Privacy Policy

Genesis OS (also referred to as "Genesis OS", "we", "our", or "us") is an AI operating system for life, work, goals, and creation. Boris is the AI copilot inside Genesis OS that generates your missions, coaching, insights, and creative output. Genesis OS is operated by Genesis AI Applications LLC, a Delaware limited liability company, which acts as the data controller responsible for your personal data under applicable privacy laws, including the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA), and other applicable U.S. and international privacy statutes.

• Data minimization. We collect only what is necessary to deliver the features you use — nothing more.
• Purpose limitation. We use your data only for the specific purposes disclosed in this policy, and we ask for fresh consent before using it for a new purpose.
• No data selling. We never sell, rent, or broker your personal data to advertisers, data brokers, or any third party — as a business model or otherwise.
• No public model training. Your personal data and conversations are never used to train public AI models.
• Transparency. AI-generated content is clearly labeled, and you can see and control what Boris is allowed to read.
• You own your data. You can export, correct, restrict, or permanently delete your data at any time.
• Security by default. Encryption in transit and at rest, least-privilege access, and continuous monitoring are baseline, not optional.

For users in California (CCPA/CPRA), the legal bases above correspond to the "business purposes" and "commercial purposes" for which we collect and use personal information, as described in §15.

4.1 Account & Identity Data

Information you provide to create and authenticate your account.

4.2 Profile, Preference & Goal Data

Information you provide during onboarding and in Settings — this is what makes Genesis OS personal to you.

4.3 Activity & Usage Data

Generated as you use Genesis OS — the record of what you have done.

• Tasks completed, habits checked, missions finished, and their timestamps.
• Journal entries, reflections, and notes you author.
• Workout logs, sets, reps, weights, and personal records.
• Nutrition logs, meals, macros, and water intake.
• Chat conversations with Boris and AI-generated artifacts.
• Learning sessions, flashcard reviews, and progress entries.
• XP, achievements, streaks, and gamification history.
• Feature usage frequency (e.g., which widgets you open) — aggregated and anonymized for product improvement.

4.4 Health, Biometric & Wellness Data (Special Category)

You may voluntarily log sensitive health and fitness data. This is special-category data under GDPR Art. 9 and is processed only with your explicit consent.

• Body weight, measurements, and progress photos.
• Heart rate, sleep, and recovery data from connected wearables (if you connect one).
• Medication logs and health activity records.
• Mood, energy, and emotional check-ins.

4.5 Communication & Social Data

If you use social, community, or collaboration features.

• Direct messages, group conversations, and their content.
• Social posts, comments, likes, and reactions.
• Community memberships and roles.
• Collaboration group activity and shared workspace data.

4.6 Financial & Connected-Account Data

Payments are processed entirely by Stripe (PCI DSS Level 1). We never see or store your card number. If you choose to connect bank or credit accounts via Stripe Financial Connections, additional data flows apply (see §7).

4.7 Technical & Device Data

Collected automatically as part of operating the service and protecting it from abuse.

• IP address (used for security, rate limiting, and approximate geolocation).
• Browser type, operating system, and screen resolution.
• Device identifiers and push-notification tokens (if you enable notifications).
• Session tokens and authentication cookies (see §13 — Cookies).
• Crash reports and error logs (anonymized by default; device details only if you opt in).
• Page-view and feature-usage analytics (aggregated, not linked to your identity).

4.8 AI Processing Data

When you interact with Boris, portions of your relevant data are sent to third-party AI model providers to generate responses. See §6 for the full AI processing disclosure.

6.1 How Boris works

When you ask Boris a question, request a mission, or generate content, Genesis OS assembles a context window from the data you have authorized Boris to read (see §6.6), sends that context to a third-party AI model provider, and returns the generated response to you. The provider processes the request under its own data processing terms.

6.2 What is sent to AI providers

• Your current message or prompt.
• Relevant portions of your profile, recent activity, and goals — limited to the domains you have enabled in your AI access settings.
• Recent conversation history (for continuity within a session).
• Uploaded files or images you explicitly attach to a prompt.
• System instructions that shape the response (never your full database).

6.3 Boris memory system

Boris maintains a memory of your preferences, facts, and past conversations so it can be more useful over time. Memories are stored on our encrypted infrastructure and associated with your account. You can view, edit, and delete individual memories, or wipe all memories, from the Memory panel. Deleting a memory removes it from future AI context.

6.4 No training on your data

Your personal data and conversations are never used to train public AI models. Our agreements with AI providers explicitly opt Genesis OS traffic out of any training data pipeline. We may, separately and only with fully anonymized, aggregated data, improve our own internal prompt engineering and feature quality.

6.5 AI transparency & not professional advice

All AI-generated content is clearly presented as AI-generated. Boris does not have consciousness or professional credentials. Responses are statistical outputs of language models based on your input. Boris AI output is not professional medical, financial, psychological, legal, or investment advice. Always consult a qualified professional for consequential decisions.

6.6 Privacy controls — what Boris can read

In Settings → Privacy → AI Access, you can toggle Boris's access per domain (fitness, finance, learning, health, career, relationships, discipline, personal). A domain set to "off" is excluded from Boris's context when generating insights for any other domain. Your preference is enforced server-side — not just hidden in the UI.

