Privacy Policy

Cerne is a self-knowledge app. You talk to it about what is weighing on your life, and it helps you see what repeats. That means Cerne handles the most intimate material there is: what you write about yourself. This page explains, plainly, what leaves your device, where it goes, for how long, and how you control it.

The party responsible for this data processing (the "controller", under Brazil's General Data Protection Law, Law 13.709/2018, and applicable data protection laws) is [RAZÃO SOCIAL], tax ID [CNPJ], based at [ENDEREÇO]. Reach us at hello@cerneapp.com.

1. The principle: your material lives on your device

Everything you write in Cerne (conversations, fragments, layers, revelations, letters, diary, practice notes) is stored on your device first. That is where the app reads from. What we describe below are the situations in which part of that material leaves the device, and why.

2. What we collect, and what for

2.1 Your account

When you create an account (with Apple, Google or email), we store:

• name and email (if you signed in with Apple's "Hide My Email", we store the relay address, not yours);
• the sign-in provider and the identifier it gives us;
• gender and year of birth, if you provide them (both are optional; gender lets the app agree its sentences with you);
• a profile photo, if you choose one;
• language, time zone, the region set on the device, the reminder time, and when you last signed in;
• device data: model, system version, app version.

Purpose: keep your account, run the app in your language and on your schedule, and let your material come back when you change devices.
Legal basis: performance of the contract (art. 7, V, LGPD).

2.2 Your material, in the protected copy

So that you lose nothing when you change or lose your device, Cerne keeps a synced copy of your material on our servers: conversations, fragments, layers, revelations (text, image and voice), letters, diary, practice notes, memories and the month's highlights. That copy is linked only to your account: a rule in the database prevents any account from seeing another account's rows. The people who operate the service have technical access to that data and only access it to keep the service running or under legal obligation.

Purpose: restoring your material across devices.
Legal basis: performance of the contract (art. 7, V).

2.3 What goes to the artificial intelligence

Cerne writes with a language model operated by third parties. Before the first conversation, the app asks for your explicit permission on a dedicated screen, and you can say no. Without that permission the chat stays locked; the rest of the app keeps working. You can withdraw the permission at any time in Settings · Your data.

What leaves the device when you chat: the text you write in the chat, together with the context the app assembles for the model to answer (your question, the layers already closed, the fragments of the conversation, the portrait the app has of you, and your practice notes). Your name, your email and your diary do not go.

The path:

1. The text leaves the device for the Cerne server (hosted on Vercel, United States), which holds the access keys and does not record the text: it only forwards it.
2. The Cerne server forwards it to OpenRouter (United States), a model router, which also does not store the text: prompt logging is turned off on our account.
3. OpenRouter delivers it to the model. Today that is OpenAI (the same model as ChatGPT), with Tencent as a fallback when it fails. The voice of the revelation is generated by OpenAI, and the image by Meta.

What the model providers do with the text:

• They train no model with it. Cerne requires the router never to route through a provider that uses the text for training or collects it.
• OpenAI retains the text for up to 30 days, only for abuse checks, and then deletes it.

Besides the text, the Cerne server records, per call, numbers: how many tokens went in and out, what it cost, how long it took, which model answered, and whether it failed. Never the content.

Purpose: the service itself (Cerne does not exist without the model).
Legal basis: your consent (art. 7, I), given on the permission screen and recorded on your account with the date and the version of the text you accepted.

2.4 Your safety

If what you write indicates a risk to your life, the app ends the conversation with a fixed message and a crisis line number. In that case our server records only a mark: that there was an alert, when, and on which account. Never the text. Cerne is not therapy, not an emergency service, and does not replace a professional.

Legal basis: protection of life (art. 7, VII).

2.5 When you flag an answer

Every Cerne answer can be flagged by you, with a reason. The reason goes to our review queue. The excerpt of the answer only goes if you tick "attach what it said", and a note only goes if you write one. We read everything that arrives there to correct the model.

Legal basis: legitimate interest in keeping the service safe (art. 7, IX), and your consent for the excerpt and the note.

2.6 Measurement and stability

To know where people get stuck and whether the app is breaking, we use two tools:

• PostHog (United States), for usage events: which screen opened, which step of the flow happened, how many layers closed. No event carries your text. Only event names, counts and categories. Session recording and automatic screen capture are turned off in code, and stay off.
• Sentry (United States), for errors and crashes: the error type, the device model, the app version. No screenshots, no view hierarchy, no personal data.

Both receive your account identifier, so that an error or a funnel can be tied to a person and not to a ghost. We do no tracking across third-party apps or sites, we use no advertising, and we sell data to no one.

Legal basis: legitimate interest (art. 7, IX).

2.7 Subscription

The subscription is processed by the store (Apple or Google) and by RevenueCat (United States), which tells us whether your subscription is active. We do not see your card. RevenueCat receives your account identifier and the subscription history.

Legal basis: performance of the contract (art. 7, V).

2.8 What we never collect

• The audio of dictation: transcription runs on the device itself and the audio is not recorded.
• Contacts, location, photos beyond the one you choose for your profile.
• Advertising, ad profiles, data from other apps.

2.9 This website

The cerneapp.com website uses no tracking cookies and no advertising. If we ever measure visits, it will be with your explicit permission, in its own notice, and without linking anything to your account in the app.

3. Who we share with

Only with the operators above, each for its own function, and nothing beyond it:

This is an international data transfer (art. 33, LGPD). It happens because these services operate outside Brazil, under contractual data protection clauses. Beyond these operators, we only share data under a legal or court order.

4. How long we keep it

• Your account and the copy of your material: as long as the account exists.
• After you delete the account: a 30-day grace period, during which signing in again cancels the deletion. After those 30 days we delete for real: account, material, images, voices and photo. The numeric records of model usage and errors lose their link to your account (they become anonymous); the safety alert marks are deleted.
• At the model providers: as in section 2.3 (up to 30 days at OpenAI).
• Usage events and errors: per PostHog's and Sentry's retention, with no text.

5. Your rights, and where to exercise each one

You have the right to access, correct, port, delete, be informed about sharing, and withdraw consent. In Cerne, each has a door inside the app:

• See and take everything: Settings · Your data · Export everything. You get a package with the book as PDF, the conversations as text, the images and the voices.
• Delete everything, including the copy: Settings · Your data · Delete everything, and Settings · Account · Delete account. Step by step at Delete your account.
• Withdraw the permission to send to the AI: Settings · Your data · Sending to the AI.
• Correct name, photo and profile data: Settings · Profile.
• Any other request, or a question: hello@cerneapp.com. We answer within 15 days.

If you believe your rights were not honored, you can appeal to your data protection authority (in Brazil, the ANPD).

6. Minimum age

Cerne is for people 18 and older. We do not knowingly collect data from children or teenagers; if we learn that an account belongs to someone under 18, we delete it.

7. Security

All communication is encrypted in transit. The copy of your material sits in a database with per-account access rules, in a private bucket for images and voices. The access keys to the providers never live in the app: they live on the server. No system is infallible; if an incident affects your data, we notify you and the authority as the law requires.

8. Changes to this policy

When this page changes in a relevant way, the date at the top changes, and the app warns you before the next conversation when the change affects sending to the AI: in that case, we ask for your permission again, on the new text.

9. Contact

[RAZÃO SOCIAL] · tax ID [CNPJ] · [ENDEREÇO]
Data protection officer: [NOME], hello@cerneapp.com.