Privacy Policy

Last updated 30 August 2026. This version replaces any earlier one.

1. Who is responsible

The controller for the processing described in this policy is Studio Heino, Lipunkantajankatu 7 C 37, contactable at hello@studioheino.com (“we”, “us”).

No Data Protection Officer has been appointed. Under Article 37 of the General Data Protection Regulation one is required only where processing is carried out by a public authority, where core activities require regular and systematic monitoring of data subjects on a large scale, or where core activities consist of large-scale processing of special categories of data. None of those apply. You can raise any data-protection question at the address above.

2. What this policy covers

Four things, deliberately kept apart because the answers differ sharply between them:

• this website and the separate origin that serves installer downloads;
• the collaboration servers we operate — where your account lives if you sign up, and where the documents you share are stored;
• the Tessera desktop application, once installed on your computer;
• collaboration servers run by you or by somebody else — for which, as section 10 explains, we are neither controller nor processor, because the data never reaches us.

3. Browsing this site

3.1 What is recorded

Serving a page requires the server to receive and briefly record certain information. For each request, a log line holds:

• your IP address;
• the date and time;
• the path requested — never the query string;
• the HTTP status, the bytes sent, and how long the request took;
• a random request identifier, not linked to you across requests.

An IP address is personal data under the GDPR, so it is treated as such even though nothing is done with it beyond operating and defending the service. The download origin records the same, plus which file was requested.

3.2 What is not collected

• No analytics or measurement of any kind, first-party or third-party.
• No third-party requests. The pages load no fonts, scripts, images, videos or frames from any other origin, so no other company learns that you visited.
• No JavaScript is served at all — including on the sign-in page — so there is no fingerprinting surface and no script that could read anything.
• No tracking pixels, no advertising identifiers, and no marketing email.
• No profiling and no automated decision-making within the meaning of Article 22.

Because there is no tracking to opt out of, a Do Not Track or Global Privacy Control signal has nothing to change; it is respected in the sense that the behaviour it asks for is already the behaviour.

4. Cookies

Browsing sets no cookies at all. Every page you can reach without signing in — the home page, the download page, this one — sets none, of any kind. That is why you are not shown a consent banner: nothing is stored on or read from your device, so Article 5(3) of the ePrivacy Directive has nothing to consent to.

Signing in sets exactly one cookie. It is called __Host-tessera_session and its value is a random identifier — no name, no email, no token, nothing derived from you. It is marked HttpOnly (script cannot read it), Secure (it never travels over plain HTTP), SameSite=Lax (it is withheld from cross-site form posts), and it expires when you close your browser. Everything it refers to is held on our server, not in it.

That cookie is strictly necessary for a service you asked for — signing in — and is therefore exempt from the consent requirement. There are no other cookies: no preference cookies, no analytics cookies, no third-party cookies. Signing out deletes it.

5. The closed-alpha list

Tessera is in closed alpha and the installer is sent by email rather than downloaded. If you ask for access, we record:

• your email address — the only required field, and the only way to send you anything;
• your name, if you gave one;
• the platform you asked for and any note you wrote about what you would use it for;
• which page the request came from, and the date.

What is deliberately not recorded: your IP address, your browser, and where you came from. Abuse is handled by rate limiting rather than by keeping something about whoever asked.

It is used to send you an installer and occasional notices about the alpha, and for nothing else. It is not shared, not sold, not uploaded to an email marketing service, and not combined with anything else to build a profile. The list lives in a file on our own server.

Legal basis: your consent, under Article 6(1)(a), given by ticking the box on the form. You may withdraw it at any time by writing to hello@studioheino.com, and your entry is deleted; withdrawal does not affect the lawfulness of anything done before it.

Retention: until you ask to be removed, or until the alpha ends and everyone on the list has been let in — whichever is first. It is not carried over into a marketing list afterwards.

6. Your Tessera account

You do not need an account to use Tessera. The application is fully functional without one and makes no network connection at all until you configure a server. An account exists for one purpose: sharing documents with other people.

If you create one on a server we operate — whether through this website or in the application — we are the controller for the following.

6.1 What cannot be done yet, and what that means for you

Stated here because it affects your rights in practice, not only your convenience:

• There is no password reset. The server sends no email, so there is no link to send. Recovering a forgotten password means contacting us and satisfying us by other means that the account is yours.
• Email addresses are not verified, for the same reason. An address is treated as a username rather than as a proven contact point.
• You cannot delete your account from the website yet. Write to hello@studioheino.com and it will be done. Your right to erasure under Article 17 does not depend on a button existing, and a request by email is answered within the deadline in section 16 regardless.

