Privacy Policy

Last updated: 2026-10-16

This policy explains what Tessen (the macOS application) and gettessen.com (this website) do with your data. It is written to match what the software and the site actually do, which is unusually little: the site has no advertising pixel and no tracking of you across other sites (the only third-party code on it is two small scripts added by its host, Cloudflare, described in section 3.3), and the application performs speech transcription entirely on your own Mac.

1. Who controls this data

The data controller for this website and the Tessen application is Tessen, a sole-trader business operated from the United Kingdom. Postal address available on request from support@gettessen.com. For any privacy question, request, or complaint, contact support@gettessen.com. We aim to respond within 30 days, and sooner wherever we can.

2. What the application does with your data

2.1 Transcription — on-device, always

Audio you dictate is captured, transcribed, and formatted entirely on your own Mac using models that run locally on Apple Silicon. It is never uploaded to us, to Apple, or to any third party, and it is not used to train anything. If you turn off your Wi‑Fi mid-dictation, nothing changes — there is no server on that path to lose.

The recording itself lives in a temporary local file for only as long as that transcription takes. On a successful transcription, or if you cancel, it is deleted immediately. If a transcription fails, Tessen keeps only the one most-recent failed recording, locally, for up to 24 hours, so you can retry it — deleted as soon as a retry succeeds, and never accumulating: only one failed take is ever kept at a time. It is never uploaded at any point, and this local-only exception is visible in the app's own Privacy panel.

2.2 The local dictation log — the one thing we want to be extremely direct about

Tessen writes a record of what you dictate to a file on your own Mac, at ~/Library/Application Support/Tessen/dictation_log.jsonl. This is what powers the Hub's searchable History tab. Three facts matter here:

• It is written in plain text, not encrypted at rest, on the assumption that your own Mac's disk (and FileVault, if you have it enabled) is the security boundary — the same assumption every local Notes or Mail database on macOS makes.
• It is never transmitted anywhere. No part of Tessen uploads this file, and there is no server we operate that could receive it.
• You control it. Tessen provides controls, in the Hub's History tab, to turn dictation logging off entirely and to delete all existing history. Doing either is immediate and local — nothing to request from us, because we never had a copy to delete.

2.3 Your custom vocabulary and corrections

Words, names, and corrections you teach Tessen are stored in a dictionary file on your own Mac and are never uploaded. The built-in trade vocabulary packs (finance, legal, medical, software) ship inside the application and involve no network access to use.

2.4 Trial start, licence activation, and licence refresh — three of the five deliberate network calls

Starting your free trial from inside the app sends a one-way hashed device ID for your Mac to a server we control when you start the trial, and once more when it ends to move this Mac to the Free plan, so the trial can be bound to this Mac and cannot simply be restarted by reinstalling the app. The device ID is derived on your Mac with a one-way hash before it is ever sent — we never receive the underlying hardware identifier itself, and the request carries nothing else: never dictation content, history, vocabulary, or any other personal data. To stop automated abuse, the server keeps a one-way hash of the requesting IP address for about 25 hours to count new trials, then it expires.

Entering a Tessen licence key sends that key and this Mac's device identifier to a server we control, once, which is designed to bind the licence to your machine so it cannot simply be copied to others. That identifier is normally a one-way hash of the hardware UUID, derived on your Mac before anything is sent; if our server cannot match that hash it falls back to sending the raw hardware identifier itself, so this policy does not describe activation as hashed-only. That request carries only the licence token and that device identifier — never dictation content, history, vocabulary, or any other personal data.

Most licence checks after that happen entirely on your own Mac, with no server involved. The one exception is a licence refresh: only in the final three days before a paid licence's local expiry window, the app makes the same kind of request — licence token and hashed device ID only, still never dictation content or any other personal data — to confirm your subscription is still active and extend the local expiry. Outside that three-day window, no refresh request is made at all. The Free plan and an active trial have no expiry to refresh, so neither ever triggers this call.

2.5 Telemetry and analytics

Tessen makes no analytics or telemetry calls of any kind. We do not know how often you dictate, what you dictated, which features you use, or whether the app crashed, unless you choose to email us about it yourself.

