This is a draft. It is waiting for the owner’s review and a lawyer’s review.
Genesis Club: Privacy Policy
DRAFT 1, 20 September 2026. Not legal advice. This draft is waiting for the owner's review and a lawyer's review. Items in [BRACKETS] are not filled in yet.
Each section opens with a plain summary. If the summary and the full text disagree, the full text counts.
1. Who is responsible for your data
Genesis Club is operated by [LEGAL ENTITY NAME], of [BUSINESS ADDRESS] ("we", "us"). We decide how and why your personal data is used, which makes us the "controller" under laws that use that word.
Questions, requests and complaints about privacy go to [PRIVACY CONTACT EMAIL].
2. The short version
- We collect what we need to run a paid members' club: your account, your payments, what you do inside the club, and what you type into it.
- The club watches how it is used. Logins, devices, which lessons are opened and when. We say so on the way in, and this policy says exactly what and why.
- Content you receive may be marked so a leaked copy can be traced to your account. Section 6 explains.
- We do not sell your personal data. We do not show you other companies' ads. There are no advertising trackers on the pages you use as a signed-in member.
- The AI guide stores your conversations so she can help you over time. You can switch that off, export it or delete it.
- You can get a copy of your data and ask us to delete it. Some records we must keep by law, and we say which.
3. What we collect
3.1 What you give us
| Data | Examples |
|---|---|
| Account | Email address, password (stored only as a hash; we cannot read it), display name, handle, optional profile photo and bio, country, and your confirmation that you are 18 or over |
| Sign-in with Google | If you choose it, Google tells us your name, email address and profile picture. We do not receive your Google password and we do not get access to your Gmail, contacts or files |
| What you type into the club | Lesson answers and submissions, posts, comments and messages, and your conversations with the AI guide |
| Goals and context | What you tell us or the AI guide about what you want to achieve, your situation and your business, so that guidance can fit you |
| Support | What you send us when you ask for help |
| Results you choose to report | Real-world outcomes you tell us about, and any evidence you attach |
3.2 What we record as you use the club
| Data | Examples |
|---|---|
| Learning activity | Lessons and blocks opened, exercises attempted and their results, time actively spent, progress and completions, each with a timestamp |
| Community activity | What you post, react to and reply to, and who you interact with |
| Agreements | Which version of each document you accepted, when, and the technical details of that moment (IP address, browser, the page and the wording you saw), so the acceptance can be proven later |
| Security and devices | Sign-ins and sign-outs, IP address, browser and device type, a random identifier we place in a cookie on each device you approve, and a one-way hash of technical signals from your browser. The hash is used as evidence of misuse only. It is never used as a password, and nobody is banned on the strength of it alone |
| Membership | Your tier, what it opens, points earned and spent, and the history of changes |
| Referrals and links | If you arrive through a member's link or one of our campaign links: which link, when, the page you landed on and the campaign details carried in the address. This is recorded by our own server. It is how a referring member is credited |
3.3 What we get from others
| Source | Data |
|---|---|
| Stripe, our payment processor | Confirmation that a payment succeeded or failed, the amount, your billing country, the last four digits and brand of your card, and dispute or refund events. We never receive or store your full card number |
| Google, if you sign in with it | As described in 3.1 |
| Our email provider | Whether an email was delivered, bounced or marked as spam |
4. Why we use it
In short: to run the club you paid for, to keep it safe, to make it better, and to meet our legal duties.
