The runtime

The GenClass runtime makes every decision in the browser with a local model. It does not need a GenClass account or server to work.

From runtime 0.2.1, the runtime sends anonymous diagnostics by default on public hosts, to help improve the model, and does not send them from local or private hosts (localhost, *.localhost, *.local, *.test, 127.0.0.1, ::1, private IP ranges). Version 0.2.1 sent from those hosts too, by mistake, when GenClass started with GenClass.init(), the auto import or the script tag; 0.2.2 fixes this. By default they contain no text from the page: only a random per-page session id, versions, mode, device class, the app's hostname and id-normalised path, and for each decision the trigger, diagnosis and confidence, action, gate, outcome, latency and counts. From runtime 0.3.0 (first as 0.3.0-beta.0), routine decisions (nothing found, nothing changed) are sampled, one in four and at most 200 per page load, while every detection is sent and the counts stay exact; a detection also says whether it was a lower-confidence "possible" one, with a count of those per page load; and a path segment containing an @, such as an e-mail address, is sent as :id. The situation text the model read is sent only when the app opts in with telemetry: { include: { situation: true } }; with that on, the redacted situation can include route names with query strings, short error messages and short field values (see TELEMETRY.md). In either setting it never sends typed password, payment or secret values, cookies, headers, request or response bodies or storage contents, and the collector stores no IP address or user agent. Turn it off with GenClass.init({ telemetry: false }), ?genclass=no-telemetry, localStorage genclass.telemetry=off, or Global Privacy Control. Full details are in TELEMETRY.md.

Where the diagnostics go

From runtime 0.2.2 the runtime sends them to https://genclass.dev/api/v1/events, a Cloudflare Worker run by the GenClass maintainers (its source is telemetry-worker/ in the repository). Earlier versions used the same worker at genclass-telemetry.mehar-144.workers.dev. Batches are stored in a private Cloudflare R2 bucket and deleted 90 days after they arrive. The collector adds the time it received a batch and a two-letter country code, and stores no IP address, user agent, cookie or request header. We use the data to evaluate and train the model, and, for an app whose owner asked for their own classifier, to train that app's own model, which only its account receives; we do not sell it or use it for advertising. The full list of fields is in TELEMETRY.md, and the terms for the collector are on the terms page.

To turn diagnostics off: GenClass.init({ telemetry: false }), ?genclass=no-telemetry, or localStorage.setItem("genclass.telemetry", "off"). Browsers that send Global Privacy Control are never collected. To have data from your site deleted, email [email protected] with the hostname.

App tokens and dashboards

A developer can get a token and a private dashboard link for a web app at genclass.dev/start or with npx @genclass/runtime init, which, only after the developer approves its changes, sends us the name from the project's package.json. We keep one record per token: the token, that name, when it was created, when data first and last arrived, a one-way hash of the dashboard link's secret (never the secret itself), and the account it belongs to, if any. It is kept until the owner asks us to delete it; email [email protected] with the token.

The token is public: it ships in the app's pages and only groups that app's diagnostics. Whoever holds the dashboard link sees that app's aggregated diagnostics (counts of decisions, detections, possible detections and actions, its hostnames and routes, the names the developer gave to protected functions, model speed and versions) and a list of recent detections, never the situation text. Function names that look like data (an e-mail address, a URL, 4 or more digits in a row, a long hex id) are sent as [redacted]. Visitors who opt out or send Global Privacy Control never reach a dashboard. Local and private hosts (localhost, private networks) do not send by default; they reach a dashboard only when the app opts in explicitly with telemetry: true or a telemetry options object. Dashboard data is deleted after 90 days. Runtime 0.2.2 and earlier ignore tokens; 0.3.0 (first as 0.3.0-beta.0) sends them, and, only with a token, the names of protected functions.

Accounts

An account on genclass.dev is optional: the runtime, its diagnostics and private dashboard links work without one. If you create one, to keep your apps in one place or to connect an app with npx @genclass/runtime login (runtime 0.3.0-beta.0 and later), it stores: your email as Google returned it (or as you typed it, trimmed and lowercased, when you sign up with an email and a password; we do not verify it, and it is also your username), and whether it is verified; your password, if you set one, only as a salted one-way hash (PBKDF2-HMAC-SHA256, 600,000 iterations), with when it was set and last used and how many wrong passwords were entered in a row (to slow down guessing); a one-way hash of a random cookie for each browser where your password was right, so it can still sign in while someone elsewhere enters wrong passwords (forgotten when you change your password or after 400 days unused); your passkeys' public keys, with when each was added and last used; your Google account id (sub) if you sign in with Google, and your GitHub user id and login if you sign in with GitHub; your sign-in sessions (a one-way hash of each session secret, its times, when it last used a passkey, and the name the command line gave itself); and which apps you own, and whether each one's private dashboard link still opens it. Nothing else: no readable password, no IP address, and no Google or GitHub access token after sign-in. We use the email only for notices about your account.

