Last updated October 10, 2026

Privacy Policy

Ceresis Core is a place to log your days. What you log is personal, so this page says plainly what we collect, what happens to it, and how you take it with you or erase it.

Who we are

Ceresis Core is operated by Brian Cruz, an individual running it as a sole proprietor (“we”, “us”). Questions about this policy or your data go to support@ceresiscore.com.

What we collect

Your account: Your email address, a display name, your timezone, your plan, and a password stored only as a hash by our authentication provider.
What you put in: Log entries and the text you typed to create them, trackers and targets, tasks, goals, an exam or deadline date if you set one, notes (and any older journal entries not yet moved into them), messages in the assistant thread, the shape of your goal map (its areas, what each one measures and which tracker it reads, including measures you have taken off it, which are kept so you can put them back, and trackers you delete from the map, kept for a week so you can restore them), and your dashboard layouts and settings (including the assistant voice and theme you choose).
Product improvement: We record when objectives are created, captures are structured or corrected, explanations are opened, recommendations are accepted, experiments start or finish, and patterns are saved. These records contain identifiers, dates, action counts and result categories, never the contents of your logs. Return-day events help measure retention. Existing AI usage records measure calls and cost by feature. For non-health goals, opening a reading or its evidence and answering whether it helped you choose a next step records the goal identifier, time, yes/no answer, and whether confirmed evidence and a target are available. Health goals and goals with health signals are excluded from this pilot measurement. Voluntary research participation is tracked privately by the operator using your account identifier, qualification and consent dates, broad deadline window, and verified decision or payment dates. We use this to measure first value and repeat use; it does not send your evidence to marketing services. Interview scheduling and interview notes require a separate voluntary agreement. Pilot records are removed if you withdraw or delete your account and otherwise within 90 days of the pilot ending.
Objective intelligence: Outcomes you want, the signals you associate with them, the source and confidence of classifications, trajectory readings and their supporting numbers, changes you agree to test, their baselines and results, and patterns inferred from successful and unsuccessful attempts. Manual experiments record your proposed change, reason, hypothesis, comparison measure and duration. They start only when you accept, with a saved baseline and review date; later differences are observational. This manual flow and deterministic drafts work without sending a message to an AI provider. Corrections can preserve a short phrase from your own input and its corrected association so repeated capture takes less work. Original log text is preserved. You can inspect, correct, reject or delete these records on either plan; they are private, included in your export and deleted with your account. You can explicitly approve a saved Note as goal context; we store a source reference and content fingerprint, never count its prose as a measurement, and require approval again after its text or tags change. Experiment references can link existing confirmed Sensor action/outcome pairs, rechecked against corrections and permission. Weekly goal feedback uses computed readings and stays quiet without new relevant evidence. AI setup and suggestions send compact objective signals and relevant previous attempts to the same AI processor described below. Goal-specific questions and experiment suggestions use bounded structured facts and explicit uncertainties; the model selects signal references or a reversible proposal, while code supplies factual figures. Suggestions never execute external actions, and an experiment starts only when you accept it. Patterns describe observed associations and do not establish causes.
Health and wellness information: If you choose to log meals, sleep or workouts, or keep a tracker that measures your body, that is health information, and we ask before recording any of it. Until you say yes we record none of it. We use it only to show it back to you and, on Pro, to generate estimates and briefs for you. See “Health data” below.
What you’ve agreed to: That you accepted the Terms and which version, and your answer about health information and when you gave it. We keep the history rather than only the latest answer, so a decision you made can’t be quietly rewritten — including by us. It’s in your export and deleted with your account.
Groups: If you start or join a group: its name, who is in it, the name you go by there, which trackers you chose to put on your scorecard for it, and the scorecard itself; if you started it, its description, chat link and season dates; and the nods you give and receive there (who nodded whom, on which day) — see “Groups” below.
Weekly review email: Only if you switch it on in Settings → Notifications: whether you did, and — once a week — the email itself, which carries the same review the app shows you. Every one has a one-tap unsubscribe that works without signing in.
Founding member: If you were in the first 100 on the waitlist when you signed in, a mark on your account that gives you the founding price at checkout. Nothing else is taken from the waitlist.
Photos: On Pro you can photograph a meal to have it read. The photo is sent for that one reading and then discarded — we never store it. Only the entry it produced is kept.
Map reviews: On Pro you can ask for a review of your map’s suggestions. When you press it, we send the suggestions, your trackers and their numbers, the lines you logged in the last four weeks, your notes (pinned and most recent first, cut to a length), the up to three notes you add for the review, and the tracker ideas you declined before with any reason you gave, to be read for that one review. We keep the review’s result (its explanations and tracker ideas), your review notes and your declined ideas (the latest twenty) until you change or clear them; all of it is in your export and deleted with your account.
Create: What you make in Create — week plans, reviews, roads, pace calculations, decision matrices, mind maps, training weeks and meal plans — is kept on your account (at most twelve) until you delete it; it’s in your export and deleted with your account. Ticking a session or logging a meal from one makes an ordinary entry, the same as logging it yourself. On Pro, when you ask for an action-plan mind map we send your goal, your weekly commitment, your non-health trackers, your open to-dos and your notes (pinned and most recent first, cut to a length); for a training week, your training trackers, the training you logged in the last five weeks and your notes; for a meal plan, your calorie and protein targets and the names of foods you logged in the last five weeks — each to be read for that one plan. Training weeks and meal plans are health information and are made only after you’ve said yes to it. A plan shared as a picture is drawn on your device and never uploaded, and training weeks, meal plans and reviews can’t be shared. On Pro you can also ask for a tool in your own words; we send what you typed, your goal and weekly commitment, your trackers (health ones only after you’ve said yes) and your notes (pinned and most recent first, cut to a length), to be read for that one tool. If you share a tool to a group, the group sees what it says — its name, headings, items and cells — and can copy it into their own Create; never what you ticked, which trackers it logs to, or anything you logged. It stays on your card in that group until you stop sharing it or leave. Shared words, numbers and cells can contain information you entered or generated from your Notes, so review the exact tool before sharing. Members can retain copies they already added even after sharing stops. A separate, explicit “Allow this reading” action displays only a selected goal’s computed non-health measurements beside a saved tool. That reading is not stored with the tool, sent to AI, or included in a shared copy; it grants no ability to change evidence.
Usage records: For Pro AI features, a count of each request and its cost (120 questions a month, and so on), so monthly allowances can be enforced. These records don’t contain what you asked.
Product usage records: At most one row a day for each of a short list of moments, with no content: that you finished setup, logged something that day, opened a brief, saw or rated a pace check, answered “did this change a decision today?” about a brief, finished or skipped the welcome tour, tapped an upgrade offer, shared an invite link, a progress card or a map, joined a group, arrived from the pace calculator or a shared map, answered the partner step in setup, started a subscription, opened quick capture, used or cancelled voice, corrected or undid a capture, or reviewed a clarification. Capture records include the input surface, elapsed time and confirmation count; they exclude transcripts, objective names and microphone audio. They never include what you logged or what a brief said. We use them to learn whether Ceresis helps and how people find it; they are in your export and deleted with your account.
Device and notifications: If you turn on notifications, your browser’s push subscription (an address our server sends notifications to). If you allow location for the weather widget, your approximate coordinates — see “Weather” below.
Calendar: If you connect a calendar, the private iCal address you paste. Our server reads that feed to show your upcoming events; the events themselves aren’t stored. Disconnecting deletes the address.
Bug reports: If you send one from Settings, what you write, the page you came from, your browser type and screen size. We use it only to fix the problem; it’s deleted with your account.
Changes to your dashboard: When you add, retarget, hide or delete a tracker, task or goal, we record that it happened and when, so the activity console can show you. It records the change, never what you logged. Kept for 14 days, then deleted.
Corrections: When you correct a logged entry, we keep how it was first filed alongside it, so a wrong estimate can be traced. It’s deleted with the entry or with your account.
Abuse protection: Our host counts requests per network address for about a minute to stop floods of requests. Those counts aren’t tied to your account or kept.
Free tools without an account: The goal map and the pace calculator run in your browser, and nothing you type into them is sent to us. If you share a map, the link itself carries the map, in the part of the address browsers never send to a website: we don’t store a copy, and anyone you give the link to can see it. While you have the page open, the map is held in your browser tab so that an account made in that tab can start with it.
Cookies: The cookies that keep you signed in, one that remembers your chosen theme, and a session cookie for the full dashboard on a phone. Optional Google Analytics cookies are used on public pages only after you allow analytics, as described below. Advertising features are disabled.

