Privacy Policy

What we collect

Your raw DNA file is never uploaded. Parsing happens entirely in your browser. The resulting rsID and genotype pairs are transmitted to our servers over an encrypted HTTPS connection for matching against our database. We do not store these pairs. They are used in memory for the duration of the request and then discarded.

The only genetic data stored server-side is the encrypted genome binary used for cloud backup — and only if you create an account. Encryption happens in your browser using AES-256-GCM with a recovery phrase that only you hold. The encrypted file is uploaded to Supabase Storage and we have no ability to decrypt it — we never see the contents. It is never used for any purpose other than restoring your report on a new device.

If you create an account, we store your email address and authentication details via Supabase Auth.

AI interpretation requests send anonymised SNP data (rsID + genotype pairs, no name or email) to Google Gemini Flash. We store the generated interpretation text — not the underlying pairs — and reuse it across users with the same genetic variants. No personally identifiable information is included in these requests.

What we do not collect

Data retention

Anonymous session data (matched SNPs without an account) is stored only in your browser's session storage and is cleared when you close the tab or click "Clear browser data". If you have an account with cloud backup enabled, your genome data is retained until you delete your account or explicitly clear it.

Your rights (GDPR)

If you are in the EU or EEA, you have the right to access, correct, export, or delete the personal data we hold about you. To exercise these rights, contact us at privacy@readmygen.com. We will respond within 30 days.

Genetic data is considered a special category under GDPR Article 9. We process it solely on the basis of your explicit consent given at sign-up, for the purpose of providing the report service.

Cookies

We do not use tracking or advertising cookies. The only cookies set are strictly necessary session cookies used by our authentication provider (Supabase) to keep you logged in.

Third-party services

Contact

For privacy questions or data removal requests: