Introduction and controller
This Privacy Policy explains how the Genesi OS project ("Genesi OS", "the Project", "we", "us") processes personal data in connection with the genesios.org websites, the documentation wiki, the community forum at forum.genesios.org, the package repositories and update endpoints, and the first-party software we distribute.
For the purposes of the Brazilian General Data Protection Law (Law No. 13.709/2018, "LGPD") and the EU and UK General Data Protection Regulation ("GDPR"), the Project acts as controller for the processing described in this Policy. Contact: contact@genesios.org.
This Policy forms part of our Terms of Service. Capitalised terms not defined here have the meaning given in those Terms.
It does not apply to third-party services you choose to connect to, nor to external websites we link to. Those are governed by their own policies.
Our approach: local-first by design
Genesi OS is built so that personal data stays on your machine. The operating system is not a data-collection product, and we have deliberately built it without a telemetry channel.
We operate no telemetry, analytics or crash-reporting endpoint of any kind. There is no server to which the operating system could report usage, hardware inventories, crash data, prompts, documents, source code, model outputs or automation definitions, and no component attempts to.
Two paths do exist by which diagnostic information can leave your machine, and both require a deliberate action by you: the installer can upload an installation log to a third-party paste service if an installation fails, and upstream desktop components can offer to send crash reports to their own projects. Neither sends anything to us. Clause 4 describes them in full.
The genesios.org websites contain no analytics platform, no advertising network, no third-party tracking pixels and no cross-site tracking scripts.
The only personal data we hold is data you deliberately give us — principally by creating a forum account and publishing content — together with the minimal technical data our hosting providers must process to serve a request.
Local-first is an architectural property, not just a promise: because there is no telemetry endpoint, there is no channel through which local activity could reach us, and the source code is published under AGPL-3.0 so this can be independently verified.
What the software does on your machine
The following features process data exclusively on your own device. We receive none of it.
| Feature | Processes locally | Sent to the Project |
|---|---|---|
| AI Mode and local models | Prompts, conversations, selected models, inference workloads | Nothing |
| Automations | Workflow definitions, triggers, command output, run logs | Nothing |
| Automation triggers you enable | Clipboard contents, screenshot filenames, watched folders, window and process names — only while a workflow that uses that trigger is switched on | Nothing |
| AI Assist in the terminal | The command line and exit code of a command that just failed | Nothing |
| Plain-language file search | Your description, and file names and dates on your disk | Nothing |
| Memory Palace | Indexed local content used for recall | Nothing |
| Genesi Forge, Code, Sandboxes | Source code, projects, containers, configuration | Nothing |
| System tuning daemon | CPU, memory, GPU and process state | Nothing |
If you configure the software to reach an external service — a cloud model provider, a remote API, a Git host, a package registry, a database or an MCP server — data flows to that third party under your configuration and their privacy policy. We are not a party to that transfer.
Language models you download run locally. Their operators do not receive your prompts through Genesi OS.
Features that read sensitive local data
Some optional features necessarily read data that is more sensitive than a CPU reading. None of it reaches the Project — there is no endpoint it could reach — but you are entitled to know what each one touches, and when, before you switch it on. Every feature in this clause is off until you build a workflow that uses it or enable it yourself.
Clipboard trigger
While — and only while — an enabled automation contains a clipboard trigger, the automation daemon reads your clipboard periodically so it can notice a change. It keeps a cryptographic digest of the last value to detect that change, not a history of what you copied. The copied text is then passed to the workflow you built, on your machine.
Anything you copy can appear in your clipboard: passwords from a password manager, card numbers, private messages. Build clipboard workflows accordingly, and be aware that any command your workflow runs will receive that text.
Screenshot trigger
This trigger lists the file names and modification times in your screenshots folder so it can notice a new one. It does not open or analyse the image unless a later block in your own workflow does so.
The email block connects to the mail server you configure, using credentials you store yourself in your session keyring. It reads or sends messages under your account, exactly as any mail client would.
Two consequences follow, and both are yours rather than ours. Your mail provider receives the connection and processes it under their own privacy policy — we are not a party to it. And message content read by the block flows into the rest of your workflow, which may pass it to a local model, a script or a notification.