Do Not Track. A Do Not Track or Global Privacy Control signal keeps optional marketing analytics off.

Optional marketing analytics

If you allow analytics, Google Analytics measures public page visits, calculator interactions, waitlist links, form starts and confirmed new waitlist submissions. Google processes browser and network information and uses a browser identifier; measured users are not a verified count of people. Advertising signals and personalization are disabled. Private app pages, email addresses, names, typed calculator values, logs, notes, health information, referral codes and URL query strings or fragments are not included in our analytics events.

With the same permission, this browser keeps first and latest known campaign tags, coarse public landing paths and a recognized referrer category for up to 30 days. On a successful signup, those tags are saved with your waitlist entry so we can compare acquisition sources. Declining analytics does not prevent calculator use or joining the waitlist. Choose “Analytics preferences” in a public page footer to change your choice. Withdrawal clears our stored campaign tags and Google Analytics cookies on this device and stops further measurement; it does not automatically erase reports already processed by Google. Contact us about deletion requests.

The analytics choice is stored on this device until changed or browser storage is cleared. Analytics cookies expire after 30 days of inactivity. Aggregate reports are read privately by the operator. Google report retention is configured in the Google property; campaign metadata on waitlist entries follows the waitlist retention below.

The waitlist

If you join the waitlist before you have an account, we keep your email address, what you told us you’re working toward (and the detail, if you added one), which page you joined from, the code of whoever’s link you used, and when you joined. We use them to invite people a few at a time, to email you when your invite is ready and when we launch, and to count referrals so your place moves up. With optional analytics consent, we also save the minimal acquisition tags described above and send a content-free signup event to Google; the address and what you wrote are never sent to Google Analytics.

Your spot’s page has a Leave the waitlist button that deletes your entry immediately; every email we send has a way to leave too, or you can write to support@ceresiscore.com. If you create an account, your waitlist entry is deleted within 30 days of your invite, and the whole list is deleted within 12 months of launch.

A group’s invite link can let someone in before sign-ups open. If you leave your email address on an invite page, we keep that address and which group invited you, and use it only to send you one invitation to create an account (through the sign-in service). It is deleted when you join the group, and in any case 14 days after you left it.

