Neron App Studio

1. Introduction

NERON ("we", "our", or "us") operates the Cortis mobile application ("the App"). This Privacy Policy explains how we handle your information when you use Cortis.

Cortis is designed with privacy as a core principle. By default all AI processing happens on your device and Cortis does not upload your conversations. The optional Remote Server (Pro) sends your messages to the server you choose.

2. Information We Collect

2.1 Data Stored On Your Device

The following data is stored locally on your device and is never transmitted to any server:

Conversations: All chat messages and AI responses are stored in a local SQLite database on your device.
AI Models: Downloaded model files are stored in your device's local storage.
App Settings: Your preferences (language, haptic feedback, active model) are stored locally.
Purchase Status: Whether you have purchased Cortis Pro is cached locally for instant access.
Calendar, reminders and contacts (assistant): When you ask the assistant (see 3.5), it reads your calendar events and reminders for the date range you asked about, and finds contacts by name (phone numbers only when you ask for them). The results are shown in the chat and saved in that conversation in the local database on your device. The assistant can save a new event or reminder only after you tap a confirmation card.

2.2 Data We May Process

Purchase Information: When you make a purchase, the transaction is processed by Apple through the App Store on iOS, or by Google through Google Play on Android. RevenueCat, our purchase management provider, receives anonymous purchase data to manage entitlements. We do not receive your payment details.

2.3 Analytics and Crash Reporting

We use Firebase Analytics (provided by Google) to collect anonymous usage data that helps us understand how our app is used and improve user experience. This includes:

Screen views and feature interactions
App version and device information (device model, operating system version)
General location data (country/region level, derived from IP address)
Session duration and frequency

We use Firebase Crashlytics (provided by Google) to automatically collect crash reports when the app encounters issues. This includes:

Crash stack traces and error messages
Device state at time of crash (memory, storage, battery)
App version and operating system version

This data is processed by Google under their Firebase Privacy Policy. Cortis does not send your name or e-mail address to analytics. Cortis asks you after the introduction whether analytics and crash reports may be sent (accept all, crash reports only, or decline). Until you answer, the app collects anonymous usage and crash data by default. A Settings switch to change this choice later is planned. If you use the Remote Server feature, usage events include the address of your own server (an IP address or host name of the server you picked or entered); they do not include chat text. If you use referrals, your referral code is included in usage events.

2.3.1 Referrals (Firebase Cloud Functions)

If you use the referral feature, the app calls our Firebase Cloud Functions, which run on Google's servers:

claimCode creates your referral code. It receives your RevenueCat app user ID (an anonymous ID, not your name or e-mail), your platform and the app version.
attribute records that an invited person used a code. It receives the referral code, the invited person's RevenueCat app user ID, how the code was entered, their platform and the app version.
shareClick handles a click on a shared invite link. It stores the raw browser user-agent (device information), the detected platform and a salted hash of the IP address, not the IP address itself.

Referral records are stored in Firestore. They hold the RevenueCat app user ID, a salted hash of the IP address and, for share-link clicks, the raw user-agent string. They can be deleted through our deletion request page.

2.4 Data We Do NOT Collect

We do not collect your conversations or prompts
We do not collect your calendar, reminders or contacts. The assistant reads them on your device only; they are not uploaded and not sent to Firebase Analytics or Crashlytics.
We do not collect voice or audio data. Voice input uses your device's own speech recognition (see 3.3)
Cortis shows no ads and uses no ad networks. On Android, Firebase Analytics includes Google's advertising-ID permission, which Firebase may use for analytics and install attribution.
We do not collect your name or e-mail address through the app. Firebase assigns a random app-instance ID to analytics and crash data. If you send a deletion request, we receive the contact e-mail you enter in the form.
We do not have accounts — there is nothing to sign up for

3. How AI Processing Works

3.1 On-Device Inference (Default)

Cortis uses on-device AI inference powered by llama.rn. When you send a message:

Your message is processed by the AI model running locally on your device
The AI generates a response using your device's processor (CPU/GPU)
The conversation is saved to a local database on your device
No data is sent to any external server during this process

3.2 Remote Server Inference (Optional, Pro Feature)

Cortis Pro includes an optional feature that allows you to connect to your own self-hosted LLM server (such as Ollama or LM Studio) running on your local Wi-Fi network. When using this feature:

The feature is off by default. When you set it up, Cortis scans your local network for Ollama and LM Studio servers and you choose which one to use; you can also enter a server address yourself
Your messages are sent to the server you configured for AI processing
This connection is entirely user-initiated
Your chat text goes only to the server you configured, not to NERON. Usage analytics events include that server's address (see 2.3).

