PrismNext

Effective 25 August 2026

Privacy Policy

This Privacy Policy explains how the PrismNext desktop application and this website handle information. Please read it together with the Terms of Use.

1. Introduction

PrismNext is a local-first desktop application for scientific research. It is developed and published by yibocat (the “Publisher”). The public website is https://prismnext.pages.dev. The source repository is github.com/yibocat/prismnext.

The Publisher does not operate a PrismNext account system, does not host your manuscripts or libraries, and does not provide a model-inference proxy. This Policy describes (a) information that remains on your device, (b) information that may leave your device when the software or this website communicates with third parties, and (c) information that the Publisher does not collect.

This Policy is a product disclosure. It is not legal advice and does not create a data-processing agreement, business-associate agreement, or similar contract.

2. Scope

This Policy applies to:

This Policy does not apply to:

3. Information the Publisher does not collect

The Publisher does not collect, and the application is not designed to transmit to the Publisher:

The exception is correspondence you send to the Publisher (for example an email to the address in Section 15). The message, and the address you send it from, are then held by the Publisher in order to reply.

“Zero telemetry” in PrismNext marketing means the absence of a Publisher-operated analytics or usage pipeline. It does not mean that the application never opens a network connection. Sections 5 and 6 list the connections that do occur.

4. Information stored on your device

4.1 Project directory

When you open or create a project, your manuscript and Git history remain in the project folder you chose. PrismNext writes project-bound metadata under .workbench/ inside that folder. This may include agent instructions and rules, compile cache, experiment records, project settings, and project-level teams. You control this directory as part of the project folder.

Older installs may still have a legacy .prismnext/ folder beside the manuscript. Current builds do not read or write it as a configuration source.

4.2 Application home

Cross-project state lives in the application home directory ~/.prismnext/ under your user profile. This may include:

Deleting a project folder does not delete that project’s session records or library slot in ~/.prismnext/.

4.3 Application data folder

Global application settings are stored in the Electron user-data folder provided by the operating system:

That folder may contain encrypted API keys and preferences, application-level teams, a Pro license file, a composer attachment cache, and the Chromium profile used by the application (including the in-app Browser partition).

4.4 Logs and temporary files

The following locations are outside the two homes above, but are created by the software:

4.5 This website

The website stores theme, language, and backdrop preferences in your browser’s localStorage. It does not create an account.

5. Information transmitted automatically

Official builds contact the Publisher’s software-update feed (hosted on Cloudflare R2) at startup, when the sidebar update affordance refreshes, and when you use Check for updates. The feed operator may observe an IP address, a user-agent string, the requested object (for example version.json or a platform manifest), and the approximate time of the request. From that, it may be inferred that a given application version checked for updates.

This website’s homepage (not these legal pages) fetches the same public feed so it can show the current version and download links. That request is made by your browser, not by the desktop application.

There is not currently a separate setting to disable the automatic update check. You may disable automatic download of updates in Settings → About. Installation of an update still requires your confirmation.

The Publisher does not use the update feed as a product-analytics system and does not combine it with project contents. Server logs retained by the hosting provider are subject to that provider’s policies.

6. Information transmitted when you or the agent initiate a request

The following transmissions occur only after you (or an agent acting with your permission) start the relevant action. The recipient is the third party named, not the Publisher. Each recipient’s own terms and privacy policy apply.

6.1 Model providers (bring your own key)

Prompts, conversation context, attachments you include, and the API key you configured are sent directly to the provider or custom endpoint you selected. The Publisher does not relay these requests.

6.2 Bibliographic catalogs and paper files

Queries and identifiers may be sent to Crossref, PubMed, DBLP, arXiv, Semantic Scholar, OpenReview, OpenAlex, DataCite, bioRxiv, and medRxiv in order to resolve metadata. If you download a paper or take an HTML snapshot, the file or publisher page is fetched from the URL the catalog or identifier resolved to (commonly arXiv or an open-access link). Optional catalog API keys you store (PubMed, Semantic Scholar) are sent only to that catalog. These requests include a product User-Agent that names PrismNext and a contact mailbox. Local PDF.js extraction does not upload the file.