Groups

A group is the one place anyone else sees anything of yours, and only because you chose it. The people in a group see its name, each other’s names there, and each member’s scorecard: for each tracker that member ticked, this week’s number against their own target and whether it’s met, and for their main commitment, whether they’re on pace, how much of it they did on each day this week, whether they met it in each of the last four weeks, last week’s total, and how many days in a row they’ve logged it. Membership gives no access to your private entries, Notes, messages, email address, settings or raw Sensor observations. If you deliberately publish a tool, its words, numbers and cells are shared as described under “Create” above. Your scorecard is rebuilt from your own log whenever you log something, and shows when it was last updated.

Nothing is on your scorecard until you tick it, a tracker that measures your body can only be ticked once you’ve allowed health data (see “Health data”), and each group is a separate choice. Joining needs an invite link that only the person who started the group can see; they can also remove people, make a new link, and delete the group. Leaving a group deletes your scorecard there at once; deleting a group deletes everyone’s.

The person who started a group can also add a short description and a link to a chat the group already uses elsewhere (for example WhatsApp or Discord); everyone in the group can see both. We store the link, never the chat: Ceresis doesn’t host messages, and anything said there is between you and that service, under its own terms and privacy policy. Stopping a tool share removes the published copy; it cannot recall copies members previously saved. Rotating an invite prevents new joins with the old link; remove an existing member to end their access to the group.

Coach groups. Someone who starts a coach group — a running coach, a tutor — sees each member’s scorecard exactly as described above, and shares none of their own. Everything above holds for a coach: no entries, no ranking, nothing you didn’t tick. Before you join, the invite page shows only the group’s name, how many are in it and how many are on pace this week — never names or scorecards.

Crews, seasons and nods. A crew is a group. The person who started it can give it a season (a start and an end date), which everyone in it sees. A nod is one tap that tells a crewmate you saw their day: we store who gave it, who it was for, the day and when it was given, and only the people in that crew can see it. Nods can’t be edited; they’re deleted with the crew or with your account, and they’re in your export. The weekly card you can share to your group chat is drawn on your own device from the scorecards you can already see, like the cards below, and is never uploaded to us; so is the season card for your own story, which shows only your promise and your record, never a crewmate’s. If you’re in a crew and have notifications on, the Sunday-evening reminder says what’s left of your promise and how many in the crew have kept theirs. Before you join, the invite page also shows the units the crew’s promises are counted in (hours, miles…) and when its season ends — still never names, scorecards or the names of anyone’s trackers.

Ceresis Sensor (alpha)

Sensor is an invitation-only test: an app on your iPhone or Mac that notices what you did and sends Ceresis a short, plain description of it, so your week can be compared with your plan. You connect each device by signing in to your own account, and everything it sends is private to that account, like your entries.

What it sends: meaning, not detail. Calendar event times and an all-day flag under a generic plan label (never titles, notes or attendees); that you arrived at or left a place you saved, as its chosen name (“gym”), never coordinates or radius; activity classifications such as walking or still, with sensor confidence and a timestamp, as supporting context only; the name of the app or kind of site you used (“study”, never the page, its title or its address) and for how long; idle periods; the name of a project; when an assistant started or finished a task; and a note you typed to Sensor yourself. Each observation carries a confidence, which device and sensor produced it, and a unique id.
Mac passive context: foreground sensing is optional and uses app names and identifiers, input-active session times, and idle periods. It reads only seconds since input, never keys or what you type. After two minutes without input, app time stops. Tiny switches are filtered locally. An open app is uncertain evidence, never proof of work. Pause, sleep and shutdown close intervals; crash recovery uses the last saved sample and never fills unobserved gaps. Calendar observations on the Mac are generic plans, as on the phone. Optional Chrome browser sensing uses a separately enabled extension. It classifies only the active hostname locally and discards the URL immediately. Only a category and sampled input-active intervals are saved, with device and provenance. No domains, paths, query strings, titles, history, pages or forms are retained or uploaded. Private browsing is excluded; missing permission, idle, lost focus, pause and sampling gaps stop counted time. Safari sensing remains disabled. Screen Time availability does not block other sensors.
Optional Mac window and project context: Accessibility access is requested only when you enable window context. Only development editor titles are classified locally and immediately discarded; raw titles are never stored or uploaded, including in debugging mode. Browser and terminal windows are excluded. Projects are individually chosen directories, with no search of unrelated folders. Only bounded Git metadata inside those folders is read; source, commands and shell history are never collected. Uploads contain repo names and change flags, never directory paths, branch names or commit hashes, and do not assert who made a change or how long coding took. Folder bookmarks stay in a protected file on the Mac and can be removed. Quick captures may include recent semantic observation ids and times as uncertain supporting context.
What it never sends: what you type, screenshots, audio, messages or email, passwords, the contents of pages or files, source code, your full browsing history, or a continuous location trail.
Health: workouts and sleep from the phone’s health records are sent only after you have allowed health data (see “Health data”), and are refused by the server and by the database without it. The phone asks only to read workouts and sleep, never to write health records. It sends workout type, timestamps and active seconds, and asleep segment times and stages; no heart rate, calories, workout routes or health-source names. Places and motion also need current health consent. The phone checks the current decision before collecting; if consent cannot be checked, these sensors stop. Calendar and health source identifiers are hashed before upload.
Raw debugging uploads are off for every device. If you switch them on, a device may send more detailed observations to help fix a problem; Ceresis deletes each of those 7 days after it arrives. Turn the switch off and none are accepted.
On the device: a device keeps its own raw observations for 7 days by default (configurable from 1 to 30 days) and uploads only the descriptions above. Saved place centers and radii stay in a protected file on the phone, excluded from backups; you can remove them in Sensor. Saving a place uses a single location fix; boundary monitoring does not run continuous GPS. Calendar and health refresh when you open the app and periodically while it is active; place boundaries can wake it. Pausing stops passive sensors. Signing a device out deletes its stored sign-in and revokes that device only. Local tests and the live service keep separate device stores and upload queues; changing servers does not transfer previously captured records between them. Expiry never deletes an unsent or rejected queue record. Queues are separated by verified account and server. Captures made while signed out remain local and are never assigned automatically to the next account.
Evidence history: goal readings retain the measurement inputs, source references, metric definitions, time and calculation version needed to inspect the saved calculation. Manual corrections keep an ordered before-and-after history alongside Sensor corrections. These records are private to your account and included in your export. Deleting an entry removes its correction history and saved readings that depended on it. Removing Sensor evidence clears affected saved Sensor readings. Earlier summaries without complete source references are also cleared. Saved Briefs remain historical text and are marked when evidence changes; they are not silently rewritten.
What Ceresis makes of it: from these observations it works out events (what likely happened and for how long, with the observations behind each one) by fixed rules, not by a model. Anything uncertain stays marked as uncertain until you confirm it, and a calendar entry counts only as a plan, never as time spent. When you confirm, reject or change an event, or add one Sensor missed, Ceresis keeps your correction (including goal or project assignments, supplied start/end times and any reason) and the original beside it, so the test can measure how often it was right.
Review measurements: an optional review timer measures time while the review page is focused and visible. It records seconds, start/end times, day, device and clock-skew status, without monitoring keys or input. You may supply battery percentages and whether the device was on battery; these are optional measurements, not evidence that Sensor caused battery use. Daily source, overlap, correction and sync metrics are calculated from your records. Device diagnostics contain counts only. Web corrections and saved measurements persist in this browser’s IndexedDB, separated by verified account, until acknowledged or explicitly discarded; account deletion removes server copies, not local files or browser storage. Clear local storage separately.
Practice imports: if you choose a practice-results CSV in Sensor, it reads only that selected file (up to 64 KiB and 100 results). You preview its source/practice identifiers, timestamps and question counts and choose a goal before saving. We store those fields as private result events; accuracy is calculated from the supplied counts. The original file and unrelated file contents are not uploaded or retained. No directory monitoring or practice-provider access is enabled. Imports are user-supplied, not independently verified. Repeated identical imports count once; conflicting versions are withheld until you reject the wrong result. Manual results on the same day/field take precedence to avoid possible double counting. Use Review to reassign, reject or delete a result; correct counts by rejecting the wrong version and importing its replacement. Imports use the existing device queue, export and account deletion rules. Local copies must be cleared separately.
Your control: Sensor’s observations, events, corrections and saved review measurements are in your export, and deleting your account deletes them. Confirmed effort assigned to a goal can contribute to its compatible leading hours signal as a calculated reading, without creating a duplicate manual entry. A block you count as study in Activity also adds to your main study commitment's weekly figure, calculated when the page loads and never stored as an entry; blocks still waiting are shown beside that figure and never counted. Same-day manual amounts are conservatively overlapped; time spent never creates an outcome measurement. Links to recorded results are saved only when you choose them. Nothing from Sensor is shown to a group.