These are gaps in the software, they are being closed, and this page will change when they are.

7. Documents and media you share

When you publish a page to one of our servers, we store the document, every change made to it, and any images, video or 3D files attached to it — along with who may open it and in what role. This is the content of your work.

7.1 It is not end-to-end encrypted

Documents are stored in a form the server can read. This is a property of the design, stated in the protocol specification rather than glossed over. In practice it means an administrator — us, for our servers — is technically capable of reading the documents stored on them.

Access is restricted to what is necessary to operate and maintain the service, and we do not read customer documents in the ordinary course of running it. But the honest description of that guarantee is organisational, not cryptographic: it rests on our policies and our staff, not on mathematics.

If that is not an acceptable basis for your data, run your own server. Tessera is built so that doing so is a normal, supported thing rather than a workaround, and section 10 explains exactly what changes when you do.

7.2 What we do not do with it

• We do not sell, rent, or share your documents or personal data with anyone.
• We do not use your documents to train machine-learning models.
• We do not scan them for advertising, profiling or product analytics.
• We do not disclose them except where legally compelled — see section 14.

7.3 Deleting your data

Ask at hello@studioheino.com and your account, its sessions and the documents of which you are sole owner will be deleted. Documents shared with other people, and changes you contributed to documents owned by somebody else, need handling differently — we will tell you what applies before doing anything irreversible. Backups are overwritten on their own cycle, so a copy may persist in a backup for the period given in section 13 after deletion from the live system.

Deleting a page in the application removes it from the server too. Your local copy is yours and is unaffected.

8. The Tessera application

With no server configured, the application sends us nothing. No telemetry, no usage reporting, no crash reporting, no automatic update check, no licence validation call. It makes no outbound network connection at all. You can verify that with a firewall rather than taking our word for it.

Your notes, boards, images and settings are stored on your computer, in your user profile. Data that stays there never reaches us, and we are not a controller or processor in respect of it.

Once you sign in to a server, the application stores one credential locally — a refresh token, encrypted with the operating system's data-protection facility and bound to your user account on that machine. Your password is never stored.

9. The server-check tool

The “Sharing & servers” page has a tool that reads the public discovery document of a server you name. If you use it:

• the address you submit is used for one request, to one fixed path, and then discarded;
• only the origin — scheme, host and port, reconstructed from the parsed address — is written to the request log; the text as you typed it is not;
• the result is shown to you and is not stored, cached or shared;
• the server you name sees a request from this website's address, not yours, and is told nothing about you.

If the address is itself personal data, the legal basis is your consent under Article 6(1)(a), given by submitting the form. You can decline by not using the tool.

10. Servers you run yourself

If you connect the application to a server we do not operate — one you run, or one run by your employer or a third party — then we receive nothing at all. Your account, your documents and your uploaded media exist on that server. We have no access to it, no visibility of it, and no relationship with whoever runs it. We are neither controller nor processor for that data, because it never reaches us.

If you run a server that other people use, then in respect of their personal data you are the controller, and the obligations of the GDPR or your local equivalent fall on you: your own privacy notice, your own legal basis, your own retention schedule, your own handling of data-subject requests. Software that makes it easy to do that correctly is not the same as software that does it for you.

11. Payments

If you subscribe to a paid plan, payment is taken by a payment provider on a page they host.

We never see your card details. There is no card field anywhere on this site, and a card number never reaches our servers, our logs or our backups. That is a deliberate design choice rather than a limitation: the provider's hosted page is what keeps card data out of our systems entirely.

From them we receive back only what is needed to run the subscription: a customer and subscription identifier, the plan, the status, the last four digits and brand of the card, the billing country used for tax, and the invoices. We do not receive the full card number.

Each provider processes your data under their own privacy policy as well as this one, and both are outside our control in that respect. Records of a payment are kept for as long as accounting and tax law requires, which is longer than the rest of your account data and is a legal obligation rather than a choice — state the retention period your jurisdiction requires; in Finland the Accounting Act generally means six years from the end of the accounting year.

12. Legal bases

Where we rely on legitimate interests you have the right to object; see section 14. A balancing assessment has been carried out for each and can be summarised on request.

13. How long data is kept

14. Who else sees it

Personal data is not sold, rented or exchanged. It is disclosed only to:

• Our hosting and infrastructure providers, acting as processors under Article 28 contracts: name your hosting provider, and your CDN or reverse-proxy provider if you use one — for example Cloudflare, which terminates TLS and can therefore see request content in the clear.
• Our payment providers, as set out in section 11, and only when you buy something.
• A public authority, where we are legally obliged to disclose. We will tell you unless we are prohibited from doing so.

