IDuh Genius

GeniusID policy

GeniusID Privacy Notice

Effective date: 11 November 2026

Operator: Joshua Judd, a Colorado sole proprietor operating IDuh Genius

Privacy contact: support@iduhgenius.com

Short version

GeniusID is your IDuh Genius account. It holds your email address, your display name and settings, the profile details you add, how you sign in, an optional profile picture, the devices you register, and which apps you’ve allowed in. The GeniusID iPhone app keeps some things only on your iPhone: your card’s signature and what you accepted. If you choose to, GeniusID posts a card with the parts of your GeniusID you pick in our Discord server. What you put in Scatterplot is yours, and an AI agent sees it only if you connect one through IDuh MCP and allow it. We use your information to sign you in and run your account and apps. We don’t sell it, we don’t run ads, and we don’t use analytics or tracking cookies. Getting a copy of your data isn’t a button yet. Email us and we’ll do it by hand.

What this notice covers

This notice covers your GeniusID account at id.iduhgenius.com, the sign-in step that IDuh Genius apps send you through, the GeniusID iPhone app, Scatterplot, connecting an AI agent to your apps with IDuh MCP, and talking with our agents while signed in with your GeniusID.

Other apps you open with your GeniusID, such as Endgame and Giveback Map, keep what you put in them too. Each will get its own section here. Not every app is open to every GeniusID yet. Your account page shows which are open to you, and a section here applies to you once you use that app.

What your account holds

  • Your email address. Supabase, our sign-in provider, keeps it so it can send you sign-in codes. While a code is on its way, our sign-in server also holds it with the request. That copy is deleted when you use the code, or within about 15 minutes if you don’t.
  • How you sign in. An 8-digit code we email you, Discord, or both.
  • Your display name and settings. The name you choose, and your Appearance and Reduce Motion choices.
  • Profile details, if you add them. Your first and last name, a homepage, up to six links and a short bio, saved from the GeniusID app.
  • A profile picture, if you add one. We keep a 256-pixel square, redrawn so that no location, camera details or other hidden data come with it. It lives in private storage. You see it on your account page and in the GeniusID app.
  • Your sessions. Each time you sign in to the account page, we record which account, how you signed in, and when. We don’t record your IP address or browser there. We clear those records within 60 days of the sign-in. A separate record of each sign-in (which account, how, and when) stays in the account database until you delete your account.
  • Discord details, if you use Discord. If you sign in with Discord or add it, we keep your Discord user ID, username, display name and avatar address. If you add a Discord bot, we keep its public application ID, its name, an optional server ID and its public icon, for up to two bots. We refuse a bot token if one is pasted in. We never store one. When you sign in with Discord, Discord also gives Supabase, our sign-in provider, the email address and picture on your Discord account.
  • Devices you register. For a Wart, we keep its device ID and public key, the name you give it, its firmware version, when you registered it, and when you removed it, if you do. While you claim a Wart, we also keep the claim’s code and a scrambled form of the network address the claim came from, both hashed rather than stored as they are.
  • Which apps you’ve allowed in. When an app asks to sign you in, you see what it’s asking for and choose Allow or Don’t allow. If you allow, Supabase records that app and what you allowed. Apps get your name and GeniusID number, never your email. For some apps we also note what you allowed them to do. The GeniusID app can ask your account which apps hold a sign-in with your GeniusID, and sign one out from your card.
  • What you agreed to at sign-up. The version of the sign-up wording you accepted, and when.

What stays on your iPhone

The GeniusID app keeps these on your iPhone. They aren’t sent to IDuh Genius.

  • Your card’s signature. Drawn or typed, your signature stays on this iPhone, only to draw your card. IDuh Genius doesn’t store it. The app keeps it in one file, outside your iCloud and computer backups, so a new iPhone asks you to sign again. It isn’t in your card’s code, and nothing sends it anywhere. It’s kept only while you’re signed in: signing out, or someone else signing in with their GeniusID on the same iPhone, deletes it, and the next person signs their own card.
  • What you accepted. The versions of the terms and of this notice that you signed, and when, kept while you’re signed in.
  • Your sign-in. Your sign-in tokens are in the iPhone’s Keychain, on this device only, and aren’t synced to iCloud Keychain.
  • One-tap apps. Which apps you allowed to sign in with one tap, and when.
  • Your ticket lights. IDuh Genius apps on the same iPhone tell each other whether they’re signed in through a space they share on that iPhone (an App Group). Each app notes whether it’s signed in, with your GeniusID number and the time, and GeniusID can leave an app a request to sign out. Nothing in that space leaves your iPhone.
  • Wart recordings and screenshots. Recordings are saved on your iPhone until you pick a folder, such as Wart Meetings in iCloud Drive, the one Scatterplot uses. Screenshots stay in the app, and a copy goes to your folder if you picked one. If the folder is in iCloud Drive, Apple keeps it in your iCloud account. GeniusID doesn’t send recordings or screenshots to IDuh Genius.
  • Your Wart’s Wi-Fi. When you choose a network for your Wart, its name and password go to the Wart over Bluetooth. The app doesn’t keep the password.