How we use it

To run the app: store what you log and show it back to you across your devices.
On Pro, to generate what you ask for: filing and estimates, photo reading, answers and briefs.
To enforce plan limits, prevent abuse, and keep the service secure.
To learn whether Ceresis Core actually helps — for example, whether people come back in their second week, or which parts of the app go unused — from the product usage records above and from counts of how often each part is used (how many entries or notes someone made, and when), never from what any of them say. Health information is never part of this: food, sleep, exercise and body measurements are left out of every count.
To email you about your account — confirmation and sign-in links, password resets, address-change confirmations, and security and billing notices.

We don’t sell your data, we don’t share it with advertisers, and we don’t use your logs to train AI models. The people you choose in a group see your scorecard and any tool content you deliberately publish there.

In the words the law uses: we do not sell or share personal information, in the sense California gives those words — we take no money for it, and we hand none of it to anyone for advertising that follows you between sites. We also don’t pass personal information to other companies for their own marketing, so there is nothing to ask us for under California’s “Shine the Light” law.

Who processes it for us

We use a small number of service providers, each only for its part of running Ceresis Core:

Supabase: Database and sign-in. Your data is stored here, isolated per account.
Cloudflare: Hosting and delivery of the app, and the security check on the sign-in and password forms (Turnstile), which tells people from automated sign-in attempts. For that check Cloudflare reads your IP address and technical details from your browser; we get back only whether it passed, and it isn’t used for advertising.
Anthropic: AI processing, for Pro features only. The text or photo needed for a request is sent when you use a Pro feature. Under Anthropic’s commercial terms, it isn’t used to train their models.
MET Norway: Weather forecasts. Our server sends coordinates rounded to about a kilometre, with nothing that identifies you.
OpenStreetMap (Nominatim): Finding a city you type for the weather widget. Only the text you search for is sent. The city you choose is saved to your account.
Your calendar provider: Google, Apple, Outlook or whoever hosts the calendar address you connect — we request that feed from them.
Your phone’s push service: If you turn on notifications, briefs are delivered through your browser’s push service (Apple, Google or Mozilla). The message is encrypted so only your device can read it.
GitHub: Makes and stores our weekly database backup. The copy is encrypted as it is made, and the stored file can only be opened with a key that only we hold. Each backup is deleted after 28 days.
Resend: Sending the emails above. Resend handles the address we send to and the contents of that message; it holds nothing else about you and has no access to what you log.
Google: With your optional analytics permission, Google processes the public-page measurement described above. If you write to us at the support address, that message is forwarded into a Gmail inbox, so Google processes what you send us — including anything you attach to a request about your data.
Paddle: Payments for Pro. Paddle handles your card details; we never see or store them. We keep your Paddle customer and subscription IDs and your subscription status, so the app knows your plan.