Worth stating explicitly: if a proxy or CDN sits in front of a collaboration server, that provider terminates TLS and is technically able to read document content in transit. That is one more party than the server alone, and if it matters to you it is another argument for running your own server without one.

15. International transfers

Our infrastructure is located in state the country or region — e.g. the European Economic Area. Where a processor transfers personal data outside the EEA, that transfer is made under the European Commission's Standard Contractual Clauses (Implementing Decision (EU) 2021/914), or to a country covered by an adequacy decision, together with any supplementary measures the transfer requires. A copy of the safeguards used is available on request.

16. Your rights

If the GDPR applies to you, you have the right to:

• access the personal data we hold about you, and receive a copy (Article 15);
• rectify data that is inaccurate or incomplete (Article 16);
• erase data — “the right to be forgotten” (Article 17);
• restrict processing while a dispute is resolved (Article 18);
• data portability — receive the data you gave us in a structured, commonly used, machine-readable format (Article 20). Tessera makes this unusually easy: your pages are already plain files on your own disk, and the application exports to Markdown, HTML, PDF, PNG and SVG without involving us at all;
• object to processing based on legitimate interests (Article 21);
• withdraw consent at any time where consent is the basis, without affecting the lawfulness of processing before withdrawal.

Write to hello@studioheino.com. We respond within one month, extendable by two further months for complex requests, in which case we will tell you within the first month. There is no charge unless a request is manifestly unfounded or excessive.

You may also complain to a supervisory authority — in the EU or EEA state where you live or work, or where the alleged infringement took place. Our lead supervisory authority is the Office of the Data Protection Ombudsman in Finland (Tietosuojavaltuutetun toimisto — confirm this is correct for your establishment; the lead authority is the one where your main establishment is). You do not have to contact us first, though we would rather you did.

17. United Kingdom

If you are in the United Kingdom, the UK GDPR and the Data Protection Act 2018 apply and give you the same rights as section 14. Your supervisory authority is the Information Commissioner's Office, ico.org.uk. Transfers of UK personal data outside the UK are made under the International Data Transfer Agreement or the UK Addendum to the Standard Contractual Clauses.

18. United States

If you are a resident of California, Colorado, Connecticut, Virginia or another US state with a comprehensive privacy law, the following applies in addition to the above.

• We do not sell your personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined in the California Consumer Privacy Act as amended by the CPRA. We never have. There is therefore no “Do Not Sell or Share My Personal Information” link, because there is nothing for it to switch off.
• We do not collect or process sensitive personal information to infer characteristics about you, and we do not use the contents of your documents for any purpose other than storing and delivering them to the people you shared them with.
• You may request to know what personal information we have collected, to have it deleted, and to have it corrected. Categories are set out in sections 3, 6 and 7; purposes in section 12.
• You will not be discriminated against for exercising any of these rights.
• Requests go to hello@studioheino.com. We verify a request by asking you to confirm it from the email address on the account. An authorised agent may act for you with written permission.

19. Children

Neither this website nor Tessera is directed at children, and we do not knowingly collect personal data from a child under 16 — or under the lower age set by a member state under Article 8(1) of the GDPR, which in Finland is 13. If you believe a child has provided personal data to us, write to hello@studioheino.com and it will be deleted.

20. Security

Article 32 requires measures appropriate to the risk. Ours include: TLS everywhere, with the software refusing to start on a cleartext public address; Argon2id password hashing; short-lived access tokens with rotating single-use refresh tokens and replay detection; authorisation checked on every request rather than only at sign-in; a website that never places a token in your browser and serves no JavaScript at all; rate limiting; content security policies that permit no scripts and no third-party resources; containers running as a non-root user with a read-only filesystem and no Linux capabilities; and logs that exclude query strings and credentials by design.

The security page describes this in more detail, including the parts that are not built. If you believe you have found a vulnerability, that page tells you how to report it.

Where a personal-data breach is likely to result in a risk to your rights and freedoms, it will be reported to the supervisory authority within 72 hours of our becoming aware of it, and to you without undue delay where the risk is high.

21. Changes

This policy changes when what it describes changes. The date at the top is the current version. Where a change materially affects how your personal data is handled we will say so prominently before it takes effect, and — if you have an account — the change will not be applied retroactively to processing already carried out.

22. Contact

Studio Heino
Lipunkantajankatu 7 C 37
hello@studioheino.com