Tesserarius privacy policy

Last updated: 8 November 2026

Tesserarius is an iPhone and Android app that keeps shop loyalty cards in a leather card holder drawn on the screen, and shows the barcode at the till.

In short

• Your cards stay on your phone. There is no account and there are no servers of ours.
• The camera is used only to read a card's code or to photograph it; the images never leave the phone.
• The app downloads a public shop catalogue, the same for everyone, and, if you leave them on, the shops' logos.
• After the first few days it shows one small Google AdMob banner at the bottom of the card holder, with non-personalised ads only. Google's code that shows it collects some data on its own, described under "Ads". With "Remove ads" the banner is gone.
• We receive no data about you.

Who is responsible

The app is made and published by Ivo Junior Bettini, an independent developer. Contact: ivojuniorbettini@gmail.com

Tesserarius is not affiliated with, endorsed or sponsored by the shops whose cards it holds. All trademarks and logos belong to their respective owners.

What stays on your phone

• Your cards: the shop, the number and the type of code, the colour, the name you give the card, and the card's photo or the picture you choose, if you add one.
• Your settings: the holder's material, the order of the cards, the initials, the logo switch, and how often you have used the holder and each card (for the order and the look of the leather).
• A copy of the shop catalogue and, for at most 30 days, the downloaded logos.
• For ads: the date of the first launch, whether you bought "Remove ads", your consent choice, which Google's code saves in the app's storage, and what Google's code keeps for itself to show the banner.

They live in the app's storage, which other apps cannot read, and in your phone's backups (iCloud or a computer on iPhone, Google on Android) if you have them on. We never receive them. A card is deleted in the app; uninstalling the app deletes everything.

Camera and photos

• Camera: the app asks for it only when you choose to scan a card's code or photograph a card. The images are analysed on the phone (on Android with Google Play services components that work on the device) and are sent to no one.
• Photos: the app sees only the picture you pick from your library, through the system picker; it has no access to your other photos.

The app does not ask for location, contacts, microphone, calendar or notifications.

Internet connections

• The shop catalogue. At most once a day the app downloads the public file https://ivemberg.github.io/tesserarius-catalogue/brands.json, hosted by GitHub Pages: names, colours and domains of shops, the same for everyone. The request contains none of your cards and no app or device identifier; the app identifies itself only by name, version and platform ("Tesserarius/1.0 (iOS)" or "(Android)"). As for any web page, GitHub sees the IP address the request comes from, under its own policy: https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement
• The shops' logos. If "Show shop logos" is on and the catalogue enables them, the app downloads from Logo.dev the logo of each shop you hold a card for. The request contains the shop's domain, so Logo.dev can infer which shops you hold cards for, together with your IP address. Logos stay on the phone for at most 30 days. With the switch off, no request is made. Logo.dev's policy: https://www.logo.dev/legal/privacy
• Purchases. "Remove ads" is bought and restored through the App Store or Google Play: Apple or Google handle the payment, and we never see your payment details.
• Ads, described below.

The app uses no analytics or crash reporting of its own.

Ads

To stay free, the app shows one small banner in a leather strip at the bottom of the card holder, and nowhere else. It appears only after the first 3 days and 2 cards, and disappears while you show a card, add one or are in Settings. No full-screen, video or rewarded ads.

Who provides the ads. Google AdMob; for people in the European Economic Area the provider is Google Ireland Limited. Google's code (the Google Mobile Ads SDK and the User Messaging Platform) is inside the app, kept apart in a module of its own.

Non-personalised ads only, chosen from context (for example the app they appear in and an approximate location), not from a profile of you or your past activity, and limited to content suitable for everyone.

What the app gives Google: nothing of its own. No cards, no shops, no photos, no keywords. An ad request only says that the ad must be non-personalised and suitable for everyone.

What Google collects on its own. Like any server, Google's see the IP address, from which an approximate location can be estimated (the town, not the street). According to what Google declares for its code, it also collects: non-advertising device or installation identifiers and, on iPhone, the advertising identifier only if you allow it (below); interactions with ads and with the app (for example views, taps, app launches); diagnostics (performance, hangs, errors of its code). It uses them to show and measure ads, for statistics and to prevent fraud and abuse. The data travel encrypted.

Consent. Where the law requires it, as in Italy and the rest of the European Economic Area, once the first few days are over the app shows Google's consent message. From then on, at every launch Google's code contacts its servers to know whether your consent must be asked, even before you choose. The legal basis is your consent (Article 6(1)(a) GDPR). If you do not consent to storing information on the device, the app requests no ads and does not start Google's advertising code. You can change or withdraw your consent at any time in Settings → Ad preferences.

The advertising identifier. On iPhone, after Google's consent message (where needed) and before starting the advertising code, iOS asks whether to allow tracking (App Tracking Transparency). If you allow it, Google may use the phone's advertising identifier (IDFA) to show and measure ads, which stay non-personalised; if you do not, the IDFA is not available and ads stay. You can change your choice in Settings → Privacy & Security → Tracking. The app never uses the IDFA itself. On Android the app gives up the permission to read the advertising ID: the system returns only zeros instead.

Google's rules. Google processes these data under its own policy: https://policies.google.com/privacy and, on how it uses data from apps that use its services, https://policies.google.com/technologies/partner-sites. From AdMob we see only totals (ads shown, taps, revenue), with no data about individuals.

Without ads. During the first few days, after "Remove ads", or if we turn ads off for everyone from the catalogue, the app does not ask for consent, does not start Google's code, shows no banner and does not contact Google.

Your rights

We receive no personal data, so we hold none to give you, correct or delete: everything the app knows is on your phone, and you delete it by uninstalling the app. Permissions can be revoked at any time in the phone's settings. For the data Google collects, the rights and tools described in its policy apply. For any question write to the address above. You also have the right to complain to your data protection authority (in Italy, the Garante per la protezione dei dati personali, www.garanteprivacy.it).

Children

The app is suitable for everyone but not designed for children in particular. We collect no one's data; what Google collects for the banner is described under "Ads".

Changes

If the app changes how it handles data, this page is updated first, with the new date at the top.