Signing out removes your sign-in, your signature and what you accepted from this iPhone. The rest stays after you sign out or delete your account. Deleting the GeniusID app removes the files and settings it keeps; sign out first if you want your sign-in gone too. Recordings in iCloud Drive, and the space the app shares with your other IDuh Genius apps, stay until you remove them.

Your card’s code

The code on the back of your card shows another Genius your GeniusID number, your name, the month you joined, which IDuh Genius apps you’re signed in to, your Wart’s name and when you registered it, your card’s finish, and when the code was made. It never carries a sign-in token, your email or your signature. It’s shared only when you show it, and anyone who scans it can read what it says.

Scatterplot

Scatterplot, at scatterplot.iduhgenius.com, is where you collect and sort what matters to you. You sign in with your GeniusID. What you put in Scatterplot is yours. We store it only to run Scatterplot for you.

  • What it saves. Your Inbox: the notes, links and files you add (files up to 6 MB each), meeting transcripts from your Wart’s iPhone app, and anything an agent you’ve connected adds for you. A transcript is made on your iPhone, so Scatterplot gets the words, not the recording. With each item it keeps where it came from (the app or agent that sent it) and how you’ve sorted it: tags, your edits to its title, sender, date or due date, and its project and collection. With a transcript it also keeps the recording device’s name and the recording’s file name. From your GeniusID it reads only your GeniusID number and your name, never your email.
  • Where it’s stored. In Scatterplot’s database at Supabase, in the United States, filed under your GeniusID number. Only Scatterplot’s own server reaches that database, and it shows each person only their own items. Your sign-in to Scatterplot is a cookie that lasts up to 30 days, and the sign-in tokens behind it are stored encrypted. Your items aren’t encrypted by Scatterplot itself, so IDuh Genius, which runs the database, could read them.
  • No AI inside. Scatterplot sorts your Inbox with plain rules, and it doesn’t send your items to any AI. An AI agent sees them only if you connect one and allow it, as described under IDuh MCP below.
  • Deleting. You can delete any item, with its file, whenever you like. Deleting everything at once, downloading a copy, and having your GeniusID’s deletion reach Scatterplot aren’t built yet. Email us and we’ll do them by hand.

Planned: forwarding email to your own Scatterplot address, connecting your HYP Yoga journal, and the Scatterplot iPhone app aren’t open yet. This section will say what each one keeps before it opens.

Connecting an AI agent (IDuh MCP)

IDuh MCP, at mcp.iduhgenius.com, lets an AI agent you use, such as Claude, work with your IDuh Genius apps. It’s open to an invited few today.

  • You see it before you say yes. You connect an agent by signing in with your GeniusID. The consent card shows what the agent will get: your GeniusID number, your name if you’ve set one, and staying signed in until you disconnect it. It also shows what the agent can do, such as reading your Scatterplot Inbox or suggesting wording for an Endgame goal. It’s one yes or no for everything on the card. Nothing is shared until you choose Allow, and an agent never gets your email.
  • What it can read. If the card includes Scatterplot reading, the agent can list, search and open your Inbox items, filed and dismissed ones included. It gets titles, tags, dates, links, each file’s name, type and size, how each item is sorted and up to 20,000 characters of its text, but never the files themselves and never your HYP Yoga journal entries. If the card includes Endgame reading, it can see your goals, their recent history and any open suggestions.
  • What it can write. If the card includes capture, it can add a note, a link or a transcript to your Scatterplot Inbox, marked as added through IDuh MCP. If it includes suggestions, it can leave one suggestion at a time on an Endgame goal. Your goal’s own words don’t change.
  • Where your content goes. What the agent reads goes to that agent and the company that runs it, such as Anthropic for Claude, under your account with them and their terms. IDuh Genius doesn’t control what they keep, so connect only agents you’d trust with it. What the agent reads comes marked as your data, not instructions for it.
  • What we keep. IDuh MCP keeps none of your content. For each request it logs your GeniusID number, which agent asked, which tool it used and whether it worked. It logs no words, results, email or IP address. Netlify keeps those logs on its own schedule, and you can’t see them yourself yet.
  • Disconnecting. Remove IDuh Genius from your agent’s settings to stop it asking. A way to disconnect an agent from your GeniusID is coming. Until then, email us and we’ll end its access.

Talking with our agents

You can chat with IDuh Genius’s agents on iduhgenius.com/agents, and with GeniusHQ in the GeniusID app.

  • Who writes the replies. Your messages go to Anthropic, whose Claude models write the agents’ replies. We send the conversation so far and the agent’s own instructions. We don’t send your name, GeniusID number, email or IP address. Anthropic handles them under its own terms.
  • What we keep. We don’t keep your messages or the replies. Your browser keeps the conversation for that tab until you close it. The app keeps it in memory until you start over, sign out or close the app.
  • Daily limit. To keep a daily limit, we count how many messages each GeniusID sends each day. We keep the count only, not the words. We haven’t set a time to clear these counts yet.

