Privacy policy.

The short version

Tessera does not send Silo Systems the content you process or your model-provider API key. No analytics, telemetry, advertising IDs or crash reports are sent to Silo. Content you send with the optional Bring Your Own Key setting goes directly to the provider you choose; other network traffic is disclosed below.

By default, Tessera processes your content on your device. If you switch on the optional Bring Your Own Key setting and confirm its consent notice, only the content you process with that feature is sent to the model provider you selected, under your own account and API key, as described below. Silo does not provide cloud processing for your content, and there is no Tessera account.

What the app never sends

Silo does not receive the content you process in Tessera, your model requests or replies, or your model-provider API key. Bring Your Own Key requests go from your device to the provider you chose, never through Silo. That provider receives what you send and ordinary request metadata, such as your IP address, under its own policies. If you contact support by email, we receive your email address and whatever you choose to send.

Outbound network traffic

The connections associated with Tessera are described below. Separately, Apple's operating system and App Store may contact Apple automatically, for example to verify your purchase or to deliver updates.

1. Model weight downloads. After onboarding, Tessera offers to download model weights from public open-weights repositories (Hugging Face (mlx-community/gemma-4-e2b-it-4bit @ 238767527555cb75a05732a84dff5d6ba0dd6809)). The download is anonymous by default; no token, account, or registration is required. The repository host receives ordinary web-request metadata, including your source IP address, but no document, prompt, usage, or telemetry data. Once the weights are on disk, Tessera's on-device features work offline.
2. Optional model endpoints you configure (Bring Your Own Key). This is off unless you turn it on in Providers and confirm the consent notice. When it is on, Tessera sends the content you process with that feature to the model provider you selected, using your own account and API key. Your key is stored only in the system Keychain on your device, and Silo never receives it. That provider receives the content and ordinary web-request metadata, including your source IP address, and handles both under its own privacy policy and data-retention practices. The traffic goes from your device straight to that provider and never through Silo, and Tessera keeps working entirely on-device with the setting off.
3. App Store updates. When Apple ships a Tessera update, the App Store delivers it. This traffic is between your device and Apple's servers. Tessera is not involved.
4. Links you click. If you click an external link inside the app, your default browser handles the request. Tessera is not involved.

Permissions we request, and why

• Network client. Used only to send the request you approved in the wire preview (the sanitized prompt, the sanitized earlier turns, and any value you chose to send as is) to the AI provider you configured, under your own API key, and to fetch the optional consent-gated Gemma 4 checkpoint from pinned Hugging Face hosts. No analytics or telemetry.

Tessera does not request protected resources beyond those listed above. System permission controls remain in effect at all times.

On-device data you create

Your content and everything derived from it live inside the macOS app container at ~/Library/Containers/com.silosystems.tessera/Data/Library/Application Support/Tessera/. Any file you explicitly choose for an import or export remains under your control at the selected location. They are yours; we do not have access to them. Removing the Tessera app bundle may leave its macOS sandbox data in place; use any in-app delete or purge controls first, then macOS storage controls for remaining container data. Files in user-selected locations remain until you explicitly delete them.

Third-party components

Any frameworks and model assets listed below are used for on-device processing. Any download sources listed below are contacted as described under ‘Outbound network traffic.’ A Bring Your Own Key provider receives the content sent with that feature and ordinary request metadata, including your IP address, and handles them under its own privacy policy and retention practices.

• mlx-swift-lm — runs locally on-device.
• gemma-4-e2b-it-4bit — runs locally on-device.
• Apple NaturalLanguage — runs locally on-device.
• NSDataDetector — runs locally on-device.
• Gemma 4 E2B local span proposer (4-bit) (Hugging Face (mlx-community/gemma-4-e2b-it-4bit @ 238767527555cb75a05732a84dff5d6ba0dd6809)) — downloaded on demand, runs locally.
• Hugging Face (mlx-community/gemma-4-e2b-it-4bit @ 238767527555cb75a05732a84dff5d6ba0dd6809) — contacted only when you choose to download model weights.

Children's privacy

Bring Your Own Key is optional and off by default. A provider you use with Bring Your Own Key receives what you send and applies its own data practices and age requirements.

Changes

If we materially change how Tessera handles data, we will update this policy and the release notes, and require explicit in-app consent before any new collection begins. Your chosen model provider controls its own privacy policy and retention practices.

Contact

Questions about this policy: admin@ohmslaw.net