Health data

Some laws, including Washington’s My Health My Data Act, give health information extra protection. We collect it only when you choose to log it, use it only to provide the app to you, never sell it, and never share it except with the providers above as needed to run the features you use — or with the people in a group, if you tick a health tracker for that group’s scorecard.

We ask first, separately from these terms. Until you say yes, nothing about food, sleep, exercise or your body is stored at all: those logs are refused — the words as well as the numbers — photos aren’t read, and what you type is filed without being sent to our AI provider. The database itself refuses food, sleep and exercise entries, so that holds however the data arrives. Everything else works the same either way: study, tasks, goals, notes, search, export and trackers that aren’t about your body.

Voice capture starts only when you ask. Your browser may send speech to its speech recognition service; check its privacy settings. Ceresis receives the transcript, files it through the same input system, and does not store microphone audio. Closing capture or leaving the page stops the microphone. Short-lived capture receipts prevent duplicate submissions and are removed after seven days when you next capture.

You can change your answer whenever you like in Settings → Data & privacy. Turning it off stops anything new being kept from that moment; it doesn’t delete what’s already there, because withdrawing consent should never quietly destroy your history. It also pauses AI generation: saved notes, labels and log text may contain health information, so we don’t send them without a current yes. Manual tracking, computed readings, search and export remain available. Deleting is its own choice, above.

The fuller account — what counts as health data, where it comes from, who sees it, and how to have it deleted — is in the Consumer Health Data Privacy Policy.

Your data, your call

Export: Settings → Data & privacy downloads your data as JSON or as a zip of CSV files, on any plan — everything you have logged or written, your settings, and the records we keep about your account. Two things are left out: the notification address your browser issues (it identifies a device, not you) and our internal payment and scheduled-job records.
Correct or delete: edit or delete any entry or note directly in the app, and change what’s on your group scorecards or leave a group at any time.
Delete your account: Settings → Data & privacy → Delete account removes your account and every row of your data immediately. Encrypted backups roll over and are gone within 30 days.
Other requests — access, restriction, objection, or a question about any of this — go to support@ceresiscore.com. We answer within 30 days.

How long we keep it

What you log stays until you delete it or close your account — we don’t expire your own entries. A few records clean themselves up sooner: an email address left on a group invite after 14 days, the dashboard-change log after 14 days, records of scheduled jobs after 60 days, and summaries written for the old journal page once they go stale, which is a few hours to a few days depending on the range they cover. Deleting your account removes everything immediately, and encrypted backups roll over within 30 days.

Security

Every account’s data is isolated at the database level with row-level security, so one account can’t read another’s rows — the one exception being the scorecards members of a group share with each other, which the database lets only that group’s members read. Connections are encrypted in transit, data is encrypted at rest, and AI features are reachable only through a server-side gate. No system is perfectly secure; if a breach affects your data, we’ll notify you and the relevant authorities as the law requires.

Children

Ceresis Core isn’t for anyone under 16, and we don’t knowingly collect data from them.

Changes

If we change this policy in a way that affects how your data is used, we’ll tell you by email or in the app before the change takes effect.

Last updated October 10, 2026

Privacy Policy

Ceresis Core is a place to log your days. What you log is personal, so this page says plainly what we collect, what happens to it, and how you take it with you or erase it.

Who we are

Ceresis Core is operated by Brian Cruz, an individual running it as a sole proprietor (“we”, “us”). Questions about this policy or your data go to support@ceresiscore.com.

