Privacy of Tessera

Tessera turns your No Man's Sky save into a story. It is a separate case from the rest of the site, and the most carefully built one. For everything else (cookies, logs, Cloudflare, your rights), see Privacy.

The short version

Your save is read in your browser and never uploaded.
Three things can leave, all of them only if you ask: a geography contribution (you tick its box and press the button), your story submitted to the public mosaic (you tick its box), and a seed, which you share yourself by handing out its link.
The seed is anonymized before it exists, not redacted afterwards.
You can leave: a key printed on your receipt removes your story from the site, with no account.
The honest limits are listed at the end.

Tessera's own documentation is written to be checked, not believed: each claim about the client names the file that implements it and the command that verifies it.

1. Where the computation happens

Everything runs locally, in a Web Worker in your browser (or in Node on the command line). The table needed to read modern saves is bundled, so the page never fetches anything to do its job.

The whole package makes exactly two network calls, one per checkbox. A built-in self-test fails if a third appears, or if either moves out of its consent branch. With both boxes clear, a save goes through the page and nothing leaves: you can watch your browser's network tab to see it.

The tool can only name 88 of the hundreds of obfuscated fields in a save, so most of what a save contains is unreadable to this code. Nothing from a save is ever executed as code, and the save is opened read only: nothing you decide here changes anything in game.

2. Three artifacts, not equivalent

The report is the working view (totals, contributors, your own pseudonym). It contains identifiers. It is never sent anywhere. It exists so you can see what was computed about you.
The geography is the corpus contribution: system addresses, the names you gave to systems and planets, black hole routes. Opt-in, sent by one press, no timer, no retry, no background upload.
The seed is the thing meant to travel: a few hundred characters holding the shape of a journey.

3. How the seed is anonymized

An explicit pass runs before the seed is built:

Your pseudonym becomes "you". Every other player disappears. Third parties are reduced to a bare count.
No field of the format can carry a pseudonym at all.
Counters are clamped (to 9999, deaths to 999) and distances become a coarse class, because past a certain precision a number stops describing a journey and starts identifying a player.
The list of completed mission ids never enters the seed. It is reduced to about twenty yes/no flags, which cannot be turned back into ids.
Dates are cut to the month, in both the seed and the geography.

Names you chose in game are your decision, one by one, before the seed exists. For each, you can keep it, drop it, or rename it. A name you refuse is never encoded, so it is in no link, no QR code, no copy of the seed. This is the opposite of redaction, which hides something already produced and leaves it recoverable from older copies. It is also the one honest exception to the anonymization: a name you keep travels with the seed, and anyone holding the seed can read it. Do not name a base after yourself and then keep it.

4. The geography

Only systems with a real in-game discovery record are sent. Planet entries are stripped of their discoverer and their own date. Names are length-capped, at most six planets per system.

One pseudonym survives by design: the credit naming the first in-game discoverer of a system. It travels because it is public information: the game shows it to every visitor of that system, with no need for your save or your consent. It can therefore name someone who is not you. This is a deliberate choice, resting on legitimate interest, and it is explained with the rest of the archive thesis in Why an archive.

5. What the server does

Reading a story (/mosaic/tessera~{seed}) writes nothing. Opening a link can never add a story to the gallery.
Publishing to the mosaic requires a token and a matching origin, and the story is queued as pending: a human reads it before it appears. The server stores the seed string and the time. The seed is not hashed, so anything in it, names included, is stored with it.
Geography is staged with the decoded systems, the payload as received, and a hash of the source IP address, for abuse triage. Treat that hash as personal data.
Reporting a story stores the seed, its hashes and your reason. Nothing about the reporter is read or kept: no account, no IP hash, nothing. A false report costs a row in a queue and never a sanction, so there is nothing to gain by knowing who sent it.
A story you never submitted leaves nothing here at all.

6. Leaving, without ever having arrived

Every seed carries a commitment to a random 120-bit key that your browser draws and prints once, on your receipt. Typing that key on the takedown page deletes the story's gallery entry and stops it rendering, immediately, with no account and no proof of identity.

Nothing is registered when the story is made. The server learns nothing unless you come back to remove it, and then it keeps a hash of the seed and a timestamp: not the seed, not your key, not your address, not who asked.
The commitment reveals nothing: it is the hash of an unstructured random value, which refers to no person, no save and no story.
There is no recovery. If you lose the receipt, the story stays up, because we never had the key. The alternatives (prove you still hold the save, or commit to something stable inside the save) either do not work, since the seed is public and a matching save can be built by hand, or would hand anyone an offline search that ends at the player. So the receipt is the backup.

Your receipt is never written to any storage. It is handed to you once, as a JSON download or a printable sheet. Close the tab without using either and nothing of it remains anywhere.

7. What this design does not protect against

A privacy page that lists only strengths is marketing.

A shared seed is public. It is not encrypted and not signed. Anyone with the string can decode it, names included. Share it only with someone you would trust to publish it.
The "public mosaic" bit is not authenticated. Anyone who obtains your seed can flip it and submit it, and your story would be queued for the wall even though you never asked. A human moderator reads it before anything is published, and once you spend your destroy key, every copy of that same story is refused from then on. But that moderator has still seen it once.
Taking a story down does not un-share it. It removes it from this site, not from copies someone already made.
Lose the destroy key and the story is permanent.
A geography contribution has no destroy key. There is currently no automated way to withdraw one, or the credit pseudonym inside it. Write to us and a human will do it.
Geography can be correlated. A set of system addresses and dates is distinctive. Contributing it and publishing a seed of the same journey links the two. They are opt-in separately.
Dates are dates. Rounded to the month is coarse, but it is still a timeline of when you played.
Addresses are public game coordinates. They say nothing about where you live. They do say where your bases are, in game.
The client is checkable, the server is a description. The client side can be verified on your own machine. The server code is not published, so what this page says about it is a description, not evidence.

8. Checking it yourself

Tessera is published with its own audit guide, written for someone who assumes the author is lying. The short test: open your browser's network tab, push a save through the page with both boxes clear, and watch nothing happen. Do it again with the geography box ticked, and watch exactly one request leave, at the moment you press the button. The only departures are the ones you asked for, at the moment you asked :)

Last updated: 9 October 2026