Privacy Policy

This policy describes how GenKaKu Labs (“GenKaKu”, “we”) handles information when you use our website, API, and network. It is written to describe what the software actually does. Where a practice is less private than you might assume, we say so rather than leave it out.

1. The short version

• Text prompts and responses are not stored. They exist in memory for the life of the request and are discarded when it completes. No database table holds them.
• Image prompts are not stored either. One caveat applies to the machine that renders them, described in section 4.
• Prompts are not end-to-end encrypted. They are protected by TLS in transit, but our orchestrator processes them in readable form in order to route them.
• We do not sell personal information and we do not use your prompts to train models.

2. What we collect

Account information. Authentication is handled by Privy. We store the identifier Privy issues you, and, depending on how you sign in, your wallet address and your X (Twitter) username and account ID. We do not receive or store your X password.

Usage and billing records. For each completed job we retain metadata only: an internal job identifier, which account requested it, which worker served it, the model and tier, the number of tokens generated, how long it took, and when it finished. Credit purchases, balances, transaction records, API keys and per-key usage counts are also stored, because they are what your bill is computed from.

Network abuse signals. We store a hash of your IP address together with a per-day request count. We do not retain raw IP addresses in the application database. This exists solely to enforce rate limits and detect abuse.

Worker information. If you contribute compute, we additionally store your worker identity and access token, hardware and throughput statistics, a reputation and strike record used to detect fraudulent workers, your earnings, and the wallet address you are paid to.

On-chain information. Deposits and payouts occur on Solana. Blockchain transactions are public and permanent by nature, and are not under our control.

3. Text prompts and responses

When you send a prompt for text inference, it is held in memory, dispatched to one or more contributor machines, streamed back to you, and then discarded. It is never written to our database. What remains afterwards is the job metadata described above.

Two consequences are worth stating plainly:

• The operator can see prompts in transit. There is no end-to-end encryption between you and the machine serving your request. Our orchestrator handles prompt text in readable form because it must route and meter it.
• Contributor machines receive your prompt text, but not your identity. Workers are given the text to process and nothing that identifies who sent it.

Operational logs used for debugging and billing may contain account and job identifiers, timing, and error information. They do not contain prompt or response text.

4. Image generation

Image generation follows the same pattern as text. Your prompt is screened, dispatched to a machine that renders it, and the finished image is returned to you directly. We do not write the prompt or the image to our database. There is no gallery, and no image you generate is shown to anyone else.

The honest caveat is the rendering machine. The image software running on a contributor’s hardware writes the file it produces to that machine’s own local disk as part of how it works. Those machines are operated by independent people, not by us, and we cannot guarantee what remains on them or for how long. If that matters for a particular image, it is a reason not to generate it here.

5. Service providers

We use a small number of processors, each for a specific function:

• Privy — authentication and embedded wallets.
• Supabase — managed database infrastructure and backups.
• Cloudflare — DNS, TLS termination, and protection against denial-of-service traffic.
• Brave Search — only when you use a feature that performs a web search; your query is sent to Brave for that request.
• A Solana RPC provider — for reading and submitting on-chain transactions.
• Contributor operators — independent people and businesses running the machines that serve inference. They receive prompt text without your identity.

6. Retention

Text prompts and responses are not retained. Billing and job metadata, image records, worker records and reputation history are retained for as long as your account exists and afterwards where we are required to keep them for tax, accounting or fraud-prevention purposes. Hashed IP counters are retained on a rolling short-term basis for rate limiting.

7. Your rights

You may request access to the personal information we hold about you, correction of it, deletion of your account and associated records, or a copy in portable form. If you are in the European Economic Area or the United Kingdom, you additionally have the right to object to or restrict certain processing, and to complain to your national data protection authority.

Two limits are honest to state. We cannot delete information that has already been written to a public blockchain, and we may retain records we are legally required to keep.

To exercise any of these rights, contact us at the address in section 9.

8. Cookies and local storage

We use cookies and browser storage that are necessary for the service to function — keeping you signed in through Privy, and holding your conversation history locally in your own browser so it is not on our servers. We do not use advertising cookies or cross-site tracking.

9. Contact

GenKaKu Labs
Privacy enquiries: privacy@genkaku.app

10. Changes

If we change this policy in a way that materially reduces your privacy, we will say so on the site rather than quietly revising the date at the top.