Privacy

Last updated September 26, 2026. tesserai is a product of Mirical LLC, a New York limited liability company (“we”). Questions: andrew@mirical.co.

What we keep, and why

• Your account: email address, and your name and picture if you sign in with Google or GitHub. To sign you in and show who did what.
• What you make: design systems, pages, versions, releases, comments, proposals, the changelog, and font files you upload. To keep and show them to you and to the people you share them with.
• Imports: when you run npx @tesserai/cli import (or your coding agent does), your project's code stays on your machine. Only the resulting system and its report (the values found, with the file and line each came from) are sent, kept for at most ten minutes until the link opens it once, then deleted. It becomes a system like any other.
• Scans: when you run npx @tesserai/cli scan --upload (or your coding agent does), your code stays on your machine. What's sent is counts and names: how often each component and option is used, what kinds of style each component is given (and the class names that do it), which components and options are never used, and the paths of generated component files edited by hand. It's kept with the system, for its members to see under Usage, the newest 200 per system; deleting the system deletes them.
• AI requests: what you ask, the parts of your system the model needs to answer (including measurements of how the preview draws what you point at), and how many tokens each request used. To answer, and to keep to the monthly allowance and spending caps.
• Billing: your plan and subscription status. Card details go to Stripe and never reach us.
• Errors and logs: error reports from your browser (the message and the page), and request logs (address, time, path). To fix problems and stop abuse. Logs are kept for up to 30 days.
• How the product is used: pages visited, what's clicked, and moments like creating a system, asking the AI, copying an install command, or starting a subscription; and recordings of sessions in the builder, with everything typed hidden and emails, names and comments blanked. To see what works and what gets in the way. A visit is tied together by a random id kept for as long as the tab is open; signed in, it's also tied to your account's id (never your email). PostHog uses your address to estimate your country and city.

Systems kept “in this browser” stay on your device and never reach us unless you save them to your account.

Cookies and storage

• A session cookie keeps you signed in.
• Your browser's storage keeps systems you haven't saved to an account, and recent settings.
• Product analytics keep a random id in the tab's session storage, removed when you close the tab.

We don't use advertising or tracking cookies.

Who processes it for us

• Cloudflare: hosting, the database and file storage, logs, the emails that carry sign-in links, and Web Analytics, which counts page views without cookies or anything that identifies you.
• PostHog (United States): product analytics and session recordings, as described above. Its requests go through our own address, and your cookies never reach it.
• OpenAI: the model that answers most AI requests. Anthropic: the model that answers when OpenAI is busy. Both receive what's needed to answer (see AI requests above) and, by their terms, don't train their models on it by default.
• TypeSafe: decides quickly whether a request is a simple edit it can make directly, and which model should answer the rest; it receives the request's words.
• Stripe: payments and billing.
• Google and GitHub: signing in, if you choose them.
• Google Fonts and Iconify: fonts shown in the preview and icon search, which receive the font or search term and your address.

These providers process information in the United States and other countries where they operate.

Sharing

What you make is shared only with the people you share it with: team members, and anyone with a link you turn on. We don't sell personal information, and we don't share it for advertising.

Keeping and deleting

We keep your account and what you make while the account is open. Deleting a system deletes it with its versions and comments. Deleting your account deletes everything in it right away (a paid plan is cancelled first); copies in our database's backups are gone within 30 days. Records we must keep for tax and accounting stay with Stripe. Download everything in one file at any time from the Systems menu.

Your rights

Wherever you live, you can ask us to show you, correct, export or delete your information, and you can delete your account yourself at any time. Write to andrew@mirical.co; we'll answer within 30 days.

In the EU, the UK and similar places: we use your information to provide the service you signed up for (your account, what you make, billing and AI requests), and for our legitimate interests in keeping it secure and improving it (logs, error reports and product analytics). You can object to the latter, and you can complain to your data protection authority.

In California: we don't sell or share personal information as the CCPA defines those, and you won't be treated differently for using your rights.

Children

tesserai isn't for children under 13, or older where the law of your country sets a higher age.

Changes

If this changes in a way that matters, we'll tell you by email or in the app before it takes effect.