Privacy
Short version: the model runs on your users' devices, decisions never need our servers, and we only use your email to talk to you about GenClass.
The runtime
The GenClass runtime makes every decision in the browser with a local model. It does not need a GenClass account or server to work.
From runtime 0.2.1, the runtime sends anonymous diagnostics by default on public hosts, to help improve the model, and does not send them from local or private hosts (localhost, *.localhost, *.local, *.test, 127.0.0.1, ::1, private IP ranges). Version 0.2.1 sent from those hosts too, by mistake, when GenClass started with GenClass.init(), the auto import or the script tag; 0.2.2 fixes this. By default they contain no text from the page: only a random per-page session id, versions, mode, device class, the app's hostname and id-normalised path, and for each decision the trigger, diagnosis and confidence, action, gate, outcome, latency and counts. The situation text the model read is sent only when the app opts in with telemetry: { include: { situation: true } }; with that on, the redacted situation can include route names with query strings, short error messages and short field values (see TELEMETRY.md). In either setting it never sends typed password, payment or secret values, cookies, headers, request or response bodies or storage contents, and the collector stores no IP address or user agent. Turn it off with GenClass.init({ telemetry: false }), ?genclass=no-telemetry, localStorage genclass.telemetry=off, or Global Privacy Control. Full details are in TELEMETRY.md.
Where the diagnostics go
From runtime 0.2.2 the runtime sends them to https://genclass.dev/api/v1/events, a Cloudflare Worker run by the GenClass maintainers (its source is telemetry-worker/ in the repository). Earlier versions used the same worker at genclass-telemetry.mehar-144.workers.dev. Batches are stored in a private Cloudflare R2 bucket and deleted 90 days after they arrive. The collector adds the time it received a batch and a two-letter country code, and stores no IP address, user agent, cookie or request header. We use the data to evaluate and train the model, and, for an app on the Custom plan, to train that app's own model, which only its account receives; we do not sell it or use it for advertising. The full list of fields is in TELEMETRY.md, and the terms for the collector are on the terms page.
To turn diagnostics off: GenClass.init({ telemetry: false }), ?genclass=no-telemetry, or localStorage.setItem("genclass.telemetry", "off"). Browsers that send Global Privacy Control are never collected. To have data from your site deleted, email mehar@daybot.ca with the hostname.
App tokens and dashboards
A developer can get a token and a private dashboard link for a web app at genclass.dev/start or with npx @genclass/runtime init, which, only after the developer approves its changes, sends us the name from the project's package.json. We keep one record per token: the token, that name, when it was created, when data first and last arrived, a one-way hash of the dashboard link's secret (never the secret itself), and the account it belongs to, if any. It is kept until the owner asks us to delete it; email mehar@daybot.ca with the token.
The token is public: it ships in the app's pages and only groups that app's diagnostics. Whoever holds the dashboard link sees that app's aggregated diagnostics (counts of decisions, detections and actions, its hostnames and routes, the names the developer gave to protected functions, model speed and versions) and a list of recent detections, never the situation text. Function names that look like data (an e-mail address, a URL, 4 or more digits in a row, a long hex id) are sent as [redacted]. Visitors who opt out or send Global Privacy Control, and local hosts, never reach a dashboard. Dashboard data is deleted after 90 days. Runtime 0.2.2 and earlier ignore tokens; the next release sends them.
Accounts
An account on genclass.dev is optional: the runtime, its diagnostics and private dashboard links work without one. If you create one, to keep your apps in one place or to connect an app with npx @genclass/runtime login (from the next release), it stores: your email as you typed it at passkey sign-up (we do not verify it) or as Google returned it, and whether it is verified; your passkeys' public keys, with when each was added and last used; your Google account id (sub) if you sign in with Google, and your GitHub user id and login if you sign in with GitHub; your sign-in sessions (a one-way hash of each session secret, its times, and the name the command line gave itself); and which apps you own, and whether each one's private dashboard link still opens it. Nothing else: no password, no IP address, and no Google or GitHub access token after sign-in. We use the email only for notices about your account.
Signing in sets one session cookie (30 days in the browser; a terminal signed in with the command line gets a 90-day token instead), and a Google or GitHub sign-in uses a cookie that lasts at most 10 minutes. Sign out, or revoke sessions, on your account page. To delete your account, choose Delete account on your account page while signed in: the account, its passkeys and its sessions are deleted at once, apps created in the account are deleted with their stats, and apps that still have a private dashboard link leave the account and keep working through that link. If you cannot sign in any more, email mehar@daybot.ca from an address Google has verified for that account; an account id or an unverified email alone is not enough.
Paid plans, payments and Stripe
The Pro and Custom plans are paid through Stripe, which processes payments for us. When you upgrade, we send Stripe your account's email (if it has one) and your GenClass account id, and you type your card or other payment details into Stripe's own checkout page: they go to Stripe and never reach GenClass. Stripe handles them under its own privacy policy and keeps your invoices and receipts, which you can see under Manage billing on your billing page. When GenClass sells Pro through Stripe Managed Payments, Stripe is the merchant of record for Pro purchases: it sells Pro to you through Link, its checkout service, so Link's name is on your Pro receipts and card statement, and Stripe handles the sales tax and payment support. To work out the tax, its checkout page asks for your name and billing address, which Stripe keeps and GenClass does not store.
GenClass stores only your Stripe customer id, your subscription id, the subscription's status and renewal or end date, and your plan. Never card numbers, bank details or billing addresses. When someone buys the Custom plan we also keep a record of the purchase (account id, email, subscription id, time) so that a person from GenClass can write to them to start the work.
Forwarding is off unless an account on a paid plan turns it on for one of its apps. Then, for each new detection from that app, GenClass sends a short record to the services that account chose (Sentry, PostHog, Datadog, Slack or its own webhook URL): the kind of problem, the model's confidence, what triggered the check, the page path, the runtime and model versions, the time and a link to the app's dashboard. Never text from the page. Those services handle the records under their own terms with the account owner. The keys and URLs for them are stored encrypted. Export lets an account on a paid plan download, or read with an export key, the events GenClass received for its own apps, as stored; export keys are stored as one-way hashes.
For apps on a paid plan, the dashboard data and the stored events are kept for 1 year instead of 90 days, and for 30 days after the paid period ends; then they are deleted as for every other app. Deleting your account cancels a paid plan at once and deletes the forwarding settings, export keys and stored copies made for your apps; Stripe keeps its own records of past payments as the law requires.
GenClass Cloud
Cloud is not available yet. It is planned to be optional and to receive only data from apps you connect with a publishable project key: aggregate metrics such as counts, categories and timings.
Early-access sign-ups
When you request early access we store your email, company, number of apps and the plan you picked. We use it only to contact you about GenClass, never sell or share it, and delete it on request.
This website
genclass.dev uses Cloudflare Web Analytics, which counts page views without cookies.