Tessin Privacy Policy

TRASIMENE SAS, 61 rue de Lyon, 75012 Paris: contact@trasimene.com. In accordance with Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act (loi Informatique et Libertés), you have rights over your personal data. The data protection contact can be reached at the same email address.

User account: email address, name, hashed password (bcrypt, not readable by TRASIMENE SAS) or, if you sign in with Google or Apple, the identifier that this service sends us; registration date, unique identifier, the account's app (Tessin), language, newsletter preference, profile photo if you add one. When you sign in and when the app is opened, our servers record the platform, the app version, the phone model and, on Android, the store that installed the app; they infer the account's country from your IP address once only, using a geolocation database installed on our servers, without keeping the address. As an account is signed in on only one device at a time, our servers keep an identifier of this device: on iPhone, an identifier generated at random by the app; on Android, a hash computed from the Android identifier and the name of the app, different for each of our apps.

Account security and logs: our servers keep a security history of your account (sign-up, successful or refused sign-ins, sign-out, password reset: date, IP address, browser or app). Like any online service, they also keep technical logs: for each request, the IP address, the time, the address requested and, in the logs of the Google Cloud platform, the browser or app. On Android, at sign-up and at sign-in, the app attaches a Google Play Integrity token, verified with Google, which attests that the app and the device are genuine.

Vault: you store in your vault passwords (label, username, email address, password, site or app concerned, notes), notes (title and content), photos and documents. The app sends them to our servers over an encrypted connection (HTTPS). Your passwords, the notes attached to them, the content of your notes and your files are encrypted on our servers with AES-256-GCM, using a key unique to your account, randomly generated and held in Google Secret Manager, never sent to your phone. This encryption is performed by our servers, which hold the key: this is what lets you open your vault on your phone and on trasimene.com, share an item by link, export your vault and be warned if one of your passwords appears in a breach. Our servers decrypt your items in memory, just long enough to display them to you, fill in a form, check for breaches, serve a share link or prepare an export. Access to these keys is restricted to the systems of TRASIMENE SAS and to authorised staff, and no administration function gives access to the content of your vault. For instant search and display, the labels, usernames, email addresses, sites and apps of your entries, the titles of your notes, the names, types and sizes of your files, a hash (SHA-256) of each file used to verify its integrity and the result of the breach check are stored without this key, protected like all our data by Google Cloud encryption. We never sell or share the content of your vault.

On your phone, the content of the vault is not stored permanently: it is kept in memory during use and removed when the vault locks. On iPhone, a document you open is temporarily copied into a protected file, erased when it is closed. If you export a photo or a document from the app, an unencrypted copy is saved on your phone: on iPhone, where you choose; on Android, in the Downloads folder. The vault opens with the phone's biometrics (fingerprint, face) or, failing that, with its lock code; biometrics are verified by the phone and we have no access to them. On Android, if your phone has neither biometrics nor a lock code, the app asks you for the password of your Tessin account, verified by our servers; for an account created with Google or Apple, which has no password, you are then asked to set up a screen lock. The vault locks again after 5 minutes of inactivity. On Android, the vault screens can be neither captured nor recorded.

Vault export: from your Tessin account area on trasimene.com, you can export your entire vault: your passwords and your notes in a CSV or JSON file, as well as your photos and documents. Before the export, the website asks you to confirm your identity (the password of your account or, for a Google or Apple account, a recent sign-in). The export is prepared by our servers, which decrypt your items in memory; the resulting file is not encrypted: keep it in a safe place. Export remains possible during the 30 days following the end of a subscription (see Article 04).

Autofill: if you turn it on in the phone's settings, Tessin suggests your credentials in other apps and on websites, and can save those you enter there. It is reserved for subscribers; during the 30 days following the end of a subscription, it continues to fill in your credentials but no longer saves any.

