Privacy notice
Genesis is a personal planning app: it holds your tasks, your schedule and the objectives you are working towards, and it helps you keep them in one place. This notice explains, in plain English, what we collect, why we collect it, who else sees it, how long we keep it, and what you can do about it.
It applies to the hosted Genesis instance used by the pilot group. It covers everyone who signs in, and there is no tracking, profiling or advertising in the app.
Who we are
The operator of this Genesis instance decides what personal data is processed and for what purpose; in data-protection terms the operator is the controller.
- Controller: Kevin Mamalis, operating this Genesis instance personally (not through Motiontech).
- Contact for anything in this notice: [email protected]
What we process
- Your Google account. When you sign in with Google we receive your name, your email address and your profile picture. We use them to recognise you, to show who is signed in, and to decide whether you are allowed into this instance. We do not read your Gmail, your Google Calendar, your Drive or anything else in your Google account.
- The planning data you enter or import. Tasks (names, descriptions, categories, priorities, deadlines, status), your schedule and the days you work, your availability, your objectives and their key results and planned hours, and your check-ins. Everything in this list is data you typed, imported from a spreadsheet, or confirmed in the app.
- Your calendar feeds. If you add a private calendar feed URL, we store that URL encrypted (AES-256-GCM) and fetch it to read meeting titles and times. The URL is shown back to you masked, and it is never sent to the language model described below.
- Invitations. If an admin of your organisation invites someone, we store the email address the admin typed, the role offered and the invite’s dates, so that person can sign in with that address. The address is kept on the invite and in the inviting admin’s audit trail. It is removed from both when that person deletes their Genesis account; someone who never signed up can ask the contact above to remove it.
- Technical logs. When the app or the planning engine handles a request we record a request id, a timestamp, the operation, the status or error code and how long it took. These logs exist to find and fix faults. They do not contain your task text, your calendar URL, your exports, or the prompts and answers of the nightly refinement.
Why we process it, and on what basis
- To provide the service you signed up for — storing your planning data, showing it back to you, importing and exporting it. Legal basis: performance of a contract with you.
- To keep the service running and secure — technical logs, backups, and access control. Legal basis: legitimate interest in operating a reliable, secure service.
We do not use your data for advertising, and we do not sell it or share it for anyone else’s marketing.
Nightly refinement and the language model
Once a night, if the operator has enabled it for this instance and you have turned it on for your workspace, Genesis asks a language model to look at the tasks that are still missing fields and to suggest values for them. This is the only feature that sends any of your content to a third party for processing beyond storage and sign-in.
What is sent, per batch: the names of your objectives and key results, the workspace’s learned patterns from earlier runs, and — for each task being refined — its task id, name, objective, category, priority, deadline, the list of missing fields and, when present, the description (truncated to 400 characters). That is all.
What is never sent: meeting titles, attendee names or emails, invitee details, calendar feed URLs, your email address, your name, your user id or workspace id, task notes on key results, your schedule layout, and your availability. docs/security/llm-data-flow.md is the precise inventory.
Turning it off. Refinement is off for your workspace until the workspace owner switches it on, and the owner can switch it back off at any time under Settings. Two switches have to be on for anything to be sent: the workspace owner’s, and the operator’s switch for the whole instance. Refinement makes zero provider calls while either one is off, and the provider key is not even handed to the process that would make the call. So the owner’s switch only ever narrows things — turning it on cannot send anything by itself while the operator has the instance-wide switch off.
Who else processes your data
We use a small number of processors. Each one only receives what its job needs.
- Hosting and storage provider — runs the server and stores the database and backups. Infomaniak, Switzerland.
- Google — sign-in only (Google Identity / OAuth). Google sees that you signed in to Genesis, as it would for any site using “Sign in with Google”.
- Anthropic — the language model behind the nightly refinement described above. Data is processed in the United States. The fields listed in the previous section are the complete set sent; no attendee emails, calendar URLs, user emails or user ids are included.
- Cloudflare — provides DNS for the Genesis domain and sits in front of the server as a proxy, terminating TLS for incoming traffic. Cloudflare Free plan, default global network (no region pinning).
We do not add a processor without updating this notice first.
Where your data is stored
Your planning data and its backups are stored on servers in Switzerland, with Infomaniak. The one exception is the nightly refinement described above, where the fields listed there are processed in the United States.
Backups are kept on the server and as an off-host encrypted copy at Infomaniak Swiss Backup, Switzerland. The copy is encrypted (age) before it leaves the server, and the key that decrypts it is kept offline, not on any server.
How long we keep it
- Account and planning data — until you delete your account.
- Exports — a data export you request is kept for at most 24 hours and then removed.
- Backups — 7 daily, 4 weekly and 12 monthly copies. Because of the monthly copies, data you delete can still exist in a backup for up to 12 months; it is not restored into the running service, and it disappears as the monthly backups age out.
- Technical logs — kept for 30 days, then deleted.
Your rights
You can do most of this yourself, without asking anyone:
- Export your data — Settings → Account → Export my data. You get a JSON file with your workspace’s rows and its audit trail. The audit trail records what you did, so if you invited people it includes the email addresses you typed for them. It never contains another user’s tasks, meetings or workspace.
- Delete your account — Settings → Account → Delete. Your workspace rows, sessions, account and calendar-feed secrets are hard-deleted, the audit trail is anonymised, and the deletion completes within 30 days. Backups age out as described above.
For everything else — access to a copy of your data, correction of something wrong, an objection to a particular use, or a question about this notice — contact [email protected]. You also have the right to complain to your local data-protection authority.
Changes to this notice
When this notice changes we update this page and the date below. If a change materially affects what we do with your data, we announce it in the app before it takes effect.
Last updated
1 November 2026.