Signing in sets one session cookie (30 days in the browser; a terminal signed in with the command line gets a 90-day token instead). A correct password also sets a device cookie (400 days) that marks that browser as one where it was right, and a Google or GitHub sign-in, or the passkey step after a sign-in, uses a cookie that lasts at most 10 minutes. Sign out, or revoke sessions, on your account page. To delete your account, choose Delete account on your account page while signed in: the account, its password, its passkeys and its sessions are deleted at once, apps created in the account are deleted with their stats, and apps that still have a private dashboard link leave the account and keep working through that link. If you cannot sign in any more, email [email protected] from an address Google has verified for that account, or, if you forgot your password, from the address you sign in with (we cannot email a reset link yet); an account id alone is not enough.

Teams

An account on a plan with members can make invite links. A link works once, for 7 days, and we store only a hash of it; we send no email, you pass the link on yourself. When someone joins your team, you see the email or GitHub login of their GenClass account and the day they joined, and they see yours. A member can open the dashboards of your apps and nothing else of your account: not its billing, its sign-ins, its export or its forwarding settings. You can remove a member and a member can leave at any time; deleting an account removes it from every team, and deletes its own team and invite links.

Paid plans, payments and Stripe

Free costs nothing, Team is sold on genclass.dev per project (since 12 November 2026; per developer on 11 November), and Enterprise is agreed by email. A plan decides what your dashboard shows, never what is collected: an app that turned visitor analytics on has them counted on Free too, and they show once its plan includes them. A paid plan (Team; the Individual plan was one until 22 October 2026) is paid through Stripe, which processes payments for us. When you upgrade, we send Stripe your account's email (if it has one) and your GenClass account id, and you type your card or other payment details into Stripe's own checkout page: they go to Stripe and never reach GenClass. Stripe handles them under its own privacy policy and keeps your invoices and receipts, which you can see under Manage billing on your billing page.

GenClass stores only your Stripe customer id, your subscription id, the subscription's status and renewal or end date, your plan, the app a plan per project is for, when you chose Free for an app and the reason you picked for it (with anything you wrote, at most 500 characters, which GenClass reads to improve its plans), and for a plan bought per developer the number of seats it pays for. Never card numbers, bank details or billing addresses. For a purchase of the Individual plan we also keep a record of the purchase (account id, email, subscription id, time) so that a person from GenClass can write to the buyer to start the work.

Forwarding and export come with Team and Enterprise. Forwarding is off unless an account turns it on for one of its apps. Then, for each new detection from that app, GenClass sends a short record to the services that account chose (Sentry, PostHog, Datadog, Slack or its own webhook URL): the kind of problem, the model's confidence, what triggered the check, the page path, the runtime and model versions, the time and a link to the app's dashboard. Never text from the page. Those services handle the records under their own terms with the account owner. The keys and URLs for them are stored encrypted. Export lets an account download, or read with an export key, the events GenClass received for its own apps, as stored; export keys are stored as one-way hashes.

For apps on a plan with a year of history (Enterprise, and the Individual plan while it was paid for), the dashboard data and the stored events are kept for 1 year instead of 90 days: for Individual, also for 30 days after the paid period ends; for Enterprise, until the agreement ends. Then they are deleted as for every other app. Deleting your account cancels a paid plan at once and deletes the forwarding settings, export keys and stored copies made for your apps; Stripe keeps its own records of past payments as the law requires.

Race hunts

A race hunt is paid for on Stripe's own checkout page. Card details go to Stripe and never reach GenClass. Stripe gives us the email you paid with, a business name if you typed one, and the app address or repository you entered. We use them to do the hunt and to write to you about it, and for nothing else. During a hunt we work on the staging or development copy you point us at, with a test login and test data. We keep the report we send you. We do not keep the test login after the hunt, and the report goes only to you. Stripe keeps its own records of the payment as the law requires.

The page check

When you check a page at genclass.dev/scan, a Cloudflare browser loads that one public page. It never sends forms or other non-GET requests to the site and never follows links. The report is cached for 6 hours and its screenshots are deleted after 24 hours; we do not keep who asked for a scan. To judge elements our measured checks cannot, small screenshot crops of the page and their measured facts are sent to Cloudflare Workers AI, where the Clef model looks at them; Cloudflare says it does not store or train on these requests. To check whether the site is on browsers' HTTPS preload list, the scanner sends the site's hostname, and nothing else, to hstspreload.org. A small GenClass model also looks at those crops inside the same Cloudflare browser; nothing new is sent anywhere. Site owners can opt out of scans, as described on how the page check works.

Early-access sign-ups

When you request early access we store your email, company, number of apps and the plan you picked. We use it only to contact you about GenClass, never sell or share it, and delete it on request.

This website

genclass.dev uses Cloudflare Web Analytics, which counts page views without cookies.

Every page of genclass.dev also runs the GenClass runtime 0.3.0-beta.1, loaded from jsDelivr, in observe mode with its visual checks on. It sends the anonymous diagnostics described under The runtime, with this site's own app token, so they also feed genclass.dev's dashboard; its interaction analytics are off. What the visual checks find stays in your browser's console and is not sent. The live demo on the home page sends nothing. The same opt-outs apply, and ?genclass=off turns GenClass off on that page.

Viewing our pitch deck records which slides you look at and for how long, with a random id kept in your browser, along with the device type (phone, tablet or desktop), the country, the site that linked to it and, if you opened a link we sent you, which link (your browser remembers it). It sets no cookies and we store no IP address. Only the founders see it.