Privacy Policy

Cerne is a self-knowledge app. You talk to it about what is weighing on your life, and it helps you see what repeats. That means Cerne handles the most intimate material there is: what you write about yourself. This page explains, plainly, what leaves your device, where it goes, for how long, and how you control it.

The party responsible for this data processing (the "controller", under Brazil's General Data Protection Law, Law 13.709/2018, and applicable data protection laws) is RAPHAEL BORGES DE ANDRADE DAYAN CONSULTORIA EM TECNOLOGIA DA INFORMACAO LTDA, tax ID 64.325.876/0001-90, based at Rua Pais Leme, 215, Conj. 1713, São Paulo, SP, 05424-150, Brasil. Reach us at hello@cerneapp.com.

1. The principle: your material lives on your device

Everything you write in Cerne (conversations, fragments, layers, revelations, letters, diary, practice notes) is stored on your device first. That is where the app reads from. What we describe below are the situations in which part of that material leaves the device, and why.

2. What we collect, and what for

2.1 Your account

When you create an account (with Apple or Google), we store:

• name and email (if you signed in with Apple's "Hide My Email", we store the relay address, not yours);
• the sign-in provider and the identifier it gives us;
• your statement that you are 18 or older (we keep only the date you stated it, never a date of birth);
• gender, if you provide it in your Profile (optional; it lets the app agree its sentences with you);
• a profile photo, if you choose one;
• language, time zone, the region set on the device, the reminder time, and when you last signed in;
• device data: model, system version, app version.

Purpose: keep your account, run the app in your language and on your schedule, and let your material come back when you change devices.
Legal basis: performance of the contract (art. 7, V, LGPD).

2.2 Your material, in the protected copy

So that you lose nothing when you change or lose your device, Cerne keeps a synced copy of your material on our servers: conversations, fragments, layers, revelations (text, image and voice), letters, diary, practice notes, memories and the month's highlights. That copy is linked only to your account: a rule in the database prevents any account from seeing another account's rows. The people who operate the service have technical access to that data and only access it to keep the service running or under legal obligation.

That material includes the mood you mark when you do a practice (a number from 1 to 5, once a day) and the tone the app notes at the end of each conversation. What you tell about your emotional life is, under the law, sensitive personal data (art. 5, II, and art. 11 of the LGPD), which is why it only goes to the artificial intelligence after your explicit permission (section 2.3), never becomes an ad and is never sold, and can be deleted by you at any time, entry by entry or the whole account.

Purpose: restoring your material across devices.
Legal basis: performance of the contract (art. 7, V) and, for the sensitive part, your consent (art. 11, I), given on the permission screen before the first conversation.

2.3 What goes to the artificial intelligence

Cerne writes with a language model operated by third parties. Before the first conversation, the app asks for your explicit permission on a dedicated screen, and you can say no. Without that permission the chat stays locked; the rest of the app keeps working. You can withdraw the permission at any time in Settings · Your data.

What leaves the device when you chat: the text you write in the chat, together with the context the app assembles for the model to answer (your question, your first name, the layers already closed, the fragments of the conversation, the portrait the app has of you, and your practice notes). The diary goes in two pieces outside the chat, both only with your permission: the Diary's sentence of the month and the highlights of the You tab, which read that month's entries. Your email does not go.

The path:

1. The text leaves the device for the Cerne server (hosted on Vercel, United States), which holds the access keys and does not record the text: it only forwards it.
2. The Cerne server forwards it to OpenRouter (United States), a model router, which also does not store the text: prompt logging is turned off on our account.
3. OpenRouter delivers it to the model. Today that is OpenAI (the same model as ChatGPT), with Tencent as a fallback when it fails. The voice of the revelation is generated by OpenAI, and the image by Meta.

What the model providers do with the text:

• They train no model with it. Cerne requires the router never to route through a provider that uses the text for training or collects it.
• OpenAI retains the text for up to 30 days, only for abuse checks, and then deletes it.

Besides the text, the Cerne server records, per call, numbers: how many tokens went in and out, what it cost, how long it took, which model answered, and whether it failed. Never the content.

Purpose: the service itself (Cerne does not exist without the model).
Legal basis: your consent (art. 7, I), given on the permission screen and recorded on your account with the date and the version of the text you accepted.

2.4 Your safety

If what you write indicates a risk to your life, the app ends the conversation with a fixed message and the number of the crisis line of your country (the list is at If you are not okay). To pick the country, the app uses the country code of your IP address on the last call to the server, the region set on the device, or the store of your account; the code stays on the device only. In that case our server records only a mark: that there was an alert, when, and on which account. Never the text. Cerne is not therapy, not an emergency service, and does not replace a professional.

Legal basis: protection of life (art. 7, VII).

2.5 When you flag an answer

Every Cerne answer can be flagged by you, with a reason. The reason goes to our review queue. The excerpt of the answer only goes if you tick "attach what it said", and a note only goes if you write one. We read everything that arrives there to correct the model. The excerpt and the note are kept for 30 days from the flag and then deleted; the reason stays as a count, with no text. If you delete your account, the excerpt and note of your flags are deleted right away.

Legal basis: legitimate interest in keeping the service safe (art. 7, IX), and your consent for the excerpt and the note.