The password is never written into the workflow file. Workflow definitions are documents people copy between machines and paste into forum threads when asking for help, so the file holds only an account label and the secret stays in the keyring.
Webhook trigger
This trigger opens a listening TCP port on your machine so that an HTTP request can start a workflow. It binds to the loopback interface (127.0.0.1) unless you deliberately choose otherwise, and that choice is refused unless you also set a shared token.
A webhook can start a workflow that runs commands. Exposing one to a network without a token would let anyone who can reach the port run those commands, which is why the software does not allow it.
AI Assist in the terminal
When a command fails, the explanation you see is produced by a model already running on your machine. It is given the command line you typed and its exit code — not the command's output, and never the contents of files. Answers are cached under your home directory so the same mistake is not paid for twice.
Plain-language file search
Searching for a file by describing it sends your description — and nothing else — to the local model, which turns it into a filter (words, file types, a date range). The model never receives a listing of your disk, the contents of any file, or the results. The search itself is performed locally by the operating system.
None of the features in this clause transmit anything to the Project. Where one contacts a third party — your mail provider — it does so because you configured it to, under credentials you supplied, and that transfer is governed by that provider's policy rather than this one.
Diagnostics, logs and crash reports
Because "we collect nothing" would be misleading without this section, we set out here every route by which diagnostic data can leave your machine. None of these routes sends anything to the Project, and each requires an explicit action by you.
Installation log upload
If an installation fails, the installer offers a button to upload its session log so you can share it when asking for help. The upload happens only if you press that button; nothing is transmitted if you close the dialog.
The destination is termbin.com, an independent public paste service that is not operated by or affiliated with the Project. We do not receive the log, are not notified of the upload, and cannot delete or retrieve the result.
The uploaded log is the complete installer session log. It typically contains the hostname and username you chose, the storage devices and partition layout of the machine, locale, keyboard and timezone settings, the list of packages installed, and hardware and driver detection output.
The resulting address is publicly readable by anyone who has or guesses it, and the transfer itself is made in plain text over the paste service’s protocol rather than over an encrypted connection.
Treat an installation log as a public document. Review it before sharing the link, and do not upload it if the machine name, account name or disk layout is sensitive in your context. If you have already uploaded one, note that the Project cannot remove it — that is a matter for the paste service.
Application crash reports
Genesi OS includes desktop components maintained by upstream projects, notably the KDE crash handler that appears when a Qt or KDE application terminates unexpectedly. That dialog can offer to submit a crash report to the upstream project’s own bug tracker.
Such a submission goes to that project — for the KDE handler, to the KDE bug tracker — under its own privacy policy, generally requires an account there, and is never routed to us. A crash report of this kind can include a stack trace, loaded libraries and details of the system configuration.
None of the first-party Genesi applications contains crash-reporting, error-tracking or usage-analytics code.
Local diagnostic data
Crash dumps produced by the system crash-handling service, journal entries, automation run logs and application logs are written to your own disk and are never transmitted anywhere. You can inspect and delete them at any time.
Logs you share with us
When you paste a log, screenshot or configuration file into a forum topic, a GitHub issue or an email to us, you are publishing that content and we process it as described in clause 8. Redact hostnames, usernames, IP addresses, tokens and paths that identify you before sharing.
Data processed when you visit our websites
When you request a page, a download or a package, our hosting and infrastructure providers process technical data necessary to deliver it and to keep the service secure.
- IP address (used transiently for routing, rate limiting and abuse prevention);
- user agent, requested URL, HTTP status, response size, referrer and timestamp;
- approximate coarse region derived from the IP address by the provider;
- security-relevant signals such as request rate and bot heuristics.
This data is processed in server and edge logs by our providers. We do not use it to build user profiles, and we do not combine it with forum account data.
Package and update requests reveal to the serving infrastructure which package names and versions were requested, together with the technical data listed above. This is inherent to how package distribution works over the network.
Forum accounts and authentication
You do not need an account to read the website, the documentation or the forum. An account is required only to participate.
Authentication is handled by our identity provider. Depending on the method you choose, the following data is processed:
- Email and password: your email address and a cryptographic hash of your password. We never receive or store your password in readable form.
- Email sign-in link: your email address and a single-use token.
