Last updated: September 25, 2026
This policy explains how BioDecode.com ("we", "us") handles information about you when you use the BioDecode app and the biodecode.com website.
The key point: BioDecode analyzes your DNA file on your own computer. We never receive, see, store, or send your DNA file or your results.
The website is different from the app. The website uses error monitoring on every visit. It uses analytics and advertising cookies only if you click Accept in our cookie banner. Section 5 explains the cookies and the banner, and section 7 explains how to change your choice.
BioDecode.com makes BioDecode, a desktop app for analyzing your genetic variants. We are the controller of the personal information described in this policy.
Email: hello@biodecode.com
BioDecode reads DNA files, such as VCF files and raw data files from consumer DNA tests. All analysis happens on your computer.
The app goes online only for these tasks:
Crash reports. The app never sends crash reports automatically. If the app crashes, it saves a crash log on your computer. You can choose to copy the log and email it to us. We only see it if you send it.
Downloading the app. The app installers are hosted on GitHub. When you download the app, GitHub receives your IP address and browser details, under GitHub's privacy statement.
We have no access to your genetic data, your DNA files, or your reports. We are not a controller or processor of your genetic data.
BioDecode can export a summary of your findings. If you choose to share it with an AI service, such as ChatGPT or Gemini, you do so by your own choice. That service's privacy policy then applies. We are not responsible for how those services handle what you share.
We collect a small amount of information through the website, your purchase, and messages you send us.
| Information | Where it comes from | Why we use it | Lawful basis (GDPR) |
|---|---|---|---|
| Your name, email address, and order details | Your purchase through Stripe | To create your license key and email it to you, with your order confirmation | Contract |
| Payment details | You enter them on Stripe's checkout page | To take payment. Stripe handles these details. We never see your full card number. | Contract |
| Your message and, if you give it, your email address | The feedback form on our homepage | To read and reply to your message | Legitimate interests |
| How you use the website: pages you visit, links and buttons you click, the site that sent you, your device and browser, and your approximate location from your IP address | Google Analytics, Google Ads, and Microsoft Advertising tags on our website | To understand how people use the website, and to measure and improve our ads. Only if you click Accept in our cookie banner. | Consent (see section 5) |
| Technical details when something goes wrong: the error, the page, your browser and device. If you clicked Accept, also a recording of the page with all text, typing, and images hidden (see section 6). | Sentry error monitoring | To find and fix problems with the website and checkout | Legitimate interests (error reports). Consent (recordings). |
| Server logs: your IP address, the pages you request, and your browser type | Our hosting provider, Netlify | To deliver the website and keep it secure | Legitimate interests |
We do not collect your genetic data, DNA files, health information, or analysis results.
Cookies are small files that websites store in your browser. Local storage works in a similar way.
We ask before we set analytics or advertising cookies. On your first visit, a small cookie banner appears in the corner of the page. It has two buttons of the same size: Reject and Accept.
_ga cookie either.Automated browsers, such as search engine crawlers, do not see the banner, and nothing optional loads for them.
The Genetics Library (pages under /genetics/) works differently. It loads no Google, Microsoft, or Sentry scripts, even after you click Accept. See section 6.
Every cookie and storage item in this table is set only after you click Accept, except biodecode_consent and biodecode_internal.
| Name | Set by | What it does | How long it lasts |
|---|---|---|---|
_ga |
Google Analytics (and our Genetics Library) | A random ID that recognizes your browser on return visits | 2 years |
_ga_77CQW8798C |
Google Analytics | Keeps track of your current visit | 2 years |
_gcl_au |
Google Ads | Links a visit to a Google ad you clicked | 90 days |
_uetsid, _uetvid |
Microsoft Advertising | Links visits to Microsoft (Bing) ads you saw or clicked. Also kept in local storage. | 1 day (_uetsid) and 13 months (_uetvid) |
Google and Microsoft cookies on their own domains, such as MUID on bing.com |
Google, Microsoft | Set under their own policies when their tags load | Set by Google and Microsoft |
| Sentry recording data (session storage) | Sentry | Groups a visit's error recording (see section 6) | Until you close the tab |
biodecode_consent (local storage) |
Us | Remembers whether you clicked Reject or Accept, and when | 12 months, then we ask again |
biodecode_internal (local storage) |
Us | Marks our own team's browsers so our visits are left out of our statistics. It is only set if you open a link containing ?internal=on. |
Until you clear it or open a link containing ?internal=off |
Cookie lifetimes above are the providers' defaults. Google and Microsoft may change them.
