Privacy Policy

Cernix is a Windows desktop application. It runs entirely on your computer.

We do not operate an application server, run analytics, collect telemetry, or maintain user accounts of the username-and-password variety. When you connect Cernix to your Google Drive (optional), the app talks to Google's API directly from your machine — your photos and metadata go to your own Drive account, not to us. We could not collect them even if we wanted to: there is nowhere for them to land.

Cernix is free and open source. There is no purchase, no licence key, and no payment processor — so there is no billing data to collect. The only external services involved are the ones you opt into (Google Drive), plus the fonts the app loads at startup.

This page documents every external request Cernix makes, every OAuth scope it requests, and every byte it writes to your disk. If something on this page is not accurate, that is a bug — please file an issue.

What Cernix reads on your machine

1. Removable drives. When you insert an SD card or USB stick, Cernix's volume watcher reads its file list, EXIF metadata, and chosen files (you decide which). Originals stay on the card unless you explicitly stage them.
2. Your local archive folder. Once you sweep files off a card, Cernix writes them to a date-organised local folder (YYYY / Month / DD) under the directory you pick.
3. XMP sidecars. Every adjustment you make in the editor is written to a tiny .xmp file next to the RAW. Your RAW pixels are never modified.
4. App-data files. An encrypted token file (auth-tokens.enc, see "What's sent to Google" below) and a SQLite ledger (sync.db) live in %APPDATA%\Cernix. The ledger records which files you've already uploaded so Cernix doesn't re-push them.
5. Caches. Thumbnail, preset-preview, and generative-fill caches under %APPDATA%\Cernix. Safe to delete; they regenerate.

What Cernix sends to Google

Two separate destinations. Drive is opt-in and does nothing until you connect an account; fonts are not — see below.

1. Google Drive (when you connect your account)

OAuth scopes Cernix requests:

drive.file — access limited to files Cernix itself creates. It can upload RAW + XMP pairs into its own folder and browse what it put there; the rest of your Drive is invisible to it, including to a compromised copy of the app.
userinfo.email — the email address linked to your Google account, shown in the app so you know which account is connected.
userinfo.profile — display name and avatar, shown in the in-app account widget.

Tokens received from Google are encrypted with Electron's safeStorage (which delegates to the OS keystore — DPAPI on Windows) and written to auth-tokens.enc. They never leave your machine except to be refreshed against Google's own token endpoint.

When you sync, Cernix uploads the RAW + XMP files you select to the Cernix folder in your Drive. That's the only destination. There is no Cernix server in the loop.

2. Google Fonts (on every launch)

This is the one request Cernix makes without being asked. The app loads its two typefaces from fonts.googleapis.com and fonts.gstatic.com at startup, which means Google sees your IP address and approximate location every time you open it — even if you never connect Drive.

No account, no cookie, and nothing identifying you as an Cernix user is attached; it is the same request any website using Google Fonts makes. We would rather it did not happen at all, and bundling the fonts with the app would remove it. That is a change we intend to make.

Offline, the request fails silently and the app falls back to a system font. Nothing else about Cernix depends on it.

What Cernix never collects or transmits

· No analytics. No Google Analytics, no Mixpanel, no Sentry, no PostHog. Open the network panel and you will see the app talk to Google's APIs and nothing else.
· No telemetry. Cernix sends zero usage data — no event counts, no feature usage, no error reports.
· No crash reporting. If the app crashes, the crash stays on your machine.
· No device fingerprinting. Cernix does not generate or transmit a device ID.
· No IP logging. Because there is no Cernix server, there is no Cernix access log.
· No third-party trackers. This page loads no third-party scripts, fonts, or beacons — the app does load its fonts from Google, disclosed above. The network panel on first load shows requests only against this site's own origin.
· No cookies. The desktop app is not a web app; this landing page sets no cookies.

Your data, your control

→ Disconnect Google Drive. Settings → Account → Disconnect inside the app, or revoke Cernix's access directly at myaccount.google.com/permissions.
→ Delete all local data. Uninstall Cernix, then delete %APPDATA%\Cernix. Token, ledger, caches — all gone.
→ Files in your Google Drive. They stay until you delete them in Drive. Disconnecting Cernix does not touch them.

Changes to this policy

Material changes will be reflected here with an updated Last updated date at the top. Cernix has no email list, so we cannot notify you of changes — please re-read this page after each app update.