2.6 The five things that can reach the network

No audio and no dictated text ever leaves your Mac, under any of the five calls below or at any other time. Every one of the network calls Tessen itself makes carries, at most, a licence token, a device identifier, a version number, or a public model filename — never anything you spoke or typed. The trial-start call's identifier is a one-way hash only; the activation call's is normally that same kind of hash, with the raw hardware identifier as the fallback described in §2.4, which is why this section does not claim the raw identifier never leaves the Mac. The speech-model download below carries no identifier of any kind — not even a hash.

An update check. The application includes a "Check for Updates…" menu item. Nothing is checked on launch, and nothing is checked in the background, unless you switch on "Check for updates automatically" in the app's update panel. That switch ships turned off, so out of the box the only thing that contacts the network is you clicking the menu item. If you do turn it on, Tessen makes the same request by itself, at most once a day. Either way it is a single outbound request to an address we control (gettessen.com) to read a public release manifest, and it carries the app's version number and no dictation content, history, vocabulary, or other personal data. No third party is contacted. If you then click "Download Update," Tessen's own process fetches that update file directly with a second, equally plain request (same version-number-only request line, no extra parameters) — it is not just handed to your default browser — and checks the downloaded bytes against the digest the manifest published, when the manifest publishes one. A match reveals the file in Finder; a mismatch deletes it and tells you, rather than ever revealing a file that failed that check; a manifest that has not published a digest yet still reveals the downloaded file, the same trust boundary a plain browser download always had, since Gatekeeper independently verifies the file's signature and notarization when you open it either way. This download is still part of the same update-check call in the count below, not a separate one.

Trial start, when you start your free trial and when it ends. Described in full in §2.4. It carries only a one-way hashed device ID for your Mac, never dictation content or other personal data. It happens when you start a trial on this Mac and once more when the trial ends, to switch this Mac to the Free plan.

Licence activation, once, when you subscribe. Described in full in §2.4. It carries only the licence token and your Mac's device identifier (hashed, with the raw-identifier fallback §2.4 describes), never dictation content or personal data, and it happens once, when you first activate.

Licence refresh, only in the final three days before a paid licence's local expiry window. Also described in §2.4. Same payload as activation — licence token and device identifier, never dictation content or other personal data. Outside that three-day window, no refresh request is made; the Free plan and an active trial have no expiry to refresh at all; the app is silent on the network the rest of the time.

Speech model download, only if you choose to add the optional accuracy pack. Tessen's built-in engine needs no download. If you run tessen engines download <id> or click a download button for the optional accuracy pack (an additional on-device speech model; once installed it is used to finalize dictation in the Balanced and Accuracy modes and to transcribe audio files you choose — all of it on this Mac), Tessen fetches that model file with a plain request to huggingface.co. It carries no identifier of any kind — no hashed or raw hardware ID, no licence token, nothing about you — only a public model filename. The downloaded bytes are checked against a SHA-256 digest built into Tessen itself; a mismatch deletes the file and refuses to use it, the same fail-closed rule the update-file check above uses. This never happens automatically or in the background, and the model is never bundled with the app, so this adds nothing to what Tessen downloads on install.

That is the complete list — five calls, never more: an update check, a one-time trial start, a one-time licence activation, an occasional licence refresh, and — only if you choose to download an additional speech-recognition engine — a speech model download. If you leave automatic update checks off — which is how they ship — never click "Check for Updates…", have already started your trial or activated your licence, are outside the three-day refresh window, and never download an additional engine, the application makes no network request at all.

Separately, on macOS 26 and later, the first time you dictate in a given language the operating system may download Apple's on-device speech model if it is not already installed. That request is made by macOS to Apple under Apple's own privacy terms; it is not made by us, it does not reach any server of ours, and no audio, transcript, or other content of yours is attached to it. It happens once per language, and every dictation after it runs with no network access at all. On macOS 13 through 15 Tessen uses the speech recognition already present on your Mac and no such download occurs. This is not counted among the five Tessen-initiated calls above because macOS makes it, not the app.