• To fill in a form, Tessin reads, in the screen displayed, the hints of the fields (username, password), the name of the app or the address of the site. After you authenticate (the phone's biometrics or, failing that, the password of your Tessin account, verified by our servers), it sends our servers the name of the site or the identifier of the app, to find the matching credentials. An app entry is offered only to that same app, a site entry only to that same site.
• To suggest a credential to you, the phone's system may display the saved username before you authenticate; the password is only provided afterwards.
• To save, after you authenticate and confirm, Tessin sends our servers the site or app, the username and the password entered.
• On Android, when an app that is not a browser requests the credentials of a site, our servers check with Google (Digital Asset Links) that this site officially declares this app. Google receives the name of the site, the identifier of the app and the fingerprint of its certificate, without any data from your account; the result is kept for 24 hours on the phone.
• On Android, Tessin also reads a Chrome setting to tell you whether filling by Tessin is active there; nothing from it is sent. It does not log apps or sites on your phone.
• On iPhone, the system keeps the list of the sites and usernames in your vault, never the passwords, to suggest them to you above the keyboard; this list is erased on sign-out, on account deletion and when your access ends.
• On iPhone, the Tessin extension for Safari, if you turn it on, runs on the pages you visit. When you submit a sign-in form, it keeps in memory on the phone, for 5 minutes, the username, the password and the site concerned, to offer to save them. They go to our servers only if you tap “Save”, after Face ID, Touch ID or the phone's passcode; the entry then keeps only the address of the site (for example https://exemple.fr), without the rest of the page's address. When you open the extension, it sends, after the same verification, the name of the site in the open tab to suggest the matching credentials to you.

Sharing by link: you can create a link to a password, a note or a file in your vault. Anyone who has the link can open the item, without an account and with no time limit, until you revoke the link or delete the item: our servers then decrypt it with your account's key to display it to that person. For a password, the link shows the password, the username, the site and the attached notes. The link is shown to you only once; we keep only a hash of it, together with the item concerned, a copy of its label or of the file name, the number of openings and the date of the last opening. A revoked link no longer opens but remains in this history until your account is deleted or the content of your vault is erased. When a link reaches 25 openings, you are informed of it in the app and by a notification.

Breach alert: as long as you are a subscriber, our servers check every week, and each time a password is saved or modified, whether your passwords appear in known data breaches, with the public Pwned Passwords service (Have I Been Pwned). The password is decrypted in memory, our servers compute a hash of it (SHA-1) and send only the first 5 characters of this hash: the service returns the list of hashes that begin with these characters, padded with fake entries, and the comparison is made on our servers. Neither your password, nor its full hash, nor your email address is sent to the service. Only the number of occurrences found and the date of the check are kept for each password. The weekly check covers the 200 most recently modified passwords in your vault; the others are marked as “not checked”. If a password is found in a breach, you are informed by a notification and by an email sent to the address of your account, at most once every 24 hours.

Password generator: the suggested passwords are created on your phone; our servers provide only the rules of the generator (length, character types). A password you copy from Tessin is erased from the clipboard after one minute.

Notifications: the app offers you once to allow notifications. Our servers record your device's notification token (Firebase on Android, Apple and Firebase on iPhone) with its identifier, and use it to send you Tessin messages: breach alerts, a share link opened many times, upcoming erasure of the vault, subscription, account, and information about Tessin. Notifications you have not allowed are not displayed; you can turn them off at any time in the phone's settings. The messages displayed in the app are kept for 7 days.

Emails: we write to you, on behalf of Tessin, to confirm your address, reset your password, alert you to a breach, warn you of the upcoming erasure of your vault, confirm a subscription taken out on trasimene.com or your withdrawal, confirm the deletion of your account, warn you before the deletion of an account that has remained inactive and, every year, remind you of the renewal of your subscription. These emails are sent by our provider Resend.

Newsletter: there is only one newsletter, that of the Trasimène team (news and tips), shared by all our apps. At sign-up, in the app as on trasimene.com, the “Newsletter” box is ticked; you can untick it, and unsubscribe at any time in your account settings (app or trasimene.com) or via the link in each mailing. Your address and, if you subscribe from your account, your name are on our mailing list at Resend.

Usage measurement in the app: to learn which screens are used and improve the app, it sends Firebase Analytics (Google) the screens displayed, the steps of the journey (sign-up, sign-in, permission requests, subscription screen, purchase, account deletion) and steps in the use of the vault (type of item saved, password generated and, on Android, autofill used in an app or on a site, without their name), with the phone model and the system version. Firebase Analytics links them to your account identifier and, on Android, to the device identifier described above. On Android, sign-up is also reported to it, which can be used to measure our Google Ads campaigns. The content of your vault is never part of it. This measurement is on from installation; you can turn it off at any time in the app, “My Account” tab, then your profile, “Usage analytics” switch. The app does not ask for tracking permission on iPhone and turns off collection of the advertising identifier on Android.

