Privacy Policy

We believe developer infrastructure should be private by default. Here is our plain-language commitment to data minimization and privacy.

Draft Policy — Requires Legal Review Before Launch

This document outlines the exact technical behavior of the GenerativeOG service operated by GenerativeOG. It accurately describes our data processing, zero-identifier architecture, and Cloudflare edge handling.

1. Data Minimization & Core Philosophy

GenerativeOG is designed with a strict fail-closed data minimization philosophy. We do not collect names, email addresses, phone numbers, billing details, or physical addresses during the MVP. The generation API and playground are entirely accessible without registering an account.

2. What We Collect (And What We Don't)

✓ What We Collect

  • Anonymous Demand Counters: When you click "Show Interest" for an upcoming feature, we increment an aggregate daily counter in our Cloudflare D1 database (e.g. screenshots: +1). No user identifier, IP address, or session ID is associated with this counter.
  • Anonymous Aggregate Events: Product telemetry events (such as template selection or documentation page views) increment daily aggregate counters without any personal or device identifiers.
  • Transient IP Hashing for Rate Limiting: To protect against denial-of-service attacks and automated scraping, client IP addresses are hashed in memory with a rotating secret cryptographic salt. The raw IP address is never stored or written to disk.

✕ What We Never Collect

  • No Personal Identifiers: No user profiles, usernames, or account credentials.
  • No Tracking Cookies: We set zero tracking cookies, advertising beacons, or third-party behavioral scripts.
  • No Device Fingerprinting: We do not fingerprint browser canvas, audio contexts, or hardware configurations.
  • No Selling of Data: We will never sell, rent, or monetize your activity or telemetry data.

3. Respect for Privacy Signals (DNT & GPC)

Our web application strictly respects standard privacy preferences. If your browser sends the Do Not Track header (DNT: 1) or the Global Privacy Control signal (Sec-GPC: 1), all operational telemetry reporting is completely disabled.

4. Cloudflare Infrastructure & Edge Processing

GenerativeOG operates globally on Cloudflare Workers and Cloudflare D1. When you interact with the service, requests pass through Cloudflare's network, which processes standard HTTP network headers (such as IP address and User-Agent) solely for request routing and DDoS mitigation in accordance with Cloudflare's privacy policy.

5. Remote Asset Fetching (Logos & Avatars)

When an image request supplies a public remote asset URL (via logo or avatar), our edge worker performs an isolated HTTPS GET request to retrieve the asset image. These requests are strictly validated against SSRF protection policies (blocking private, internal, loopback, and cloud metadata IP ranges). The fetcher operates statelessly: it transmits no cookies, authorization headers, or user identifiers to remote origins, and enforces a 2 MB size cap and 5-second timeout.

6. Bot Verification (Turnstile)

To prevent automated spam and synthetic inflation of demand metrics, the Developer Tools and "Show Interest" forms utilize Cloudflare Turnstile. Turnstile runs non-intrusive client-side verification to confirm human interaction without requiring interactive CAPTCHA image puzzles or tracking cookies across third-party websites.

7. Contact Information

If you have questions regarding this privacy policy or our data practices, contact us at: support@generativeog.in.