- Google sign-in: the identifiers Google returns to us, typically your email address, name and profile picture URL. We do not receive your Google password, and we request no access to your Google account beyond basic identity.
Your email address is used for authentication, account security, email confirmation, password reset and essential service notices. It is not published on your profile, is not shared with other users, and is not used for marketing.
Your forum profile stores a username, an optional display name, an optional avatar URL, an optional biography, your role, and your reputation and experience totals. Everything in your profile other than your email address is public by design.
Session cookies are set to keep you signed in. They are strictly necessary for the operation of an authenticated area.
Content, interactions and community features
When you use the forum we store the content and interactions you generate: topics, replies, votes, reports you submit, notifications addressed to you, and badge and experience events attributable to your account.
Topics, replies, votes and profile information are public. They can be read without an account, indexed by search engines, and cached, quoted or mirrored by third parties beyond our control.
Reports you submit about other users or content are visible to moderators, not to the reported user or the public.
View counting
To count how many times a topic has been viewed without tracking individuals, we store a salted, irreversible hash together with a time window rather than an IP address or account identifier. The hash cannot be used to reconstruct who viewed a topic, and is not linked to your profile.
Support, reports and correspondence
If you email contact@genesios.org, open a GitHub issue, submit a pull request or send a security report, we process the content of your message and the identifiers it carries — such as your email address or GitHub username — in order to respond and to keep a record of the matter.
Public issue trackers and pull requests are hosted by GitHub and are visible to anyone. Do not include personal data, credentials, tokens or private files in a public submission.
Logs, screenshots and configuration files you attach when seeking help may contain personal data. Please redact them before sharing; we cannot know in advance what a submitted log contains.
What we deliberately do not do
We do not sell, rent or trade personal data, and we do not share it for advertising or for any third party’s independent marketing purposes.
We do not run behavioural advertising, retargeting, cross-site tracking, fingerprinting or ad-network integrations.
We do not use your forum content, prompts or code to train machine-learning models.
We do not carry out automated decision-making or profiling that produces legal or similarly significant effects for you.
We do not require an account, an email address or any registration to download, install or use the operating system.
Purposes and legal bases
Where the GDPR or the LGPD applies, we rely on the following bases.
| Purpose | Data | Legal basis |
|---|---|---|
| Serving the website, downloads and packages | Technical request data | Legitimate interests (GDPR Art. 6(1)(f)); LGPD Art. 7, X |
| Creating and operating your account | Email, credentials, profile | Performance of a contract (Art. 6(1)(b)); LGPD Art. 7, V |
| Publishing your content on the forum | Topics, replies, votes, profile | Performance of a contract (Art. 6(1)(b)); LGPD Art. 7, V |
| Security, abuse prevention and moderation | Technical data, reports, moderation records | Legitimate interests (Art. 6(1)(f)); LGPD Art. 7, IX |
| Responding to your enquiries | Correspondence | Legitimate interests / contract (Art. 6(1)(f), (b)) |
| Complying with legal obligations | As strictly required | Legal obligation (Art. 6(1)(c)); LGPD Art. 7, II |
Where we rely on legitimate interests, we have assessed that our interest in operating a secure, functioning community service does not override your rights and freedoms, and we have minimised the data used for that purpose. You may object to this processing as described in clause 14.
Where processing is based on consent — for example, an optional profile field you choose to complete — you may withdraw that consent at any time without affecting the lawfulness of processing carried out beforehand.
Service providers
We rely on a small number of infrastructure providers, which act as processors on our instructions or as independent controllers where indicated.
| Provider | Role | Data involved |
|---|---|---|
| Vercel | Website and application hosting, edge delivery | Technical request data, server logs |
| Supabase | Authentication and forum database | Account credentials, profile, forum content |
| GitHub | Source code, issues, releases and downloads | Contribution and issue data, download requests |
| Optional sign-in provider (independent controller) | Identity data, only if you choose Google sign-in |
Providers are engaged under their standard data processing terms, may process data only in accordance with our instructions and their contractual obligations, and are subject to confidentiality and security commitments.
This list may change as our infrastructure evolves. Material changes will be reflected in an updated version of this Policy.
International transfers
Our providers operate globally, so personal data may be processed on servers outside your country of residence, including in the United States and the European Union.