7.1 Stripe Financial Connections (connected banking)

If you use the connected-banking feature in the Finance widget, you link accounts through Stripe Financial Connections. Stripe acts as the data conduit; we never receive your bank login credentials.

• You can disconnect any account at any time; we immediately mark it disconnected and stop syncing.
• We use connected-banking data only to display balances, track spending, and detect recurring subscriptions inside your Finance widget.
• We never use it for advertising, never share it with third parties, and never make financial decisions on your behalf.

7.2 Other optional integrations

Genesis OS may offer integrations with calendars, email, cloud storage, and other services via OAuth. When you connect one, you authorize the provider to share specific data with us under that provider's scopes. You can revoke any connection at any time, which immediately stops new data syncing.

The table below lists the categories of sub-processors we rely on, what they do, and the data they may process. Specific vendor names may change; we maintain a current list and notify you of material additions.

For users in the EU, EEA, UK, or Switzerland, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, the UK International Data Transfer Agreement (IDTA) or Addendum, and other recognized transfer mechanisms to ensure your data receives an adequate level of protection wherever it is processed.

• We conduct transfer impact assessments (TIAs) as required and document them on request.
• Where a sub-processor processes data in a third country, our data processing agreement requires them to apply equivalent safeguards.
• You may request a copy of the applicable SCCs by contacting us at the email in §19.

• Encryption in transit: TLS 1.3 for all data moving between your device and our servers.
• Encryption at rest: AES-256 encryption for all stored data, including databases, file uploads, and backups.
• Least-privilege access: Strict role-based access controls. Only authorized engineers can access production systems, and only via short-lived, audited credentials.
• Authentication security: Passwords are hashed with strong, salted algorithms. Two-factor authentication (TOTP) is available and the secret is encrypted at rest.
• Secrets management: API keys, signing secrets, and encryption keys are stored in a managed secrets vault with automatic rotation policies.
• Continuous monitoring: We monitor for security events, anomalous access patterns, and potential intrusions.
• Regular reviews: We periodically review access logs, dependencies, and infrastructure configuration for vulnerabilities.
• No card storage: We never store payment card numbers — Stripe (PCI DSS Level 1) handles all card data.

We maintain an incident response plan. If we confirm a personal data breach that poses a risk to your rights or freedoms, we will:

1. 1Notify the relevant supervisory authority within 72 hours of becoming aware of it, where required by GDPR Art. 33.
2. 2Notify affected users without undue delay where the breach is likely to result in a high risk to your rights and freedoms (GDPR Art. 34).
3. 3Describe the nature of the breach, the likely consequences, and the measures we are taking, including steps you can take to protect yourself.
4. 4Document the incident internally for accountability and post-incident review.

You can configure a shorter activity-log retention period in Settings → Privacy → Retention (e.g., automatically prune workouts, meals, and journal entries older than a number of days you choose, or retain forever). This puts a hard ceiling on how long your sensitive activity data lives in our system.

We show a cookie consent banner on first visit where required by law (e.g., the EU and UK). You can change your analytics preference at any time. We do not use advertising pixels, behavioral retargeting, or cross-site tracking.

14.1 Transactional (cannot be opted out)

Billing receipts, security alerts, password resets, and account changes. These are necessary to operate and secure your account; you cannot opt out of them while your account is active.

14.2 Product & reminder (opt-in, withdrawable)

Daily mission reminders, weekly performance summaries, feature announcements, and founder updates — sent only with your consent during onboarding or in Settings. You can opt out anytime from notification settings in the app or by emailing us. Opting out never affects transactional emails.

15.1 Exercising your rights

1. 1Use the in-app tools: Settings → Privacy (export your data, adjust AI access, set retention), Settings → Account (delete account), Memory panel (delete memories).
2. 2Email us at support@genesis-applications.com with the right you wish to exercise. We respond within 30 days (72 hours for urgent erasure).
3. 3We verify your identity before acting on a request to protect your account from unauthorized access.
4. 4For GDPR rights you may also lodge a complaint with your local Data Protection Authority; for CCPA, with the California Privacy Protection Agency.

When you submit a request by email, we match it to the email address on your account. For high-impact requests (full data export, account deletion, or restricting processing), we may require you to complete the request from within your logged-in account, or to confirm additional details. This prevents bad actors from deleting or exporting your data without your permission.

We do not knowingly collect personal data from children under 16, and we do not knowingly process the special-category data of minors. If you are a parent or guardian and believe your child has created a Genesis OS account, contact us immediately at support@genesis-applications.com and we will delete the account and all associated data promptly. For users in jurisdictions with a higher minimum age (e.g., 16 in parts of the EU), the higher age applies.

• We will notify you of material changes by email and an in-app notice at least 14 days before they take effect.
• Non-material changes (clarifications, formatting) may be made without separate notice; the "Last updated" date at the top of the page will reflect the change.
• Your continued use of Genesis OS after a material change takes effect constitutes acceptance of the updated policy.
• The version number at the top of this page helps you track what changed and when.

We aim to respond to all privacy inquiries within 5 business days, and to urgent data-subject requests (erasure, restriction, access) within 30 days — faster where required by law.