies locally on your device to support your browsing sessions, as any browser does; these are not collected by us.

Our websites and web-based experiences use strictly necessary cookies (for example, for login and session management) and two first-party measurement cookies, tsr_src and tsr_ref. When you arrive at tesseract.dev through a link that names where it was published (for example a link we posted on a social network, or another website that links to us), tsr_src holds that source — the same value for everyone who followed the link, not an identifier — and tsr_ref the address of the website you came from (when your browser tells us), both for 30 days, so we can count which links bring visits, downloads and new accounts.

For each visit to our website (through a link or not), each page you open there and each download click, our website records the source if there is one, the page, the referring website’s address (or our page you came from), your approximate country (derived from your IP address, which is not kept with the record), the kind of device and your time zone — until our server confirms a record, your browser keeps it in its local storage and sends it again; an account created while the cookie is set records the source and the website it came from; and an install of one of our computer apps counted for a link (below) records the source, the website it came from, the app’s system and your approximate country. These records name no person and are kept without a time limit, for analytics.

When you sign in to one of our apps with Google, the sign-in request carries the source and website the cookies hold through Google and back, sealed so that only our server can read them, for at most 30 minutes; a new account keeps them, and nothing else of them is stored.

A download, and a sign-in to one of our apps, carry no cookie. So that they can still be counted for the link that brought them, our server keeps for a short time, under a keyed hash of the network a download click or an app’s sign-in came from (your IP address, or the network part of an IPv6 address): the link’s source, the referring website, what was downloaded, the system it was downloaded on, the time of the click to ten minutes and a keyed form of the click’s identifier — for at most two days from the click, or fifteen minutes from the start of a sign-in. A mark that a click was taken is kept under that keyed identifier alone, also no longer than the two days.

The first install of one of our computer apps from that network that fits the download (its system) takes its details; the first Google sign-in to one of our apps from that network then takes what is kept for it, once — a sign-in start, and an install’s details for a computer app’s sign-in — and a new account without a source of its own keeps one of them; they are deleted then, or when their time is over. A count of the installs from a network is kept under the same hash for a day after an install, so up to three days from a click.

The hash is made with a secret key only we hold, and the address itself is never kept; with that key, while an entry exists, we could work out the address it came from and match the entry to the record of that download click.

We do not use Google Analytics. The one advertising tracker is in our web app (app.tesseract.dev): where you get personalised sponsored messages, it loads Gravity Labs’ measurement script, which sets its own cookies and browser storage (for up to 180 days) and fingerprints your device, as described in "Sponsored Messages on the Free Allowance" — where our desktop apps run the same measurement with a file on your computer instead of cookies; turning off "Personalised ads" removes it. Our other websites carry no advertising trackers. Cloudflare, which serves our websites, reports to us aggregate traffic figures (requests, visits, countries, pages) that identify no one.

15. Connected Cloud Storage (Google Drive, Dropbox, Microsoft OneDrive) #

You can connect cloud storage accounts — Google Drive, Dropbox, and Microsoft OneDrive — to Tesseract’s file browser. You connect an account by signing in on the provider’s own sign-in page in your web browser and approving the access shown there; Tesseract never sees your password for that account.

What we access and why. With your approval, Tesseract can list, open, download, upload, rename, move, copy, and delete the files and folders in the connected account, and read the account’s email address to label the connection. This access is used only to provide the file-browser features you use: each action happens because you browse, open, edit, copy, move, or delete something in Tesseract, or ask the Tesseract agent to do so for you.

Where your files go. Files are accessed by the Tesseract app on your own device, directly between your device and the provider. We do not copy your cloud files or their metadata to our servers. If you open a connected account from another of your own devices through Tesseract’s device link, the data passes through our relay in transit only and is not stored. If you ask the Tesseract agent to read or work on a file, that file’s content is sent to the AI Model Provider you selected (see Section 5) solely to carry out your request.

How the connection is kept. The lasting sign-in token for a connected account is stored encrypted in your Tesseract Vault on your device (and end-to-end encrypted if you sync your Vault); short-lived access tokens are kept only in memory on your device.