| Purpose | What it covers | Legal basis, where the law asks for one |
|---|---|---|
| Providing the club | Your account, access to what your tier opens, lessons, progress, community features, points, support | Performance of our contract with you |
| Payments and records | Charging you, receipts, refunds, disputes, tax and accounting records | Contract; legal obligation |
| Personal guidance | The AI guide using your goals, progress and past conversations to suggest what to study next | Contract; for the memory feature you can switch off, consent |
| Spotting where people get stuck | Seeing which lessons cause trouble so they can be rewritten, and so a person or the AI guide can offer help | Legitimate interests: improving the product and helping members succeed |
| Security and abuse prevention | Detecting account sharing, scraping, fraud, harassment and breaches of the house rules; protecting other members | Legitimate interests: keeping the club and its members safe; legal obligation where it applies |
| Protecting our content | Marking delivered content so leaks can be traced (section 6) | Legitimate interests: protecting our work from piracy |
| Crediting referrals | Recording which member's link brought a new member, and paying commission | Contract with the referring member; legitimate interests |
| Service messages | Login links, receipts, security alerts, notices about your membership or these documents | Contract; legal obligation |
| Marketing messages | News and offers by email | Consent. Off unless you switch it on. Unsubscribe any time. Service messages still arrive |
| Legal duties and claims | Keeping records the law requires, and defending or bringing legal claims | Legal obligation; legitimate interests |
We do not use your data for automated decisions that have legal or similarly significant effects on you. A person makes the decisions that matter, such as closing an account.
5. The AI guide and your data
In short: your conversations are stored so the guide can remember you. You control that memory.
- Conversations with the AI guide are stored with your account. She also reads your progress and, if you allow it, a short profile of your goals and situation, so her suggestions fit.
- To produce a reply, the relevant text is sent to an AI model provider through OpenRouter, a gateway that routes the request to the model we have selected. [CONFIRM OpenRouter's data-use terms and the model list at launch.]
- If you connect your own AI account or key, your conversations with the guide are sent to the provider you chose, under that provider's terms and privacy policy, not ours. The settings page tells you this before you switch it on.
- The guide only ever sees what you yourself are allowed to see. She is never given another member's private information in a conversation with you.
- Your controls: in settings you can stop the guide from keeping a profile of you, export everything she holds about you, and delete it. Stopping the memory does not delete what is already stored; deleting does.
6. Content marking, in plain words
In short: lessons and videos you receive may be quietly labelled as yours.
To deter piracy, content delivered to your account may carry identifiers tied to that account. These can be visible, such as your email address shown over a video, or invisible, such as small variations in the text of a lesson. If club material appears where it should not, these identifiers let us find the account it came from.
The identifiers say which account received a copy. They do not track where you go or what you do outside the club, and they do not collect anything from your device.
7. Who we share it with
In short: the companies that help us run the club, and nobody else unless the law requires it.
We do not sell your personal data, and we do not share it with anyone for their own advertising.
| Who | Why | Where |
|---|---|---|
| Supabase | Database, sign-in and file storage | United States |
| Vercel | Hosting the website and application | United States and global edge network |
| Stripe | Taking payments, handling refunds and disputes, and paying affiliates | United States and globally |
| Resend | Sending email | United States |
| Only if you choose to sign in with Google | United States and globally | |
| OpenRouter | Routing the AI guide's language model requests to the model provider we selected | United States [CONFIRM region] |
| Cloudflare | A challenge on sign-up and sign-in to keep bots out | Global network |
[CONFIRM this table against the live system on the day of publication. Add the video host, error monitoring and any analytics provider if one is in use.]
Other members see what you choose to publish: your display name, handle, profile, posts, comments and messages you send them.
Affiliates. A member who referred you can see that a referral joined, its tier and status, so they can be paid correctly. They are shown an anonymised record. They are not given your name, email or contact details.
The law. We disclose data when a valid legal process requires it, or when it is necessary to protect someone's safety or to establish or defend a legal claim.
A sale of the business. If the club is sold or reorganised, member data would transfer to the new owner under the same commitments, and we would tell you.
8. Cookies and similar storage
In short: only what the club needs to work. No advertising cookies.
| What | Purpose | How long |
|---|---|---|
| Sign-in session cookie | Keeps you signed in | Until you sign out or it expires |
| Device identifier cookie | Recognises a device you approved, for the two-device limit and for security | [PERIOD] |
| Referral and campaign cookie | If you arrived through a link, remembers it so the referrer can be credited when you join | [PERIOD] |
| Local storage | Remembers that you accepted the first-visit disclaimer, and small preferences | Until you clear it |
| Bot challenge | Cloudflare's challenge may set what it needs while it checks a sign-up or sign-in | Short-lived |
These are necessary for the club to function, so they do not depend on a consent banner.