What we collect

Your account: Your email address, a display name, your timezone, your plan, and a password stored only as a hash by our authentication provider.
What you put in: Log entries and the text you typed to create them, trackers and targets, tasks, goals, an exam or deadline date if you set one, notes (and any older journal entries not yet moved into them), messages in the assistant thread, the shape of your goal map (its areas, what each one measures and which tracker it reads, including measures you have taken off it, which are kept so you can put them back, and trackers you delete from the map, kept for a week so you can restore them), and your dashboard layouts and settings (including the assistant voice and theme you choose).
Product improvement: We record when objectives are created, captures are structured or corrected, explanations are opened, recommendations are accepted, experiments start or finish, and patterns are saved. These records contain identifiers, dates, action counts and result categories, never the contents of your logs. Return-day events help measure retention. Existing AI usage records measure calls and cost by feature. For non-health goals, opening a reading or its evidence and answering whether it helped you choose a next step records the goal identifier, time, yes/no answer, and whether confirmed evidence and a target are available. Health goals and goals with health signals are excluded from this pilot measurement. Voluntary research participation is tracked privately by the operator using your account identifier, qualification and consent dates, broad deadline window, and verified decision or payment dates. We use this to measure first value and repeat use; it does not send your evidence to marketing services. Interview scheduling and interview notes require a separate voluntary agreement. Pilot records are removed if you withdraw or delete your account and otherwise within 90 days of the pilot ending.
Objective intelligence: Outcomes you want, the signals you associate with them, the source and confidence of classifications, trajectory readings and their supporting numbers, changes you agree to test, their baselines and results, and patterns inferred from successful and unsuccessful attempts. Manual experiments record your proposed change, reason, hypothesis, comparison measure and duration. They start only when you accept, with a saved baseline and review date; later differences are observational. This manual flow and deterministic drafts work without sending a message to an AI provider. Corrections can preserve a short phrase from your own input and its corrected association so repeated capture takes less work. Original log text is preserved. You can inspect, correct, reject or delete these records on either plan; they are private, included in your export and deleted with your account. You can explicitly approve a saved Note as goal context; we store a source reference and content fingerprint, never count its prose as a measurement, and require approval again after its text or tags change. Experiment references can link existing confirmed Sensor action/outcome pairs, rechecked against corrections and permission. Weekly goal feedback uses computed readings and stays quiet without new relevant evidence. AI setup and suggestions send compact objective signals and relevant previous attempts to the same AI processor described below. Goal-specific questions and experiment suggestions use bounded structured facts and explicit uncertainties; the model selects signal references or a reversible proposal, while code supplies factual figures. Suggestions never execute external actions, and an experiment starts only when you accept it. Patterns describe observed associations and do not establish causes.
Health and wellness information: If you choose to log meals, sleep or workouts, or keep a tracker that measures your body, that is health information, and we ask before recording any of it. Until you say yes we record none of it. We use it only to show it back to you and, on Pro, to generate estimates and briefs for you. See “Health data” below.
What you’ve agreed to: That you accepted the Terms and which version, and your answer about health information and when you gave it. We keep the history rather than only the latest answer, so a decision you made can’t be quietly rewritten — including by us. It’s in your export and deleted with your account.
Groups: If you start or join a group: its name, who is in it, the name you go by there, which trackers you chose to put on your scorecard for it, and the scorecard itself; if you started it, its description, chat link and season dates; and the nods you give and receive there (who nodded whom, on which day) — see “Groups” below.
Weekly review email: Only if you switch it on in Settings → Notifications: whether you did, and — once a week — the email itself, which carries the same review the app shows you. Every one has a one-tap unsubscribe that works without signing in.
Founding member: If you were in the first 100 on the waitlist when you signed in, a mark on your account that gives you the founding price at checkout. Nothing else is taken from the waitlist.
Photos: On Pro you can photograph a meal to have it read. The photo is sent for that one reading and then discarded — we never store it. Only the entry it produced is kept.
Map reviews: On Pro you can ask for a review of your map’s suggestions. When you press it, we send the suggestions, your trackers and their numbers, the lines you logged in the last four weeks, your notes (pinned and most recent first, cut to a length), the up to three notes you add for the review, and the tracker ideas you declined before with any reason you gave, to be read for that one review. We keep the review’s result (its explanations and tracker ideas), your review notes and your declined ideas (the latest twenty) until you change or clear them; all of it is in your export and deleted with your account.
Create: What you make in Create — week plans, reviews, roads, pace calculations, decision matrices, mind maps, training weeks and meal plans — is kept on your account (at most twelve) until you delete it; it’s in your export and deleted with your account. Ticking a session or logging a meal from one makes an ordinary entry, the same as logging it yourself. On Pro, when you ask for an action-plan mind map we send your goal, your weekly commitment, your non-health trackers, your open to-dos and your notes (pinned and most recent first, cut to a length); for a training week, your training trackers, the training you logged in the last five weeks and your notes; for a meal plan, your calorie and protein targets and the names of foods you logged in the last five weeks — each to be read for that one plan. Training weeks and meal plans are health information and are made only after you’ve said yes to it. A plan shared as a picture is drawn on your device and never uploaded, and training weeks, meal plans and reviews can’t be shared. On Pro you can also ask for a tool in your own words; we send what you typed, your goal and weekly commitment, your trackers (health ones only after you’ve said yes) and your notes (pinned and most recent first, cut to a length), to be read for that one tool. If you share a tool to a group, the group sees what it says — its name, headings, items and cells — and can copy it into their own Create; never what you ticked, which trackers it logs to, or anything you logged. It stays on your card in that group until you stop sharing it or leave. Shared words, numbers and cells can contain information you entered or generated from your Notes, so review the exact tool before sharing. Members can retain copies they already added even after sharing stops. A separate, explicit “Allow this reading” action displays only a selected goal’s computed non-health measurements beside a saved tool. That reading is not stored with the tool, sent to AI, or included in a shared copy; it grants no ability to change evidence.
Usage records: For Pro AI features, a count of each request and its cost (120 questions a month, and so on), so monthly allowances can be enforced. These records don’t contain what you asked.
Product usage records: At most one row a day for each of a short list of moments, with no content: that you finished setup, logged something that day, opened a brief, saw or rated a pace check, answered “did this change a decision today?” about a brief, finished or skipped the welcome tour, tapped an upgrade offer, shared an invite link, a progress card or a map, joined a group, arrived from the pace calculator or a shared map, answered the partner step in setup, started a subscription, opened quick capture, used or cancelled voice, corrected or undid a capture, or reviewed a clarification. Capture records include the input surface, elapsed time and confirmation count; they exclude transcripts, objective names and microphone audio. They never include what you logged or what a brief said. We use them to learn whether Ceresis helps and how people find it; they are in your export and deleted with your account.
Device and notifications: If you turn on notifications, your browser’s push subscription (an address our server sends notifications to). If you allow location for the weather widget, your approximate coordinates — see “Weather” below.
Calendar: If you connect a calendar, the private iCal address you paste. Our server reads that feed to show your upcoming events; the events themselves aren’t stored. Disconnecting deletes the address.
Bug reports: If you send one from Settings, what you write, the page you came from, your browser type and screen size. We use it only to fix the problem; it’s deleted with your account.
Changes to your dashboard: When you add, retarget, hide or delete a tracker, task or goal, we record that it happened and when, so the activity console can show you. It records the change, never what you logged. Kept for 14 days, then deleted.
Corrections: When you correct a logged entry, we keep how it was first filed alongside it, so a wrong estimate can be traced. It’s deleted with the entry or with your account.
Abuse protection: Our host counts requests per network address for about a minute to stop floods of requests. Those counts aren’t tied to your account or kept.
Free tools without an account: The goal map and the pace calculator run in your browser, and nothing you type into them is sent to us. If you share a map, the link itself carries the map, in the part of the address browsers never send to a website: we don’t store a copy, and anyone you give the link to can see it. While you have the page open, the map is held in your browser tab so that an account made in that tab can start with it.
Cookies: The cookies that keep you signed in, one that remembers your chosen theme, and a session cookie for the full dashboard on a phone. Optional Google Analytics cookies are used on public pages only after you allow analytics, as described below. Advertising features are disabled.

