Privacy policy

Last updated 11 November 2026

1. Who we are

Tessera Fit is a registered business name of Jacob Sullivan, a sole trader based in Sydney, Australia (ABN 73 141 573 448). In this policy, "Tessera Fit", "we", "us" and "our" mean that business. "You" means anyone who uses the Tessera Fit website or app.

We handle personal information in line with the Australian Privacy Principles in the Privacy Act 1988 (Cth). We do this even where an exemption might otherwise apply to a business of our size, because the information our users trust us with includes health information.

2. What this policy covers

This policy covers the website at tesserafit.app (and the other Tessera Fit domains that redirect to it), the Tessera Fit app, and any email you exchange with us. It explains what we collect, why, who we share it with, and the choices you have.

Services you connect to Tessera Fit, such as Garmin Connect, Hevy and Apple Health, have their own privacy policies. Those policies govern how those companies handle your data.

3. Information we collect

Training and health data counts as "health information", which is a type of sensitive information under Australian privacy law. We only collect it with your consent, and only what we need to show you your training history.

You don't have to give us any of this information. If you don't connect a service or upload a file, Tessera Fit simply won't show that data. We need an email address to create an account or join the waitlist.

4. Connected services

Tessera Fit works by reading data from apps you already use. You decide which ones to connect and which files to upload. Each connection is separate, and you can disconnect any of them at any time from your Tessera Fit settings or from the other service's own settings.

Hevy and Strong

You can bring in Hevy workouts by uploading an export, or, if you have Hevy Pro, by giving us an API key you create in Hevy. We read your workouts, including exercises, sets, reps, weights, RPE and session times. We store an API key in encrypted form and use it only to sync your data. Strong history comes in as a CSV export that you upload.

Apple Health

Apple Health data comes in through an Apple Shortcut that you add to your iPhone and that runs once a day. You choose which data types the Shortcut shares, such as workouts, sleep, heart rate variability, resting heart rate and weight. The Shortcut sends that data straight to Tessera Fit over an encrypted connection using a key unique to your account, which you can revoke at any time. Apple Health data is not used for advertising or marketing, and is not shared with third parties for those purposes.

FIT files and CSV files

You can upload FIT files from devices such as COROS, Suunto and Wahoo, or any other device that saves them, and CSV files you've made yourself. FIT files can include second-by-second heart rate, pace, power, laps and GPS location. We read the file to add it to your training history and keep the original so you can re-process or download it later.

Garmin Connect

See the next section.

5. Garmin Connect

If you connect your Garmin account, you are sent to Garmin to sign in and approve access. Tessera Fit never sees your Garmin password.

When you approve access, your data is transferred between Garmin and Tessera Fit:

• Garmin sends us the data you've allowed us to access. Depending on the permissions you grant, this can include activities, daily summaries, heart rate, heart rate variability, sleep, stress, body composition and other wellness data recorded by your Garmin device.
• We send Garmin the information needed to make and keep the connection, such as the authorisation request and the tokens Garmin issues to us.

Garmin handles your data under its own privacy policy. You can read the Garmin Connect privacy policy on Garmin's website. Tessera Fit is not affiliated with Garmin.

We use Garmin data only to show it to you in Tessera Fit, in line with your consent and Garmin's developer terms. Wherever we show data that came from a Garmin device, we say so. You can disconnect Tessera Fit at any time, either in Tessera Fit or in your Garmin Connect account settings. When you do, we stop receiving your Garmin data and delete the Garmin data we hold as described in section 11.

6. How we use your information

We use your information to:

• create and run your account;
• sync, store and display your training and health data, and calculate the metrics you choose to see, such as training load, trends and personal records;
• remember your dashboard layout and settings;
• reply to your messages and give you support;
• tell you about important changes to Tessera Fit, your account or this policy;
• email you when Tessera Fit opens if you joined the waitlist, and about new features only if you've asked us to. You can opt out at any time;
• keep Tessera Fit secure, prevent misuse, and find and fix errors;
• meet our legal obligations.

We only use your information for the purpose we collected it for, or for a directly related purpose you would reasonably expect, unless you agree otherwise or the law requires or allows it.

Tessera Fit shows information about your training. It is not a medical device and doesn't give medical advice.