3.3 Voice Input (Speech-to-Text)

Cortis includes an optional voice input feature that converts your speech to text. When you use this feature:

On iOS, your voice is processed on your device using Apple's on-device speech recognition
On iOS, no audio data is recorded, stored, or transmitted to any server — including Apple's servers
On Android, voice input uses the speech recognition service of your device, which may be provided by Google. Cortis requests on-device recognition, but we cannot verify from the app whether a particular device keeps recognition on the device.
On both platforms Cortis requests on-device recognition where the platform supports it (requiresOnDeviceRecognition)
The resulting text is placed in the chat input for you to review and edit before sending

3.4 Text-to-Speech (Pro Feature)

Cortis Pro can read AI responses aloud using your device's built-in text-to-speech engine. This processing happens entirely on your device — no text or audio data is sent to any external service.

3.5 Assistant (Calendar, Reminders, Contacts)

The Cortis assistant can look things up in your calendar, reminders and contacts, and can add events and reminders for you. When you use it:

Cortis asks for each permission (calendar, reminders, contacts) when the assistant first needs it. You can revoke any of them at any time in your system settings
The assistant reads calendar events and reminders for the date range you asked about, and finds contacts by name. It returns phone numbers only when you ask for them. The results appear in the chat and are saved in that conversation in the local database on your device
The assistant only creates events and reminders, and only after you tap a confirmation card that shows exactly what will be saved. It never edits or deletes existing events or reminders
The assistant never creates, edits or deletes contacts
The assistant runs only on the on-device model. It does not run in Remote Server chats
Analytics events for the assistant carry only the kind of action, a count and the model ID, never titles, dates or names. Crash reports carry error codes only
Cortis does not send anything from your calendar, reminders or contacts to NERON, Firebase, RevenueCat or any other server
Where a saved event or reminder goes: an event or reminder you save is stored by your phone's calendar or reminders provider, which may sync it to your own iCloud or Google account according to your phone settings. That is done by your phone's operating system, not by Cortis. On Android, reminders are saved as calendar entries

4. Third-Party Services

Firebase Analytics (Google): Anonymous usage analytics to understand app usage patterns. See Firebase Privacy Policy.
Firebase Crashlytics (Google): Automatic crash reporting to improve app stability. See Firebase Privacy Policy.
RevenueCat: Manages in-app purchase entitlements. Receives anonymous purchase data from Apple or Google. See RevenueCat Privacy Policy.
Google Play: Handles payment processing for purchases on Android. See Google Privacy Policy.
Apple App Store: Handles payment processing for purchases on iOS. See Apple Privacy Policy.
Hugging Face: AI model files are downloaded from Hugging Face servers. Only the model download request is made — no user data is transmitted.
Expo Updates: The app checks for over-the-air updates from Expo's update service. Only app version and platform information is transmitted — no user data is shared.
Unsplash: Decorative images in the Explore section are loaded from Unsplash servers. Standard image requests are made — no user data is transmitted.

5. Data Storage and Security

All your data is stored locally on your device using SQLite and MMKV local storage. Data is protected by your device's built-in security features including iOS Data Protection (passcode, Face ID, Touch ID) on iOS and your screen lock on Android.

Deleting the app will permanently remove all locally stored data including conversations, settings, and downloaded models.

6. Your Rights

What you can do with your data:

Access: Your conversations and downloaded models are stored on your device, where you can use them at any time
Delete: Delete individual conversations in the app, or use Settings > Storage & Data > Erase All Data to delete conversations, downloaded models, custom personas, server configurations and settings. Uninstalling the app also removes this data from your device. Analytics and crash data already collected cannot be deleted on request. Referral records can be deleted through our deletion request page. Purchase records are held by Apple or Google and by RevenueCat.
Portability: You can export a conversation as a Markdown file from the conversation list. We do not hold your conversations on our servers, so there is nothing to export from us.

7. Children's Privacy

Cortis is not intended for children under 13. We do not knowingly collect any personal information from anyone, including children.

8. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by updating the "Last updated" date.

9. Contact Us

If you have questions about this Privacy Policy, contact us at: [email protected]