2.6 Measurement and stability

To know where people get stuck and whether the app is breaking, we use two tools:

• PostHog (United States), for usage events: which screen opened, which step of the flow happened, how many layers closed. No event carries your text. Only event names, counts and categories. Session recording and automatic screen capture are turned off in code, and stay off.
• Sentry (United States), for errors and crashes: the error type, the device model, the app version. No screenshots, no view hierarchy, no personal data.

Both receive your account identifier, so that an error or a funnel can be tied to a person and not to a ghost. We do no tracking across third-party apps or sites, we use no advertising, and we sell data to no one. You can turn both tools off in Settings · Your data · Usage statistics: the app works the same.

Legal basis: legitimate interest (art. 7, IX).

2.7 Subscription

The subscription is processed by the store (Apple or Google) and by RevenueCat (United States), which tells us whether your subscription is active. We do not see your card. RevenueCat receives your account identifier and the subscription history. Whenever your subscription changes (purchase, renewal, cancellation, refund), RevenueCat notifies our server, and we keep that payment history: product, amount, currency, store country and dates, never card data. We use it for our accounting and to grant or end access at the right time. If you delete your account, this history is unlinked from it and remains only as an accounting record.

Legal basis: performance of the contract (art. 7, V) and, for the accounting record, compliance with a legal obligation (art. 7, II).

2.8 What we never collect

• The audio of dictation: transcription runs on the device itself and the audio is not recorded.
• Contacts, location, photos beyond the one you choose for your profile.
• Advertising, ad profiles, data from other apps.

2.9 This website

The cerneapp.com website measures visits with Google Analytics 4, and only after you allow it in the cookie notice: without your choice the default is denied and no measurement cookie is created; the IP address is anonymized; and nothing is linked to your account in the app. To change your choice, use the "Cookies" link in the footer. The site is hosted by Hostinger, in São Paulo, whose servers record the IP address and time of each visit in their logs, for the hosting provider's standard period. No advertising, no social network pixel.

3. Who we share with

Only with the operators above, each for its own function, and nothing beyond it:

This is an international data transfer (art. 33, LGPD). It happens because these services operate outside Brazil (the exception is Hostinger, which hosts the website in São Paulo), under contractual data protection clauses. Beyond these operators, we only share data under a legal or court order.

4. How long we keep it

• Your account and the copy of your material: as long as the account exists.
• After you delete the account: a 30-day grace period, during which signing in again cancels the deletion. After those 30 days we delete for real: account, material, images, voices and photo. The numeric records of model usage and errors lose their link to your account (they become anonymous); the safety alert marks are deleted.
• At the model providers: as in section 2.3 (up to 30 days at OpenAI).
• Usage events: up to 1 year at PostHog. Errors: up to 90 days at Sentry. No text in either.
• Website visits: up to 14 months at Google Analytics, only if you allowed it.
• Backups: encrypted, kept for up to 30 days; when the account is deleted, it leaves the backups within 30 days after the purge.
• Answer flags: excerpt and note for 30 days; reason, surface and date stay as a count, with no text and no link to your account.

5. Your rights, and where to exercise each one

You have the right to access, correct, port, delete, be informed about sharing, and withdraw consent. In Cerne, each has a door inside the app:

• See and take everything: Settings · Your data · Export everything. You get a package with the book as PDF, the conversations as text, the images and the voices.
• Delete everything, including the copy: Settings · Account · Delete my account, with a 30 day grace period. Step by step at Delete your account.
• Withdraw the permission to send to the AI: Settings · Your data · Sending to the AI.
• Correct name, photo and profile data: Settings · Profile.
• Any other request, or a question: hello@cerneapp.com. We answer within 15 days.

If you believe your rights were not honored, you can appeal to your data protection authority (in Brazil, the ANPD).

6. Minimum age

Cerne is for people 18 and older. We do not knowingly collect data from children or teenagers; if we learn that an account belongs to someone under 18, we delete it.

7. Security

All communication is encrypted in transit. The copy of your material sits in a database with per-account access rules (each account reaches only its own rows, verified by test), in a private bucket for images and voices, with an encrypted daily backup kept for up to 30 days. The access keys to the providers never live in the app: they live on the server, with usage caps and a spending limit. The text of your conversations never enters any system log: logs record who, when and from where, never what.

7.1 If there is a security incident

No system is infallible. If we discover an incident that may affect your data (unauthorized access, leak, loss), we do the following, in this order: contain the problem within 1 hour (switching off what is needed and rotating keys); establish within 24 hours what was reached and whose; and notify the Brazilian data protection authority (ANPD) and you, at your account e-mail, within 3 business days of discovery, as article 48 of the LGPD requires. The message says what happened, which data was affected, what we did, what you can do and how to reach the data protection officer. If the incident requires you to sign in again, the message says so.

8. Changes to this policy

When this page changes in a relevant way, the date at the top changes, and the app warns you before the next conversation when the change affects sending to the AI: in that case, we ask for your permission again, on the new text.

9. Contact

RAPHAEL BORGES DE ANDRADE DAYAN CONSULTORIA EM TECNOLOGIA DA INFORMACAO LTDA · tax ID (CNPJ) 64.325.876/0001-90 · D-U-N-S 579119303 · Rua Pais Leme, 215, Conj. 1713, São Paulo, SP, 05424-150, Brasil · +55 41 9788-0145
Data protection officer (DPO, article 41 of the Brazilian LGPD): Raphael Dayan. For any request about your data, question or complaint, write to hello@cerneapp.com: we reply within 15 days, the legal deadline for simplified access.