Privacy Policy

Last updated 13 October 2026

Kern is made by Christian Relf ("we", "us"). This policy covers the Kern desktop app, the optional Kern Cloud service (accounts, sync and collaboration), and this website. In short, Kern works without an account, and we only see data you choose to put into Kern Cloud. We don't sell or rent your data, show ads, or run analytics.

1. Using Kern without an account

Without a Kern Cloud account, everything you create in Kern (tasks, projects, notes, whiteboards, settings, files and so on) is stored only on your computer, and we receive none of it. There's no telemetry, analytics or crash reporting.

A few optional features connect from your computer straight to other services. None of them go through us:

• Update check: asks GitHub whether a newer release exists.
• Link previews: fetch the title and icon of a link you add, from that link's website.
• GitHub integration: talks to GitHub with a token you provide.
• AI features: send the content Kern shows you beforehand to the AI provider whose API key you entered.

Those services handle your data under their own privacy policies. You can turn all of these features off with one switch in Settings → Privacy. Kern keeps tokens, passwords and API keys in your operating system's secure credential store.

2. What Kern Cloud collects

If you create a Kern Cloud account, we store:

• Account details: your name, email address, a hashed password (never the password itself), an optional profile picture, and whether your email is verified.
• Sign-in sessions: a session token, its expiry date, and the IP address and device/user-agent string it was created from, so you can review and sign out other sessions. Sessions expire after 60 days without use.
• One-time codes for verification, sign-in and password recovery. These are stored hashed and expire after 10 minutes.
• Content you sync, in your personal space and in any workspaces you belong to: projects, project groups, boards, tasks, labels, milestones, release links, notes, inbox items, whiteboards, linked repository names and GitHub issue links. Images placed on shared whiteboards are uploaded as compressed copies. When you delete an item, a small deletion marker is kept so your other devices know to remove it too.
• Workspace details you enter: name, ID, description, logo, colour, website, industry, team size, use case, time zone and GitHub organisation.
• Membership: which spaces you belong to, your role and job title, who invited you, and when you joined.
• Invitations: the invited email address, an optional message, and whether it was accepted, declined or revoked.
• Workspace activity log: events such as members joining, role changes and imports, shown to workspace admins.

Files, folders, code, terminal sessions, environment variables, settings and AI keys never leave your computer, even when you're signed in. Live presence information (which view you're on, whiteboard cursors, selections and drags) is passed between collaborators in real time but never stored.

We also process IP addresses briefly to rate-limit sign-in and sign-up attempts and protect the service from abuse.

3. Why we use it

• To run your account and keep it secure: signing you in, verifying your email, recovering your password and preventing abuse.
• To sync your content between your devices and share it with the people in your workspaces.
• To send emails you need, such as verification codes, invitations, a welcome message and "password changed" notices. We don't send marketing email.

If data protection law such as the UK or EU GDPR applies to you, our legal basis is performance of our agreement with you (providing the service you signed up for) and our legitimate interest in keeping the service secure.

4. Who can see your data

• Your workspaces' members can see the workspace's content, its member list (names, emails, roles and titles), and pending invitations. Admins can also see the activity log.
• Service providers that help us run Kern Cloud: Cloudflare, which carries traffic between the app and our server, and our email delivery provider, which sends account emails. They only get the data they need to do that.
• Authorities, if the law requires it.

We never sell your data or share it for advertising.

5. Where it's stored and how it's protected

Kern Cloud runs on a server operated by us, behind Cloudflare. All traffic is encrypted in transit (HTTPS and secure WebSockets). Passwords and one-time codes are stored only as hashes. Every request is checked against your role in the space it touches, and viewers can't make changes. We back up the database regularly.

6. How long we keep it

• Your account and content stay until you delete them or your account.
• Deleting your account (Settings → Account & Cloud) permanently removes your account, sessions, personal space and any workspace where you're the only member. If you own a workspace that other people still use, you'll need to transfer or delete it first.
• Changes you made in other people's workspaces stay part of those workspaces, since they belong to that team. They're no longer linked to an account.
• A deleted workspace closes for all its members right away. Its data may stay in our database for a while after that. If you'd like it purged sooner, ask us.
• Whiteboard images that nothing uses any more are removed automatically after 7 days.
• Deleted data may remain in backups until those backups are replaced.

7. Your choices and rights

In the app you can edit your name, email and password, sign out other sessions, leave workspaces, export your data (Settings → export to JSON, Markdown and CSV), and delete your account. Depending on where you live, you may also have the right to access, correct, delete or port your data, to object to or restrict how we use it, and to complain to your data protection authority (in the UK, that's the ICO). For anything you can't do in the app, contact us using the details below.

8. This website

kern.chrisrelf.xyz is a plain static site. It sets no cookies and has no analytics or third-party scripts. Our hosting provider may keep standard server logs, such as IP addresses and requested pages, for security and reliability.

9. Children

Kern Cloud isn't intended for children under 13, or under the age of digital consent where you live. You can use the app offline at any age.

10. Changes

If we change this policy, we'll update the date at the top. If the changes are significant, we'll also tell signed-in users in the app or by email before they take effect.

11. Contact

For questions or requests about your data, email kern@chrisrelf.xyz.