Do Not Track. A Do Not Track or Global Privacy Control signal keeps optional marketing analytics off.

Optional marketing analytics

The waitlist

Groups

Ceresis Sensor (alpha)

What it sends: meaning, not detail. Calendar event times and an all-day flag under a generic plan label (never titles, notes or attendees); that you arrived at or left a place you saved, as its chosen name (“gym”), never coordinates or radius; activity classifications such as walking or still, with sensor confidence and a timestamp, as supporting context only; the name of the app or kind of site you used (“study”, never the page, its title or its address) and for how long; idle periods; the name of a project; when an assistant started or finished a task; and a note you typed to Sensor yourself. Each observation carries a confidence, which device and sensor produced it, and a unique id.
Mac passive context: foreground sensing is optional and uses app names and identifiers, input-active session times, and idle periods. It reads only seconds since input, never keys or what you type. After two minutes without input, app time stops. Tiny switches are filtered locally. An open app is uncertain evidence, never proof of work. Pause, sleep and shutdown close intervals; crash recovery uses the last saved sample and never fills unobserved gaps. Calendar observations on the Mac are generic plans, as on the phone. Optional Chrome browser sensing uses a separately enabled extension. It classifies only the active hostname locally and discards the URL immediately. Only a category and sampled input-active intervals are saved, with device and provenance. No domains, paths, query strings, titles, history, pages or forms are retained or uploaded. Private browsing is excluded; missing permission, idle, lost focus, pause and sampling gaps stop counted time. Safari sensing remains disabled. Screen Time availability does not block other sensors.
Optional Mac window and project context: Accessibility access is requested only when you enable window context. Only development editor titles are classified locally and immediately discarded; raw titles are never stored or uploaded, including in debugging mode. Browser and terminal windows are excluded. Projects are individually chosen directories, with no search of unrelated folders. Only bounded Git metadata inside those folders is read; source, commands and shell history are never collected. Uploads contain repo names and change flags, never directory paths, branch names or commit hashes, and do not assert who made a change or how long coding took. Folder bookmarks stay in a protected file on the Mac and can be removed. Quick captures may include recent semantic observation ids and times as uncertain supporting context.
What it never sends: what you type, screenshots, audio, messages or email, passwords, the contents of pages or files, source code, your full browsing history, or a continuous location trail.
Health: workouts and sleep from the phone’s health records are sent only after you have allowed health data (see “Health data”), and are refused by the server and by the database without it. The phone asks only to read workouts and sleep, never to write health records. It sends workout type, timestamps and active seconds, and asleep segment times and stages; no heart rate, calories, workout routes or health-source names. Places and motion also need current health consent. The phone checks the current decision before collecting; if consent cannot be checked, these sensors stop. Calendar and health source identifiers are hashed before upload.
Raw debugging uploads are off for every device. If you switch them on, a device may send more detailed observations to help fix a problem; Ceresis deletes each of those 7 days after it arrives. Turn the switch off and none are accepted.
On the device: a device keeps its own raw observations for 7 days by default (configurable from 1 to 30 days) and uploads only the descriptions above. Saved place centers and radii stay in a protected file on the phone, excluded from backups; you can remove them in Sensor. Saving a place uses a single location fix; boundary monitoring does not run continuous GPS. Calendar and health refresh when you open the app and periodically while it is active; place boundaries can wake it. Pausing stops passive sensors. Signing a device out deletes its stored sign-in and revokes that device only. Local tests and the live service keep separate device stores and upload queues; changing servers does not transfer previously captured records between them. Expiry never deletes an unsent or rejected queue record. Queues are separated by verified account and server. Captures made while signed out remain local and are never assigned automatically to the next account.
Evidence history: goal readings retain the measurement inputs, source references, metric definitions, time and calculation version needed to inspect the saved calculation. Manual corrections keep an ordered before-and-after history alongside Sensor corrections. These records are private to your account and included in your export. Deleting an entry removes its correction history and saved readings that depended on it. Removing Sensor evidence clears affected saved Sensor readings. Earlier summaries without complete source references are also cleared. Saved Briefs remain historical text and are marked when evidence changes; they are not silently rewritten.
What Ceresis makes of it: from these observations it works out events (what likely happened and for how long, with the observations behind each one) by fixed rules, not by a model. Anything uncertain stays marked as uncertain until you confirm it, and a calendar entry counts only as a plan, never as time spent. When you confirm, reject or change an event, or add one Sensor missed, Ceresis keeps your correction (including goal or project assignments, supplied start/end times and any reason) and the original beside it, so the test can measure how often it was right.
Review measurements: an optional review timer measures time while the review page is focused and visible. It records seconds, start/end times, day, device and clock-skew status, without monitoring keys or input. You may supply battery percentages and whether the device was on battery; these are optional measurements, not evidence that Sensor caused battery use. Daily source, overlap, correction and sync metrics are calculated from your records. Device diagnostics contain counts only. Web corrections and saved measurements persist in this browser’s IndexedDB, separated by verified account, until acknowledged or explicitly discarded; account deletion removes server copies, not local files or browser storage. Clear local storage separately.
Practice imports: if you choose a practice-results CSV in Sensor, it reads only that selected file (up to 64 KiB and 100 results). You preview its source/practice identifiers, timestamps and question counts and choose a goal before saving. We store those fields as private result events; accuracy is calculated from the supplied counts. The original file and unrelated file contents are not uploaded or retained. No directory monitoring or practice-provider access is enabled. Imports are user-supplied, not independently verified. Repeated identical imports count once; conflicting versions are withheld until you reject the wrong result. Manual results on the same day/field take precedence to avoid possible double counting. Use Review to reassign, reject or delete a result; correct counts by rejecting the wrong version and importing its replacement. Imports use the existing device queue, export and account deletion rules. Local copies must be cleared separately.
Your control: Sensor’s observations, events, corrections and saved review measurements are in your export, and deleting your account deletes them. Confirmed effort assigned to a goal can contribute to its compatible leading hours signal as a calculated reading, without creating a duplicate manual entry. A block you count as study in Activity also adds to your main study commitment's weekly figure, calculated when the page loads and never stored as an entry; blocks still waiting are shown beside that figure and never counted. Same-day manual amounts are conservatively overlapped; time spent never creates an outcome measurement. Links to recorded results are saved only when you choose them. Nothing from Sensor is shown to a group.