Internal measurement: the app also sends directly to our servers, on first opening, on opening (once a day on Android, each time it returns to the foreground on iPhone) and each time certain vault functions are used (opening, unlocking, copying a password, autofill, generating a password), the event type, an identifier of the device, the app and system version, the model, the language and the date, without any vault content; our servers infer the country from the IP address, with the same geolocation database, without keeping the address, and link these events to your account once you are signed in. Our servers also count, on your account, the views of a password, a note or a file (the type of action only). Finally, they record on your account the uninstallation of the app when the notification service or Firebase reports it to them. This internal measurement does not depend on the “Usage analytics” setting.

Error reports: in the event of a crash or error, the app sends a report to Firebase Crashlytics (Google), to Sentry and, at the launch following a crash, to our servers: error trace, screen displayed, model, versions, device identifier, without your name or your email address. These reports do not depend on any setting, because they are used to fix failures.

Installation source: on first launch, the app sends our servers the source of its installation, so that we know which campaign or website led you to Tessin. On iPhone, this is an attribution token provided by Apple (AdServices): our servers exchange it with Apple for the Apple Search Ads campaign, ad group, keyword and country, when the installation comes from one of these ads. This Apple service asks for no tracking permission. On Android, it is the install referrer provided by Google Play (source, campaign and, if there is one, click identifier), also sent again at sign-up. This source is recorded with the device's first-opening event, which is erased after 13 months, and copied to your account, where it is erased together with the account.

Exit surveys: if you state why you are cancelling your subscription or deleting your account, your answers (reasons chosen, optional comment, platform) are kept with your account and erased with it.

Support: if you write to support from the app or from your Tessin account area on trasimene.com, we receive your name, your email address, the subject, your message and the attachments you add (two at most, 5 MB each), as well as technical information (device identifier, platform, model, system version, app version, time zone and, on Android, security patch level). Your message reaches us by email, together with a record that our servers compile from your account (subscription, account, device, previous requests); the request (name, email address, subject, message, platform, app version) is kept for follow-up. Without a signed-in account, you write to us directly at contact@trasimene.com.

Payment: no card data is stored by TRASIMENE SAS. A subscription purchased on the App Store or on Google Play is managed by Apple or Google; a subscription purchased on trasimene.com is managed by RevenueCat and paid by card through Stripe, without your card data passing through our servers. RevenueCat receives your Tessin account identifier to link the subscription to your account, and sends us the events of your subscription (purchase, renewal, cancellation, expiry, amount). The history of your payments (date, plan, price, store used) is kept after your account is deleted (see Article 04).

On-device access: on Android, Internet and network state, notifications, biometrics, Google Play purchases, the autofill service and Credential Manager (which you turn on in the settings), and reading a Chrome setting. On iPhone, notifications, Face ID or Touch ID, adding images to your photos (for the images you export), the autofill extension and the Safari extension (which you turn on in the settings). Photos and documents are added to the vault through the system picker, which gives access only to the items you choose. Tessin does not ask for location, the list of your apps, or access to your contacts, your camera, your microphone or your notifications. This data is never sold.

If someone has sent you a link to an item in their Tessin vault, the page opens without an account. The content remains hidden until you ask for it to be displayed; each display or download increases the number of openings visible to the person who created the link. As for any visit, your IP address and your browser appear in our technical logs for 30 days. The page uses the cookies described in the privacy policy of the trasimene.com website: analytics and marketing cookies only with your consent, and the code of the link is removed from the addresses sent to our measurement tools. Legal basis: our legitimate interest in ensuring the security of the service. You can exercise your rights by writing to contact@trasimene.com.

• Contract performance (Art. 6.1.b GDPR): user account, storage and encryption of the vault, export, autofill, sharing by link, breach alert, generator, subscription management, 30-day access after it ends and advance notice before erasure, service notifications and emails, support.
• Consent (Art. 6.1.a GDPR): analytics and marketing cookies of the trasimene.com website (see Article 06).
• Legitimate interests (Art. 6.1.f GDPR): platform security and fraud prevention (security history, technical logs, Play Integrity, Digital Asset Links verification, identifiers of banned accounts), error reports (Firebase Crashlytics, Sentry), usage measurement of the app (can be refused with the “Usage analytics” switch), internal measurement, installation source, exit surveys; for people who open a share link, security of the service.
• Direct marketing to our customers (Article L34-5 of the French Postal and Electronic Communications Code; legitimate interests, Art. 6.1.f GDPR): sending of the newsletter, which presents services similar to those you use. You can refuse it at sign-up by unticking the box, then at any time via the link in each mailing or in your account settings.
• Legal obligation (Art. 6.1.c GDPR): retention of your payment history, including after your account is deleted, for 10 years, the retention period for accounting records (Article L123-22 of the French Commercial Code).