3. What this website does with your data

3.1 The notify form — “Hear about the next version”

If you submit your email address through the “Hear about the next version” form (labelled “Get early access” before 9 September 2026), it is stored in Cloudflare Workers KV (a key-value store operated by our hosting provider, Cloudflare, on our behalf) together with the date you submitted it and the two-letter country code Cloudflare derives from your connection (for example GB) — a country, never a city, an address or a precise location. We do not store your IP address against your email — a separate, short-lived, hashed value is used only to rate-limit abuse of the form for one hour and is not linked to your address in storage. We use this address only to email you about downloads, launches, and product updates you asked to hear about. We do not sell it, rent it, or share it with anyone other than Cloudflare, who process it purely as storage infrastructure and do not use it for their own purposes.

3.2 Payment

Purchases are processed by Stripe, Inc., via a Stripe Payment Link. When you pay, your card details, billing address, and related payment data are collected and processed by Stripe directly — they never pass through our servers, and we cannot see your full card number. For this data, Stripe acts as an independent data controller, not our processor: your relationship with them for payment data is governed by Stripe's own privacy policy. We receive from Stripe only what is necessary to fulfil your order (confirmation that payment succeeded, the email address you paid with, and the amount/plan purchased).

3.3 Hosting and security

This website is hosted on Cloudflare Pages and protected by Cloudflare's edge network, which necessarily sees standard connection metadata (IP address, request headers) to serve the page at all, in the same way any web host does. We add no session-replay, advertising, or fingerprinting tooling on top of that. Cloudflare itself adds two scripts to the pages it serves: a cookieless page-view counter (anonymous visit counts, with no identifier that follows you to other sites), and a small script that hides email addresses on the page from automated scrapers. The site loads no third-party fonts. You can see exactly what loads in your browser's network inspector.

3.4 Cookies

This site sets no cookies and uses no client-side storage to identify or track you across visits.

4. Processors we use

Processor	What they handle	Role
Cloudflare, Inc.	Website hosting, the notify-form mailing list (Workers KV)	Processor
Stripe, Inc.	Payment and billing data	Independent controller

No other third party receives any data from this site or this application.

5. Your rights (GDPR / UK GDPR)

If you are in the UK or EEA, you have the right to:

• Access the personal data we hold about you (in practice: the email address and submission date in our notify list, if any).
• Rectify inaccurate data.
• Erasure ("right to be forgotten") — request we delete your email from our records.
• Restrict or object to our processing of your data.
• Portability — receive the data you gave us in a portable format.
• Withdraw consent at any time, for processing based on consent (such as the notify list).
• Lodge a complaint with your local data protection supervisory authority (in the UK, the Information Commissioner's Office) if you believe we have mishandled your data.

To exercise any of these rights, email support@gettessen.com. Because your dictation history and vocabulary never leave your own Mac, there is nothing on our servers to access, correct, or delete beyond an email address you may have given us.

6. Your rights (California / CCPA)

California residents have the right to know what personal information we collect, to request deletion of it, to correct it, and to opt out of the "sale" or "sharing" of personal information. We do not sell or share your personal information with third parties for their own advertising or marketing purposes — the only sharing that occurs is with the two processors named above, for the purposes described. You will not receive discriminatory treatment for exercising any of these rights. Requests can be made to support@gettessen.com.

7. Data retention

• Notify-list emails are retained until you ask us to delete them, or until the purpose (notifying you about launch/updates) has clearly passed, whichever is sooner.
• Payment records are retained by Stripe per their own retention obligations, including statutory tax and accounting record-keeping periods that can exceed the length of your subscription.
• Your local dictation log and vocabulary are retained on your own Mac for as long as you keep them — we hold no copy and set no retention period for something we never receive.

8. Children's privacy

This service is not directed at children under 16, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

9. International data transfers

Cloudflare and Stripe operate global infrastructure and may process data outside your country of residence. Both maintain their own transfer safeguards (including Standard Contractual Clauses where applicable) — see their respective privacy policies for details specific to their processing.

10. Changes to this policy

If this policy changes, the "Last updated" date at the top of this page will change, and material changes will be called out on this page. We will not retroactively expand what we do with data you already gave us under an earlier version of this policy without telling you.

11. Contact

Email support@gettessen.com for any privacy question, request, or complaint. Governing law for this policy: the laws of England and Wales. The courts of England and Wales have exclusive jurisdiction, without prejudice to any mandatory consumer-protection rights you have under the laws of your country of residence.