Your card on our Discord server

Genius(es) in the GeniusID app is the way into the IDuh Genius(es) Discord server. Nothing in this section happens unless you choose it.

  • What we check. If your GeniusID has a linked Discord, we ask Discord whether that Discord account is in our server. We don’t keep the answer.
  • Your card. You choose which of these go on a card: your GeniusID name, your bio, your homepage and links, which IDuh apps you’re signed in to, the month you joined, your Wart’s name, and your card number. When you send it, GeniusID’s bot posts the card in the server’s #my-id channel, next to your Discord name. Your email, your first and last name and your full GeniusID number are never on it.
  • Who sees it. Everyone in the server, and Discord, which keeps the post under its own terms.
  • What we keep. Your choices, your card’s look, and the post’s ID, so we can change or remove it.
  • Changing and removing. Changing your choices changes the same post. Taking your card down deletes the post. Deleting your GeniusID deletes it too. If you unlink Discord, the post is removed the next time GeniusID checks. If you leave the server, your card stays up until you take it down.
  • No messages. GeniusID has no messages between Geniuses and no list of Geniuses. Talking happens on Discord, under Discord’s own rules.

Cookies

The account page sets a cookie that keeps you signed in, for up to 7 days without a visit and 30 days in all. It sets short-lived cookies while you sign in: one for up to an hour, one for 10 minutes during a Discord sign-in, and one for 10 minutes that remembers an app’s request to sign you in. Scatterplot sets a sign-in cookie for up to 30 days, and one for 10 minutes while you sign in. Talking with our agents sets a sign-in cookie on iduhgenius.com that lasts 30 days from when you last used it, and two 10-minute cookies while you sign in. Page scripts can’t read any of these cookies, and only the site that set one receives it. We don’t use advertising, analytics or tracking cookies.

Who handles your information

We use these services to run GeniusID. Each handles the part described.

  • Netlify hosts the account site and the website, runs their server code, and stores the agents’ daily counts. It processes technical request information, such as your IP address, the page requested and the time. Our own logs are written without your email, account ID or IP address.
  • Supabase provides sign-in, the account database, private picture storage and Scatterplot’s database, in the United States.
  • An email delivery service sends your sign-in codes for Supabase.
  • Anthropic writes the agents’ replies.
  • Discord, only if you sign in with it, add it, save a Discord bot or send your card to our server.
  • Apple keeps your Wart recordings if you choose a folder in iCloud Drive.
  • Hover/Titan carries the support mailbox, if you write to us.

Providers may process information outside Colorado, using their own infrastructure and subprocessors. Their technical logs and security records follow their own terms. We don’t sell your information.

AI

No AI reads or changes your account, and Scatterplot doesn’t use AI. Agent Big Head, our own AI agent, reviews every message sent to support@iduhgenius.com. Chat with our agents uses AI, and an AI agent you connect through IDuh MCP reads only what you allow, both as described above.

How long we keep it

  • Your account information: while your account exists.
  • A sign-in code’s request: about 15 minutes at most.
  • Session records: cleared within 60 days of the sign-in.
  • Sign-in records: until you delete your account.
  • Limits on sign-in attempts: kept under scrambled forms of your email and network address, and cleared a day after the limit resets. Limits in the app’s account requests are kept under your account ID and cleared from time to time.
  • What you put in Scatterplot: until you delete it, or ask us to.
  • The agents’ daily counts: no time set yet.
  • IDuh MCP’s request logs: as long as Netlify keeps function logs.

We may keep a particular record longer if the law requires it or to deal with an active security matter, and we’ll limit that to what’s needed. Providers keep their own logs and backups under their own schedules, and we can’t promise an exact purge date for copies we can’t reach.

Signing out and deleting your account

  • Sign out on this iPhone. The app removes its sign-in from the Keychain and asks Supabase to end that session.
  • Sign out everywhere. This ends every session on the account page and in the app at once. It takes a code we email you.
  • Delete your account. This also takes a code we email you. Deleting removes your account, your sign-in, your profile picture and your sessions, and signs you out.

Both are on your account page and in the GeniusID app. If either doesn’t work for you, email us and we’ll do it by hand.

Deleting your GeniusID doesn’t yet reach what you’ve put in Endgame, Scatterplot or Giveback Map. Ask us and we’ll delete that by hand too.

Your choices and requests

You can change your display name, picture and Discord bots on your account page or in the GeniusID app. Your Appearance and Reduce Motion settings, and adding Discord, are on your account page. To remove Discord from your account, email us.

To get a copy of what your account holds, or to delete it, email support@iduhgenius.com from the address on the account. We may ask you to confirm it’s you, and we’ll tell you if a legal exception stops us from deleting something. Downloading a copy from the app or the account page is planned. Today both say it isn’t available yet. Privacy laws where you live may give you additional rights.

Changes and contact

We will post the current notice and its effective date here. If our data practices change in a way that matters, we’ll update this notice before using the new practice, tell you in the GeniusID app, and ask you to sign the new version. Questions and requests go to support@iduhgenius.com.

Version history

  • Initial version — 11 November 2026.