We do not load other companies' advertising or analytics scripts on sign-in pages, AI pages or any page you use as a signed-in member. If we ever use an advertising pixel on a public marketing page, it will load only after you agree, and this policy will be updated first.
9. How long we keep it
In short: as long as you are a member, then only what the law or a dispute requires.
| Data | Kept for |
|---|---|
| Account and profile | While your account exists |
| Learning activity in detail | [PERIOD], after which it is reduced to summaries |
| AI conversations | Until you delete them or close your account; detailed logs are reduced to summaries after [PERIOD] |
| Security events | [PERIOD] |
| Payment, tax and commission records | As long as tax and accounting law requires, typically several years: [PERIOD, per accountant] |
| Records of what you agreed to | For as long as a dispute about it could be brought: [PERIOD, per lawyer] |
| Raw payment-processor messages | Removed on a reviewed schedule once the accounting record exists |
When you ask us to delete your account we remove or anonymise your personal data, except for the records in the last three rows and anything we are required to keep because of an open dispute, an unpaid commission or a legal hold. Financial ledgers are kept in a form that no longer identifies you.
10. Your choices and your rights
In short: see it, fix it, take it with you, delete it, object. Ask and we act.
In your account settings you can:
- edit your profile;
- export everything we hold about you, in a machine-readable file;
- stop the AI guide keeping a profile of you, and delete what she holds;
- turn marketing email on or off;
- see your recent security activity and sign out of other devices;
- close your account and request deletion.
Depending on where you live, the law may also give you the right to:
- know what we hold and get a copy;
- have inaccurate data corrected;
- have your data deleted;
- restrict or object to certain uses, including uses based on our legitimate interests;
- withdraw consent you gave, without affecting what happened before;
- complain to your data protection authority.
Write to [PRIVACY CONTACT EMAIL]. We will respond within the time the law allows, and we may need to confirm it is really you first. We will never penalise you for using these rights.
[LAWYER: add the regional sections that apply to where we sell. For the European Economic Area and the United Kingdom: confirm the legal bases above, name an EU or UK representative if one is required, and state the transfer mechanism used for data sent to the United States. For California and other US states with privacy laws: the categories of personal information collected and disclosed in the last 12 months, a statement that we do not sell or share personal information as those laws define it, and how to exercise rights through an authorised agent.]
11. Where your data is held
Our main database is hosted in the United States. If you use the club from another country, your data is transferred to and processed in the United States and wherever our providers operate. Where the law requires a specific safeguard for that transfer, we use one. [LAWYER: name the mechanism.]
12. How we protect it
In short: the database itself enforces who can see what. We do not rely on the website alone.
- Access to member data is enforced by the database, row by row, so one member cannot read another's records even if the website had a fault. Automated tests attack these rules on every change to the system.
- Passwords are stored only as salted hashes. We cannot see your password.
- Payment card details are handled by Stripe and never reach our systems.
- Connections are encrypted in transit. Lesson files and videos are delivered through short-lived links.
- Access to the systems that hold member data is limited to the people who need it.
- Sensitive actions, such as changing your email, approving a new device or exporting your data, require you to confirm your identity again.
No system is perfectly secure. If a breach affects your personal data, we will tell you and the authorities as the law requires.
13. Children
The club is for adults. You must be 18 or over to join. We do not knowingly collect data from anyone under 18. If you believe a minor has an account, tell us and we will close it and delete the data.
14. Changes to this policy
We will update this policy when what we do changes. The date at the top shows the current version. If a change affects how we use data we already hold about you in a way you would not expect, we will tell you before it takes effect, by email or inside the club.
15. Contact
[LEGAL ENTITY NAME], [BUSINESS ADDRESS]. Privacy requests: [PRIVACY CONTACT EMAIL].
Version 2026-09-22-draft · sha256 4da4a0d36ce6f15f11b606715b7601d4b90ddbf77401fa1409ed7cb6a02c8956