genUine Security

genUine hears your voice, reads what you ask it to read, and can post to your LinkedIn. This page says plainly how we protect that, including what we have not done yet. genUine is made and run by a small founding team.

• Certifications: None. genUine has not been audited for a security certification such as SOC 2 or ISO 27001. This page will say so if that changes.
• Privacy Policy: begenuine.app/privacy
• Terms of Use: begenuine.app/terms

• Hosting: The website and our servers run on Vercel’s managed platform. There are no servers of our own to maintain or log in to.
• Database: Account data is stored in Upstash, a managed Redis database, reached only over TLS.
• Encryption in transit: Every connection between the app, the website, our servers and our providers uses HTTPS (TLS).
• Encryption at rest: Your LinkedIn access token is encrypted by genUine with AES-256-GCM before it is stored, with a key kept outside the database. We do not claim encryption at rest for the rest of the database; it is protected by our database provider’s access controls.
• Sign-in: Clerk runs sign-in. genUine never sees or stores your password.
• Payments: Stripe runs checkout. Card details never reach our servers.

• Audio: Sent to the speech-to-text provider and discarded once it is transcribed; we never store it. The audio of a dictation is not kept on your device. Other recordings stay there until they have been sent, so a failed upload can be tried again: genUine keeps the newest 10 and deletes any older than 7 days each time it starts and the next time you record.
• Screenshots and selected text: Taken only when you ask, used for that one request, and not stored, unless you keep a selection with “learn this” as a sample of your writing.
• Keys: The desktop app’s key watcher reports only which modifier keys are held and how many other keys went down, never which ones, and on Windows whether a mouse button is held. None of it leaves your computer.
• History: The History list itself stays on your computer: what you dictated (the text, what was heard and the app it went into) and what you asked, with the answers. The post drafts in it are also kept on our servers, as the Privacy Policy says. On the computer each account keeps at most its newest 1,000 entries, none older than 90 days, in the app’s storage without encryption. Signing out, deleting your account or saying “clear my history” erases it, and the side notch that shows it is hidden from the screenshots genUine takes (Privacy Policy).
• Downloads: For a week after you say “learn how I write”, the app watches your Downloads folder for LinkedIn’s archive. It looks only at file names, at the sizes and dates of .zip files, folders and any Shares.csv, and, for those that arrived after you asked, at the list of files inside a .zip and the names of the files in a folder, with the sizes and dates of any Shares.csv, Comments.csv and Profile.csv among them. From LinkedIn’s archive it uploads only your posts, comments and headline, and after you say “forget how I write” our servers turn such an archive away and keep nothing from it. For “get my numbers”, a spreadsheet from Downloads is sent only once the app has checked, on your computer, that it is LinkedIn’s analytics export.
• Data deletion: Delete account in genUine’s Settings deletes your data from our servers straight away. See the Privacy Policy.
• Subprocessors: Every provider that handles your data is listed in the Privacy Policy.

• Admin tools: Protected by a secret password, checked on the server for every request, and not linked from the product.
• Desktop app: It shows genUine’s own pages and LinkedIn’s: LinkedIn’s sign-in page when you connect LinkedIn, and its messaging page when you send a reply. The messaging page keeps its own storage, separate from genUine’s. Pages run in Electron’s context isolation, with no direct access to your computer. The history’s side notch lists only the signed-in account’s entries, and the notch opens an entry only for the account it belongs to.

• Code changes: Changes go through pull requests, and every pull request runs our type checks and test suite automatically.
• Third-party code in the app: The desktop app ships no third-party libraries: it is Electron and genUine’s own code, parts of which are adapted from Clicky under the MIT License (see Acknowledgements). On Windows that includes genUine’s own key helper, built with the C# compiler that comes with Windows.
• App signing: The Mac app is not notarized by Apple yet, and the Windows installer and its key helper are not code-signed yet, so your computer asks you to confirm the first launch of each version you download. Download genUine only from begenuine.app.

• Health check: A public health check reports whether the service, its database and its AI provider are working.
• Incident response: If we learn of a breach that affects your data, we contain it, find out what happened, and tell the people affected by email without undue delay. We tell regulators where the law requires it (within 72 hours under the GDPR), and LinkedIn within 24 hours when LinkedIn data is involved, as its API terms require.

If you find a security problem in genUine, please tell us at shaan@begenuine.app before telling anyone else, with enough detail for us to reproduce it. We will acknowledge your report within two business days, keep you updated while we fix it, and credit you if you would like. We will not take legal action against research done in good faith that avoids harming users or their data.

Security questions and reports: shaan@begenuine.app