These companies receive information about you when you use our website or buy BioDecode.
| Service | What it receives | Why | Where it is processed |
|---|---|---|---|
| Google Analytics | Only if you click Accept: pages you visit, clicks on our buy button and partner links, feedback form sends, your device and browser, your IP address, and cookie IDs. If you accepted and then buy, our server tells Google a purchase happened, with the order number, price, and currency. It does not send your name or email. | Website statistics and measuring sales | United States and other countries |
| Google Ads | Only if you click Accept: pages you visit, your IP address, and cookie IDs | Measuring whether our Google ads work. Google may also use this to show you our ads on other sites. | United States and other countries |
| Microsoft Advertising (Bing Ads) | Only if you click Accept: pages you visit, your IP address, and cookie IDs | Measuring whether our Microsoft ads work. Microsoft may also use this to show you our ads. | United States and other countries |
| Sentry | Error details, the page address (without query strings), your browser and device, and your IP address. If you clicked Accept and an error happens, Sentry also receives a recording of your last moments on the page, with all text, typing, and images hidden (see below). | Finding and fixing website and order errors | European Union (Germany) |
| Stripe | Your name, email address, payment details, and the billing details Stripe asks for. If you clicked Accept, we also pass Stripe your Google Analytics browser and visit IDs when you click our buy button, so we can tell which visit led to a sale. If you did not, we pass nothing. | Taking payment | United States, European Union, and other countries |
| Resend | Your name, email address, license key, and order details | Sending your license key and order confirmation by email. A copy goes to our own mailbox. | United States |
| Netlify | Server logs, a record of your order (order number and email address) so we never send your license twice, and feedback form messages | Hosting the website, running our order system, and storing feedback messages | United States and other countries |
| Google reCAPTCHA | Your device and browser details, your IP address, and how you interact with the check | Blocking spam on the feedback form. It only loads when you open the feedback form. | United States and other countries |
| Akismet (through Netlify) | Your feedback message and related technical details | Spam filtering for the feedback form | United States |
| GitHub | Your IP address and browser details when you download the app | Hosting the app installers | United States |
Sentry reports errors on every visit. These reports use no cookies. If you clicked Accept, Sentry also keeps a short recording of the page in your browser's memory, on most pages. It is sent to Sentry only if an error happens. The recording shows the layout of the page and your clicks, but hides all text, everything you type, and all images and videos. We use recordings only to fix problems, never for advertising. They never contain your DNA file, because the website never receives it. Checkout happens on Stripe's own site, so Sentry does not record your payment details.
The Genetics Library (pages under /genetics/) loads no Google, Microsoft, or Sentry scripts. What you type in the library search stays in your browser.
To count visits, your browser sends our server a few fixed labels: which part of the library you are in, what kind of site sent you (for example "google" or "direct"), and which button you clicked, if any. It also sends your Google Analytics browser ID. If you do not have one yet, the library creates a _ga cookie with a new random ID. Our server passes these labels to Google Analytics with advertising use turned off. The library does this only after you click Accept in the cookie banner. It sends nothing and sets no cookie before then, after you click Reject, if your browser sends a "Do Not Track" or Global Privacy Control signal, or if it is an automated browser.
Some pages link to Sequencing.com, which sells DNA sequencing. These links include our affiliate code, so Sequencing.com knows you came from us and we may earn a commission. We do not set any cookie for this. Sequencing.com's own privacy policy applies on its website.
Some of the services above process information outside the UK and the European Economic Area, mainly in the United States. Where they do, they rely on legal safeguards such as the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, or the EU–US Data Privacy Framework and its UK extension. You can read each provider's privacy policy: Google, Microsoft, Sentry, Stripe, Resend, Netlify, and GitHub.
We do not sell your personal information for money.
Depending on where you live, you may have the right to:
To use any of these rights, email hello@biodecode.com.
You have the right to know what personal information we collect and how we use it, to ask us to delete it, and to opt out of its sale or sharing. We do not sell personal information for money. Our Google Ads and Microsoft Advertising tags may count as "sharing" for targeted advertising under California law. These tags load only if you click Accept. To opt out, click Reject, turn on Global Privacy Control, use the other steps in section 7, or email us.
Our lawful bases are contract (to deliver your purchase), consent (for analytics and advertising cookies, the Genetics Library's visit counts, and Sentry recordings), and legitimate interests (to run and secure the website, report errors, and answer feedback). You can withdraw consent at any time with the "Cookie settings" link at the bottom of any page. Withdrawing does not affect what happened before. You can complain to your local data protection authority. In the UK, this is the Information Commissioner's Office at ico.org.uk.
We use standard security measures to protect the small amount of personal information we hold. We never hold your genetic data, so it cannot be exposed through us.
BioDecode is not for people under 18. We do not knowingly collect personal information from children.
We may update this policy. The "Last updated" date at the top shows when we last changed it.
For privacy questions, or to use your rights:
BioDecode.com
Email: hello@biodecode.com
Company details and postal address