Verify us

Run it yourself

Open Terminal and run:

tessen --privacy-report

This prints every privacy self-check the app runs on itself, with the measured statistics behind each verdict — bytes scanned, file and host counts, socket count, and so on — the same numbers the Hub's own privacy panel renders, in plain text you can copy, grep, or diff against a later run.

What it checks, and what a pass means

• Outbound hosts — scans the shipped binary's own strings for any embedded http/https host, and checks each one against the small list Tessen is allowed to ever contact: apple.com, gettessen.com, buy.stripe.com, and huggingface.co (the last one only used if you deliberately choose to download an optional speech model). A host outside that list found inside the binary is a fail.
• Audio retention — lists the temporary directory for any leftover recording file. Dictation audio is processed and discarded; nothing should still be sitting there afterward.
• Account / sign-in state — scans Tessen's own Application Support folder for anything shaped like a session token, OAuth credential, or cookie. There should be none — Tessen has no account to sign into.
• Live socket count — reports how many open network sockets the running process currently holds, for you to eyeball against whatever you expect at that moment.

What the output looks like

[PASS] outbound_hosts — Outbound hosts embedded in the shipped binary
  every embedded host is on the allowed list
    hosts_found: 4
    hosts_allowed: 4

[PASS] audio_retention — Audio retention after transcription
  no leftover recording files found
    files_found: 0

[PASS] account_state — Account / sign-in state
  no session, OAuth, or cookie-shaped file found
    files_scanned: …

[PASS] socket_count — Live socket count for this process
  reported for you to inspect; no pass/fail verdict by design
    sockets: …

Exact field names and counts vary by build and by what your Mac is doing at the moment you run it — the shape above is what to expect, not a literal transcript to match byte for byte.

What we run before every build ships

Before any .dmg is notarized and shipped, our release pipeline runs scan_release.sh against the built .app, checking for exactly the kind of thing that would embarrass a privacy-first product if it leaked: a developer's home-directory path baked into the binary or a bundled resource, this repository's own internal project names, an oversized or unexpected data file that looks like baked-in developer state, marketing-site assets that have no business in a native app bundle, and any file that looks like a private signing key.

A clean run prints:

==> Release scan clean: no leaked paths, private keys, or
    marketing-site cruft found.

Any hit prints one LEAK: … line per finding and the build stops — it never reaches a customer.

Reproduce the same class of check yourself

This tool runs against our source tree, so you can't invoke scan_release.sh directly on the app you downloaded — but the technique it uses is standard and you can approximate it in a minute on your own Mac. Open Terminal and run:

strings -a /Applications/Tessen.app/Contents/MacOS/Tessen | grep -i "/Users/"

It should print nothing. A native app with a developer's home-directory path or an internal project name baked into the binary is a sign something was shipped that shouldn't have been — exactly what our own gate refuses to ship.