• Account: for as long as you do not delete it. An account with no sign-in at all for 3 years is deleted; an email notifies you 30 days beforehand.
• Vault during the subscription: for as long as the subscription runs.
• Vault after the subscription ends: for 30 days, you keep access to your vault, on your phone and on trasimene.com, to read and copy your items, export it from trasimene.com, download your photos and documents, delete them and cut off your share links; your links remain open to their recipients during this period. At least 7 days before erasure, we notify you by email, as well as by a notification. The content of the vault (passwords, notes, photos, documents, share links) is then permanently erased. It is never erased unless this email has been sent: if the email is sent late, the erasure date is postponed accordingly. Your account itself is not deleted; if you subscribe again before erasure, nothing is erased.
• Share links: open until they are revoked, the item is deleted, the account is deleted or the vault is erased; their history, until the account is deleted or the vault is erased.
• Breach check results: replaced at each check, erased when the password changes or drops out of the 200 checked, and with the vault.
• Account security history: 7 days.
• Technical logs: 30 rolling days.
• Internal measurement and crash reports sent to our servers: 13 months at most, including events sent before any sign-in to an account; view counters: 35 days.
• Messages displayed in the app: 7 days.
• Support requests: 3 years after the last exchange, including after the account is deleted.
• Exit surveys and installation source copied to the account: until the account is erased.
• Payment history: 10 years, including after the account is deleted.
• Ban: in the event of a ban for breach of the terms of use, the identifiers that make it possible to enforce it (email address, account identifier, Google or Apple identifier, device identifier) are kept for 5 years, even after the account is deleted.
• Newsletter: until you unsubscribe; we then keep a record of the unsubscription, so as not to write to you again, until your account is deleted.
• Account deletion: see Article 12.

TRASIMENE SAS uses the following providers, which process data on its behalf and are bound by a GDPR-compliant data processing agreement:

• Google Cloud: hosting of the API, the database and the encrypted vault files (Cloud Storage) in region europe-west1 (Belgium, EU); vault keys in Secret Manager, encrypted and automatically replicated by Google to stay available; technical logs (Cloud Logging), https://cloud.google.com/security/compliance/gdpr
• Firebase (Google LLC): Cloud Messaging for notifications (device token, title and text of the notifications sent), Analytics for usage measurement and Crashlytics for crash reports, https://firebase.google.com/support/privacy
• Sentry (Functional Software Inc.): error reports from the apps, the website and the API; servers in the European Union for the apps and the website, https://sentry.io/privacy
• RevenueCat Inc.: management of subscriptions taken on the App Store, Google Play and trasimene.com (account identifier, purchases, subscription status), https://www.revenuecat.com/privacy
• Stripe Inc.: card payment on trasimene.com, via RevenueCat; card details are entered at Stripe and never pass through our servers, https://stripe.com/privacy
• Resend Inc.: sending of our emails (address confirmation, alerts, notice before vault erasure, subscription, newsletter), https://resend.com/legal/privacy-policy
• Infomaniak Network SA (Switzerland): mailbox of contact@trasimene.com, where your messages to support arrive, https://www.infomaniak.com/fr/cgv/politique-de-confidentialite
• Have I Been Pwned (Troy Hunt, Australia), Pwned Passwords service: receives the first 5 characters of the SHA-1 hash of your passwords, nothing else; the password never leaves our servers, https://haveibeenpwned.com/Privacy

Recipients that process data on their own behalf, as part of the service:

• Apple Inc.: App Store, notifications on iPhone (APNs), Apple sign-in and attribution of installations from Apple Search Ads (AdServices), https://www.apple.com/legal/privacy
• Google LLC: Google Play, Google sign-in, Play Integrity (which proves to our servers that the Android device and app are genuine), Google Play install referrer and Digital Asset Links (see “Autofill”), https://policies.google.com/privacy
• the people to whom you send a share link.