7. What we don't do

• We don't sell or rent your personal information.
• We don't use your training or health data for advertising, and we don't share it with advertisers or data brokers.
• We don't use your health data to train artificial intelligence models. If we ever offer features that use AI, we will update this policy and ask for your consent first.
• We don't make your data public or share it with other users.

8. Who we share it with

We share personal information only with service providers that help us run Tessera Fit, and only as much as they need to do that job. They are required to protect it and may not use it for their own purposes. They are:

• Cloudflare, which hosts this website, stores waitlist sign-ups, provides our domain name system and protects our services from attacks;
• Google (Google Workspace), which provides our business email;
• the hosting and database providers that run the Tessera Fit app. We will name them here before the app is available to users.

We may also disclose personal information:

• if you ask us to, or agree to it;
• if we are required or authorised to by law, such as under a court order;
• if it's needed to prevent a serious threat to someone's life, health or safety;
• to a buyer of the business, if Tessera Fit is ever sold. They would have to keep handling your information in line with this policy, and we would tell you before it happened.

9. Storage outside Australia

Some of our service providers store or process data outside Australia, including in the United States. Where we send personal information overseas, we take reasonable steps to make sure the recipient handles it consistently with the Australian Privacy Principles, including by choosing providers with strong security and privacy commitments.

Data you connect from Garmin, Hevy or Apple may already be stored overseas by those companies under their own policies.

10. How we protect it

• All data is encrypted in transit using HTTPS (TLS).
• Health data, access tokens and backups are encrypted at rest.
• Access to personal information is limited to the people who need it to run Tessera Fit, and is protected by multi-factor authentication.
• Access tokens for connected services are used only to sync your data and are deleted when you disconnect.
• We keep our software and providers up to date and review our security practices regularly.

No system is perfectly secure, but we take reasonable steps to protect your information from misuse, interference, loss, and unauthorised access, change or disclosure.

11. How long we keep it

• While your account is open, we keep your training and health data so you can see your full training history.
• When you disconnect a service, we stop collecting data from it straight away, delete its access tokens, and delete the data we received from it within 30 days. You can export your data before you disconnect.
• When you delete your account, we delete your personal information within 30 days. Copies in encrypted backups are deleted when those backups expire, within a further 35 days.
• Waitlist sign-ups are kept until Tessera Fit opens and we've emailed you, or until you ask to be removed. If you don't create an account within 6 months of that email, we delete your sign-up.
• Emails and support messages are kept for up to two years after our last contact with you, unless you ask us to delete them sooner.
• We may keep some information for longer if the law requires it, such as business and tax records.

12. Your choices and rights

You can ask us to:

• give you a copy of the personal information we hold about you, including an export of your training data in a common format;
• correct information that is wrong, out of date or incomplete;
• delete some or all of your information;
• remove you from the waitlist or stop sending you emails about new features.

Email privacy@tesserafit.app from the address linked to your account. We will respond within 30 days and won't charge you. If we can't do what you ask, we'll tell you why in writing and how you can complain.

If you live outside Australia, such as in the European Union or the United Kingdom, you may have extra rights under your local law, such as the right to object to or restrict how we use your information. Contact us and we will honour those rights.

13. This website

This website doesn't use advertising or tracking cookies, and it doesn't use third-party analytics. Fonts, scripts and files are served from our own domain. The small amount of JavaScript on the site only runs the animations, the example dashboard and the waitlist form, and doesn't track you.

Cloudflare, which delivers the website, processes your IP address and basic request details to deliver pages and protect the site from attacks, and may set strictly necessary security cookies to do that.

When you join the waitlist, we store your email address, which form you used and the time, as described above. When you email us, we keep your email address and message so we can reply.

14. Age requirement

Tessera Fit is for people aged 16 and over. We don't knowingly collect personal information from anyone under 16. If you think someone under 16 has given us their information, contact us and we will delete it.

15. Data breaches

If a data breach is likely to result in serious harm to you, we will notify you and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme. We will also notify any connected service, such as Garmin, as required by our agreements with them.

16. Changes to this policy

We may update this policy as Tessera Fit changes. The date at the top shows when it was last updated. If we make a significant change, such as collecting a new type of data or using it in a new way, we will tell you by email or in the app before the change takes effect, and ask for your consent where the law requires it.

17. Contact and complaints

For privacy questions, requests or complaints, email privacy@tesserafit.app. We aim to respond within 30 days.

If you're not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au or on 1300 363 992.