What we never do. We do not sell data from your connected accounts, use it for advertising, use it to train or improve AI or machine-learning models (ours or anyone else’s), or let people read it, except with your explicit consent, where necessary for security purposes or to comply with applicable law.

Google user data. Tesseract’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnecting. You can disconnect an account at any time by removing it in Tesseract, which deletes its sign-in token from your Vault, and you can revoke Tesseract’s access from the provider’s own account settings: Google Account → Security → Third-party apps with account access; Dropbox → Settings → Connected apps; Microsoft account → Privacy → Apps and services. Revoking access does not delete any of your files.

16. Accounts Connected to Your Assistants (Gmail, Google Calendar and Contacts, Microsoft 365, Teams and others) #

You can connect accounts to the assistants you make in Tesseract — Google (Gmail, Google Calendar, Google Contacts), Microsoft 365 (Outlook mail, calendar and contacts), Microsoft Teams, and other services that offer a connection, such as Notion or Linear. You connect an account on the provider’s own sign-in page and approve the access shown there; Tesseract never sees your password for it. A connected account can be used only by the assistants you allow, and you can allow or take back each one at any time.

What we access and why. With your approval, an assistant can read and search your email, write drafts, send the messages you ask it to send, and label, archive or move messages to the trash (it never deletes them permanently); list your calendars and events, create, change or cancel events and answer invitations; look up, add, change or delete contacts; and read and write Teams chat messages and post in channels. It does this only to carry out what you ask it, or the routines you set for it (for example a morning brief), and the account’s email address is read to label the connection.

Where your data goes. When an assistant runs on your device, Tesseract on your device fetches the data directly from the provider. When you put an assistant online, it runs in its own isolated container — on Tesseract Cloud or on a server you choose — which fetches the data the same way; what the assistant keeps, such as its conversations and notes, stays in that container’s own storage and is erased when the container is deleted. The content an assistant works on is sent to the AI Model Provider you selected (see Section 5) solely to carry out your request; when that request goes through Tesseract’s model gateway, the gateway relays it without storing it.

How the connection is kept. The sign-in tokens are stored encrypted on your device, or in the assistant’s encrypted environment when it is online; the services’ tokens are used only by Tesseract itself and are never handed to the AI model.

What we never do. We do not sell data from your connected accounts, use it for advertising, use it to train or improve AI or machine-learning models (ours or anyone else’s), or let people read it, except with your explicit consent, where necessary for security purposes or to comply with applicable law.

Google user data. Tesseract’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Disconnecting. You can disconnect an account at any time on the assistant’s card in Tesseract, which deletes its sign-in tokens and, where the provider allows it, revokes them; you can also revoke Tesseract’s access in the provider’s own account settings (Google Account → Security → Third-party apps with account access; Microsoft account → Privacy → Apps and services). Disconnecting does not delete any of your email, events or contacts.

17. Sponsored Messages on the Free Allowance #

Using Tesseract without a paid plan or a balance — the free AI allowance, conversations that run on your own Claude, ChatGPT, Gemini or other AI account, and the free use of our Remote Desktop, Private Network and Atrium apps — is paid for in part by sponsored messages (ads). In the desktop app, the browser extension and the phone app they appear in conversations, whichever AI account a conversation runs on, and on the Home screen. In Remote Desktop, Private Network and Atrium one appears at the end of the app’s start screen — your list of computers, your list of networks, your own page.

They never appear if you have a balance or a paid plan, and never inside a remote-desktop session, on a network’s own page, in a notification, or in any channel, message or conversation between people. They are always labelled "Sponsored", are never part of the AI’s answer, and never influence it.

They are always on: there is no setting that turns them off, and a paid plan or a balance is the way to have none. In the EEA, the UK and Switzerland they are chosen from the conversation alone and never personalised. We honour the Global Privacy Control signal: with it, ads are chosen from the conversation alone. At most one sponsored message is on your screen at a time.