How we use it

To run the app: store what you log and show it back to you across your devices.
On Pro, to generate what you ask for: filing and estimates, photo reading, answers and briefs.
To enforce plan limits, prevent abuse, and keep the service secure.
To learn whether Ceresis Core actually helps — for example, whether people come back in their second week, or which parts of the app go unused — from the product usage records above and from counts of how often each part is used (how many entries or notes someone made, and when), never from what any of them say. Health information is never part of this: food, sleep, exercise and body measurements are left out of every count.
To email you about your account — confirmation and sign-in links, password resets, address-change confirmations, and security and billing notices.

Who processes it for us

We use a small number of service providers, each only for its part of running Ceresis Core:

Supabase: Database and sign-in. Your data is stored here, isolated per account.
Cloudflare: Hosting and delivery of the app, and the security check on the sign-in and password forms (Turnstile), which tells people from automated sign-in attempts. For that check Cloudflare reads your IP address and technical details from your browser; we get back only whether it passed, and it isn’t used for advertising.
Anthropic: AI processing, for Pro features only. The text or photo needed for a request is sent when you use a Pro feature. Under Anthropic’s commercial terms, it isn’t used to train their models.
MET Norway: Weather forecasts. Our server sends coordinates rounded to about a kilometre, with nothing that identifies you.
OpenStreetMap (Nominatim): Finding a city you type for the weather widget. Only the text you search for is sent. The city you choose is saved to your account.
Your calendar provider: Google, Apple, Outlook or whoever hosts the calendar address you connect — we request that feed from them.
Your phone’s push service: If you turn on notifications, briefs are delivered through your browser’s push service (Apple, Google or Mozilla). The message is encrypted so only your device can read it.
GitHub: Makes and stores our weekly database backup. The copy is encrypted as it is made, and the stored file can only be opened with a key that only we hold. Each backup is deleted after 28 days.
Resend: Sending the emails above. Resend handles the address we send to and the contents of that message; it holds nothing else about you and has no access to what you log.
Google: With your optional analytics permission, Google processes the public-page measurement described above. If you write to us at the support address, that message is forwarded into a Gmail inbox, so Google processes what you send us — including anything you attach to a request about your data.
Paddle: Payments for Pro. Paddle handles your card details; we never see or store them. We keep your Paddle customer and subscription IDs and your subscription status, so the app knows your plan.

Health data

The fuller account — what counts as health data, where it comes from, who sees it, and how to have it deleted — is in the Consumer Health Data Privacy Policy.

Your data, your call

Export: Settings → Data & privacy downloads your data as JSON or as a zip of CSV files, on any plan — everything you have logged or written, your settings, and the records we keep about your account. Two things are left out: the notification address your browser issues (it identifies a device, not you) and our internal payment and scheduled-job records.
Correct or delete: edit or delete any entry or note directly in the app, and change what’s on your group scorecards or leave a group at any time.
Delete your account: Settings → Data & privacy → Delete account removes your account and every row of your data immediately. Encrypted backups roll over and are gone within 30 days.
Other requests — access, restriction, objection, or a question about any of this — go to support@ceresiscore.com. We answer within 30 days.

How long we keep it

Security

Children

Ceresis Core isn’t for anyone under 16, and we don’t knowingly collect data from them.

Changes

If we change this policy in a way that affects how your data is used, we’ll tell you by email or in the app before the change takes effect.

Privacy Policy

Who we are

What we collect

Optional marketing analytics

The waitlist

Groups

Ceresis Sensor (alpha)

Sharing a week or a map

How we use it

Who processes it for us

Health data

Your data, your call

How long we keep it

Security

Children

Changes

Privacy Policy

Who we are

What we collect

Optional marketing analytics

The waitlist

Groups

Ceresis Sensor (alpha)

Sharing a week or a map

How we use it

Who processes it for us

Health data

Your data, your call

How long we keep it

Security

Children

Changes