The Tessin app does not use cookies. The Tessin pages on trasimene.com (presentation, purchase, Tessin account area, online vault, share link page) use the cookies described in the privacy policy of the trasimene.com website: essential cookies without consent, analytics and marketing cookies with consent, which you can manage at any time via the “Manage cookies” button at the bottom of the page.

Under Articles 15 to 22 of the GDPR, you have the following rights:

Right of access (Art. 15) · Right to rectification (Art. 16) · Right to erasure (Art. 17) · Right to data portability (Art. 20) · Right to object (Art. 21) · Right to restriction of processing (Art. 18) · Right to withdraw your consent at any time.

To exercise your rights: contact@trasimene.com, or support in your signed-in area (app or https://trasimene.com/apps/tessin/support), response within 30 days. Proof of identity may be requested. State the app concerned (Tessin) and the email address of the account: any accounts you may have in our other apps are separate accounts. To retrieve the content of your vault yourself, use the export in your Tessin account area on trasimene.com (see “Vault export”).

If you believe that the processing of your data does not comply with the regulations, you have the right to lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL): 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, https://www.cnil.fr

Your account data and the encrypted content of your vault are hosted in the European Union (Google Cloud, Belgium). The vault keys are held in Google Secret Manager, which encrypts them and automatically replicates them across several Google Cloud regions so that they remain available, including outside the Union. The technical logs of our servers are kept by Google Cloud with no commitment as to region. Some providers process data outside the Union: Have I Been Pwned in Australia; Sentry (a US company, with app and website data stored in the Union), RevenueCat, Stripe, Resend, Google (Firebase, Play Integrity, Google sign-in, Digital Asset Links) and Apple (notifications, Apple sign-in, Apple Search Ads attribution) in the United States. Infomaniak processes data in Switzerland, a country recognised by the European Commission as offering equivalent protection. These transfers are governed by standard contractual clauses approved by the European Commission, by the EU-US Data Privacy Framework where the provider is certified under it, or by an adequacy decision.

Access to the service is restricted to adults; minors must obtain the express consent of the holder of parental authority (see the Terms of Service). In accordance with Article 45 of the French Data Protection Act (loi Informatique et Libertés), a minor under 15 years of age cannot consent alone to the processing of their personal data: the joint consent of the minor and the holder of parental authority is required. The holder of parental authority may exercise GDPR rights on behalf of the minor by writing to contact@trasimene.com.

In accordance with Article 85 of the French Data Protection Act (loi Informatique et Libertés), you may set directives regarding the retention, erasure and disclosure of your personal data after your death, and modify them at any time by writing to contact@trasimene.com. In the absence of directives, your heirs may exercise certain rights under the conditions provided by law. The content of your vault is not handed over to anyone without a directive from you; on presentation of supporting documents, your heirs may have your account deleted.

You can delete your Tessin account from your profile or from the subscription screen, in the app, or on trasimene.com, in the settings of your Tessin account area; the steps to follow are set out on the page https://trasimene.com/apps/tessin/delete-account. Deletion concerns only your Tessin account. Remember to export your vault before deleting your account: as soon as you confirm, you no longer have access to it.

As soon as you make the request, your access is cut off: you are signed out on all your devices and no one can sign in to your account any more; your share links stop opening; your notification tokens are removed; your newsletter subscription is removed, unless another of your accounts with us is subscribed to it. We confirm the deletion to you by email, with the date of permanent erasure.

Nothing else is erased for 30 days. At the end of these 30 days, everything that belongs to your account is erased: the content of your vault (passwords, notes, photos, documents) and its encryption key, your share links, your profile photo, your security history, your preferences, the usage measurement and error reports linked to your account, then the account record itself. The following are still kept, as stated in Article 04: your payment history (10 years), the messages you sent to support (3 years after the last exchange) and, in the event of a ban, the identifiers that make it possible to enforce it (5 years). Internal measurement events that are not linked to your account, such as the first opening of the app, are erased after 13 months.

Deleting your account does not stop a subscription taken on the App Store or on trasimene.com: cancel it first where you took it (see the page https://trasimene.com/apps/tessin/delete-account). For a Google Play subscription, we also ask Google to cancel it at the time of deletion; check afterwards that the cancellation does appear in Google Play.