To choose a relevant ad, we send our advertising partner, Gravity Labs, the recent messages of the conversation where the ad appears (up to six, each shortened), your IP address, your operating system and app version, a random identifier for the conversation, and an identifier derived from your account or device that is not your name or email address. We do not send your files, your other conversations, your account details or your payment information.

Where an ad has no conversation beside it — the Home screen, the start screens of our other apps — and in the browser extension, Gravity Labs receives the name of the screen instead of any messages: nothing about your computers, networks, channels or the web pages you visit.

Gravity Labs uses this information to choose and measure ads and to prevent ad fraud, under its own privacy policy, which also lets it tailor and measure ads across the apps and sites that use its services. To stop that, turn off "Personalised ads" (Settings → Privacy, under Sponsored messages): each ad is then chosen from the conversation alone, no identifier derived from your account or device is sent, and every request tells Gravity Labs not to use it for personalisation or to sell or share it. A browser that sends the Global Privacy Control signal gets the same. In the EEA, the UK and Switzerland every ad is chosen this way — from the conversation alone, never personalised.

Where ads are personalised, our web app also loads Gravity Labs’ measurement script (its "pixel"), which Gravity Labs requires to attribute ads and pay us. It sends Gravity Labs the address, title and referrer of the pages you open in the web app, the clicks you make there, your browser, language, time zone and screen, a fingerprint of your device (from how your browser draws graphics and plays audio, and its hardware), and any user or customer identifier the page keeps in your browser; it keeps an identifier in your browser’s cookies and storage for up to 180 days, so Gravity Labs can recognise your browser and link an ad you saw to a later visit or purchase, including across the apps and sites that use its services.

Our desktop apps (Tesseract, Remote Desktop, Private Network and Atrium on your computer) run Gravity Labs’ version of the same measurement for apps: it keeps a random visitor identifier and its sessions in a file on your computer for up to 180 days, and each time an app starts it sends Gravity Labs that identifier with your operating system and its version, your processor’s type and number of cores, your memory size, time zone, locale and language.

Our phone apps (Tesseract, Remote Desktop and Atrium) do the same with a random visitor identifier kept on your phone for up to 180 days, sending with it only your phone’s operating system and its version, time zone, locale and language. On an iPhone or iPad this happens only if you tap "Allow" when the app asks whether it may track you across apps and websites; without that, no identifier goes to Gravity Labs and every ad there is chosen from the conversation alone. You can change that answer in your iPhone’s Settings → Privacy & Security → Tracking.

In every app, the identifier goes with each ad request, so Gravity Labs can tie the ad to the visitor it measures. It never runs in the browser extension or the Private Network phone app, in the EEA, the UK or Switzerland, where your browser sends the Global Privacy Control signal, or where ads are not personalised; turning off "Personalised ads" removes it and what it kept.

When an ad is on your screen, the app tells Gravity Labs it was seen; when you open it, your browser goes through Gravity Labs’ link to the advertiser.

Each ad offers "Why this ad", which says how it was chosen and who paid for it, and "Hide", which pauses sponsored messages for 15 minutes. To keep sponsored messages but not personalised, turn off "Personalised ads". Only adding funds or choosing a paid plan stops sponsored messages altogether. Sponsored messages appear for everyone old enough to use Tesseract (see "Children"). If we know you are under 18 — because you told one of our apps, or your app store says so — every ad is chosen from the conversation alone and no identifier for you is sent; if we don’t, turn off "Personalised ads" for the same.

18. Changes to This Policy #

We may update this Privacy Policy from time to time. For material changes we will provide reasonable notice (for example, in-app) and, where required, obtain your consent. The "last updated" date reflects the current version.

19. Contact and Privacy Officer #

For privacy questions or to exercise your rights, contact Eightcell Labs, Inc. at support@tesseract.dev, or by mail at 3979 Albany Post Road #620, Hyde Park, NY 12538, United States. Our privacy officer is Liviu Maftuleac, reachable at the same addresses.

For the purposes of Article 27 of the EU/UK GDPR, we have designated Liviu Maftuleac as our representative for data-protection matters; you may contact the representative at support@tesseract.dev.