Privacy
There is nothing to collect it with
Most privacy pages are a promise. This one is an architecture: the product has no account, no server and no network code, so the interesting question is not what we would do with your data but where it could possibly go.
What is collected
Nothing. Not anonymised usage, not crash reports, not a count of installs. The app contains no analytics library and makes no outbound requests; the engine makes none either, beyond whatever a source you explicitly connect requires in order to be read.
If the window crashes it writes what happened to ~/.coredence/crash.log and shows it to you the next time it opens. That file stays on this machine; if you want it to reach us, you copy it and send it to support@coredence.com yourself. That is why no crash reporter is wired in: a claim you can check without a socket is worth more to you than a crash report would be to us.
You do not have to take that from us. Two commands settle it in a way reading source code never could — one asks the operating system what the program has open, the other opens your whole identity in a tool nobody here wrote.
Where your identity lives
One file, in your home directory
~/.coredence/coredence.db — a plain SQLite database. It never leaves the machine unless you move it.
Read-only in the app
The viewer opens that file with a read-only handle. It cannot change what it shows you, and that is a property of the file descriptor rather than a policy.
Yours to delete
Delete the file and the identity is gone. There is no copy anywhere else, because there is nowhere else.
Checking it yourself
You do not have to believe any of the above. While the app is running, ask the operating system what it has open — it should be the database and nothing across a network.
The first should print nothing at all — not a filtered list, nothing. The second prints every table in your identity. Neither depends on trusting a word on this page.
One honest caveat, because a promise with an unstated exception is worth nothing: while it is distilling, the engine calls the model you chose. That is a connection, it goes from your machine to the provider whose key you entered, and it carries the passage being read. It is the one thing that leaves, it happens only during a pass, and choosing a model that runs on your own machine removes it entirely.
A second exception if you pick the Coredence plan: the same call is then relayed through our proxy, because we pay for the model. The proxy keeps no rules and no text — the only thing it stores is the tokens spent per licence, because there is no other way to count a quota, and a test holds it to that. From there the text goes to the model, and that provider's own retention applies. This option is not the default, and if you never pick it there is no proxy in the picture at all.
This website
The site is static and sets no cookies of its own. The one exception is Google Analytics: we use it to count visits, see which pages are read and which download or the demo was clicked, and it loads only if you allow it in the bar at the bottom of the page. If you decline, or never choose, not a single request goes to Google.
If you allow it, Google stores an identifier cookie (_ga) in your browser and processes your visit — the page, where you came from, device type, a city-level location derived from your IP address — on servers that may be outside your country. Google signals and ad personalisation are turned off; the data is not used for advertising and has no link to the app. You can change your mind at any time: . Withdrawing deletes the cookie and stops the measurement.
The graph you see is generated at build time from invented data; it is not anybody’s identity.
If the site is hosted somewhere that keeps standard server logs, those logs exist. We do not read them for anything and there is no identifier in them that ties a request to a person using the app, because the app never contacts this site.
If that ever changes
Any future feature that needs a server — syncing an identity between two of your own machines, for instance — would be optional, off by default, and described here before it shipped. The local product would keep working without it. Nothing that reads your work will ever require an account.