Where personal data covered by the GDPR is transferred outside the EEA or the UK, the transfer relies on an adequacy decision or on Standard Contractual Clauses incorporated into the relevant provider agreement, together with supplementary measures where appropriate.
Where the LGPD applies, international transfers are made on the bases permitted by Articles 33 to 36 of that law.
Retention
We keep personal data only for as long as it is needed for the purpose for which it was collected, or for as long as required by law.
| Category | Retention |
|---|---|
| Account and profile data | While the account exists; removed or anonymised on deletion |
| Published forum content | While published; see clause 13.2 on deletion |
| Server and security logs | Short-term, as configured by the hosting provider |
| Topic view hashes | Aggregated counters retained; hashes expire with their time window |
| Moderation records | Retained as long as necessary to enforce the Terms and handle appeals |
| Correspondence | While needed to handle the matter and for a reasonable period afterwards |
| Backups | Overwritten on the provider’s rolling backup cycle |
When you delete your account, your profile and its personal identifiers are removed. Content that forms part of a public discussion may be retained in anonymised form — detached from your identity — so that threads and quotations by other participants remain coherent. Where applicable data protection law entitles you to erasure of that content itself, we will comply with that request.
Anonymised data that can no longer be associated with you is not personal data and may be retained without a time limit.
Your rights
Subject to the conditions of the law that applies to you, you have the following rights.
- Confirmation and access — to know whether we process your personal data and to obtain a copy of it.
- Rectification — to have inaccurate or incomplete data corrected.
- Erasure — to have your data deleted where one of the grounds provided by law applies.
- Restriction — to have processing limited in certain circumstances.
- Objection — to object to processing based on legitimate interests, on grounds relating to your situation.
- Portability — to receive certain data in a structured, commonly used, machine-readable format.
- Withdrawal of consent — where processing is based on consent, at any time.
- Anonymisation or blocking of unnecessary or excessive data, and information about data sharing (LGPD Arts. 18, IV and 18, VII).
- Complaint — to lodge a complaint with a supervisory authority: the ANPD in Brazil, or your local authority in the EEA or the UK.
You can exercise many of these rights directly: profile details can be edited in the forum, and an account can be deleted from its settings.
For anything else, write to contact@genesios.org. We will respond within the period required by applicable law — 15 days under the LGPD, one month under the GDPR, extendable where the law permits and we tell you why.
We may need to verify your identity before acting on a request, in order to avoid disclosing personal data to the wrong person. We will not charge a fee unless a request is manifestly unfounded or excessive, in which case we will tell you before proceeding.
Security
We apply technical and organisational measures appropriate to the nature of the data we hold, including encryption in transit, hashed password storage handled by our authentication provider, database-level access rules restricting each user to their own records, role-based moderation privileges and least-privilege access to administrative interfaces.
No website, database or transmission can be guaranteed perfectly secure. We cannot warrant absolute security, and you share content on the forum at your own risk.
If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority and affected users as required by the GDPR and by Article 48 of the LGPD, without undue delay.
Please report suspected vulnerabilities privately to contact@genesios.org rather than in a public issue, and allow a reasonable period for remediation before disclosure.
Children
The Services are not directed at children. Accounts are intended for users who have the legal capacity to accept our Terms, and who meet the minimum age for consent to online services in their jurisdiction.
We do not knowingly collect personal data from a child below that age. If you believe a child has provided us with personal data, contact contact@genesios.org and we will delete the account and associated data.
Where a child lawfully uses the Services with parental consent, processing follows Article 14 of the LGPD and the equivalent GDPR provisions, in the child’s best interest.
Changes to this Policy
We may update this Policy as our services, infrastructure or legal obligations change. The version identifier, effective date and revision date at the head of this document indicate the current version.
For material changes affecting your rights or introducing a new purpose or recipient, we will take reasonable steps to notify you through the website or the forum before the change takes effect.
Earlier versions are available in the public history of the website repository, so changes to this Policy can be audited.
Contact
For any question about this Policy, to exercise your rights, or to raise a privacy or security concern, write to contact@genesios.org.
Please indicate the nature of your request so that we can route it correctly, and avoid including unnecessary personal data or credentials in your message.