6.3 Document parsing (MinerU)

If you request MinerU parsing, the selected PDF is uploaded to MinerU together with the token you stored. The file contents are therefore disclosed to that service.

6.4 Zotero

If Zotero desktop is running on the same machine, PrismNext may talk to the local connector (and, if installed, Better BibTeX) on localhost. That traffic does not leave the device. If you store a Zotero Web API key, synchronization requests are sent to Zotero’s API together with that credential.

6.5 Agent network tools

A session that is permitted to use the network may call the agent’s web-search and web-fetch tools. Web search, when enabled, uses Exa; query text is disclosed to Exa. Web-fetch requests go to the URLs the agent retrieves.

6.6 In-app Browser

Pages you open make ordinary web requests to the sites you visit. Cookies and site data for that Browser are stored in the application’s persist:browser partition, not in your everyday browser profile.

6.7 Skill installation

Installing a skill from a URL downloads the archive from that URL (commonly GitHub). The host may log the request.

6.8 LaTeX compilation

Compiling a document with the bundled Tectonic engine may download missing TeX packages from Tectonic’s package network. A system TeX Live install uses whatever sources that install is configured to use.

6.9 Git, MCP, and endpoints you connect

Git fetch and push, user-configured MCP servers, and custom model endpoints send whatever those protocols require to the host you configured. The Publisher does not operate those hosts.

7. Cookies and similar technologies

The desktop application does not use web cookies for Publisher analytics. The in-app Browser may accept cookies from sites you visit, as those sites request.

This website uses localStorage for appearance and language. It loads typefaces from Google Fonts, which is a third-party request from your browser. The site is hosted on Cloudflare Pages; Cloudflare may log IP addresses and request metadata in accordance with its policies. The homepage also requests the public release feed (Section 5). The site does not embed a third-party analytics script.

8. Third parties

The Publisher is not responsible for the privacy practices of model providers, catalog operators, MinerU, Zotero, Exa, Tectonic’s package hosts, Git hosts, MCP operators, Cloudflare, Google Fonts, or any site opened in the Browser. You should review those parties’ policies before sending them data.

9. Retention

Local files remain until you delete them, uninstall the application and remove leftover folders, or the operating system deletes temporary files. The Publisher does not retain a copy of your projects. Update-feed logs, if any, are retained only as the hosting provider retains ordinary web logs. Email you send to the Publisher is retained as long as needed to understand and reply to it, then according to the mailbox provider’s ordinary retention.

10. Security

API keys and settings are stored in the application data folder on your device. Where the operating system provides it, secrets are encrypted at rest with the platform secret store. Encryption is not available in every environment, and it does not protect keys you paste into chat or send to a provider. You are responsible for the physical and account security of that device, for filesystem permissions, and for any secrets you paste into chat. No method of electronic storage is completely secure.

11. International transfers

When you use a third-party service, that service may process information in a country other than your own. Those transfers are made by you (or the agent you authorized) to that service, not by the Publisher acting as your processor.

12. Your choices; deletion

You may:

Uninstalling the application does not always remove application data, ~/.prismnext/, logs, project .workbench/ directories, Downloads, or third-party caches. If you wish those deleted, you must delete them yourself.

Because the Publisher does not hold your project data, the Publisher cannot remotely erase it for you.

13. Children

PrismNext is a research desktop tool. It is not directed at children, and the Publisher does not knowingly collect personal information from children.

14. Changes

The Publisher may revise this Policy when the software’s data practices change. The effective date at the top of this page will be updated. Material changes will be reflected in the application changelog where appropriate. Continued use of a new version after the effective date constitutes acknowledgment of the revised Policy.

15. Contact

Questions about this Policy may be sent to yibocat@yeah.net. Security reports should follow the Security page.