Privacy
Privacy architecture
The engineering companion to our Privacy Policy: how the site is built, and why the promise would be hard to break even deliberately.
Updated 2026-09-13 · 9 min read · Genealogy & education only
The promise
Genetic data is not like other personal data. You cannot rotate it after a breach, it stays accurate for your whole life, and it describes people who never agreed to anything — your parents, siblings, children and cousins. A company holding a pile of it is a permanent liability, for them and for you.
So DNADojo does not hold one. Not encrypted, not "temporarily during processing", not at all.
How the architecture enforces it
Promises kept by policy can be changed by a policy update. Promises kept by architecture require someone to build the missing half of a system first — which is a visible, reviewable change rather than a quiet one.
- Static hosting. The site is pre-rendered HTML, CSS and JavaScript on a CDN. There is no application server to receive an upload.
- Client-side calculation. Relationship maths is a few kilobytes of TypeScript and a versioned lookup table, executed on your device.
- Worker-isolated parsing. Raw files go to a Web Worker that contains no
fetch, noXMLHttpRequestand no remoteimportScripts. - Strict Content Security Policy.
connect-srcis locked down, and the Explorer page tightens it further. - No third-party scripts on the Explorer. Nothing else runs on the page where a genotype file is open.
What is handled, and where
| Data | Default behaviour | Optional behaviour | Ever on our servers? |
|---|---|---|---|
| Calculator inputs (a cM number) | Held in page memory only | Included in a share URL if you create one | No |
| Raw DNA file | Read from disk, parsed in a Worker, discarded when the tab closes | Saved to this device's IndexedDB only if you explicitly choose to | Never |
| Parsed SNP index | Session memory | Local cache, clearable with one button | Never |
| Family names, notes, tree details | Not collected | — | No |
| Future Pro research metadata | Not collected | Synced after you sign in, if Pro ships | Metadata only — never raw genotypes |
Analytics allowlist
Usage measurement is useful — it is how we learn which tool to build next. It is also the most common way privacy promises leak, because it is easy to hand an analytics library an object that happens to contain something sensitive.
So the analytics helper on this site accepts only events and property names on a fixed list. There
is no generic track(anything) function to misuse.
| Allowed | Rejected by the helper |
|---|---|
page_view, tool_open, tool_calculate,
parser_started, parser_completed,
parse_duration_ms, file_size_bucket | Raw file content, rsIDs, genotypes, file names, family member names, an exact cM value tied to an identity, note text, anything not on the list |
No analytics provider is currently wired up. The helper's output sink is null, which means the Explorer page today ships with zero third-party requests of any kind.
What DNADojo will never do
- Store raw genotype data on a server.
- Build a cross-user DNA matching database.
- Send DNA, genotypes or identifiable family relationships to a language model or any third-party API.
- Sell, share or license genetic data.
- Provide disease risk, carrier status, drug response or nutrition advice.
- Run advertising on pages where genetic data is handled.
If any of these ever changed, it would not be a feature release. It would be a different product, and it would need a fresh threat model, a legal review, and a new consent flow — not a checkbox in a settings page.
Threat model
| Threat | Mitigation |
|---|---|
| A third-party script reading parsed DNA out of page memory | No third-party scripts on the Explorer page; strict CSP; analytics isolated behind an allowlist |
| Cross-site scripting exfiltrating in-memory data | Static content, no innerHTML with user input, dependency audits, tight CSP |
| Leftover data in IndexedDB on a shared computer | Nothing persisted by default; a single "Clear local DNA data" button removes everything |
| Wrong reference build producing misleading comparisons | Build is detected and displayed, including "unknown"; no automatic conversion |
| A hostile or enormous file freezing the browser | Streaming chunked parse in a Worker, progress reporting, and a cancel button that frees memory |
| A future feature quietly adding an upload | Treated as an architectural change requiring review, not a routine merge |
Your relatives did not consent
This is the part of genetic privacy that consent forms handle badly. Your genotype exposes information about people who never took a test. Uploading your file to a new service is a decision about them too.
DNADojo's answer is to need as little as possible: no account, no upload, no matching pool. It is also why the Explorer exists at all — so that "look inside my own file" does not have to mean "give my file to another company".
Deleting your data
There is nothing on our side to delete, because there is nothing on our side. On your side:
- Press Clear local DNA data on the Explorer to wipe any local project storage.
- Close the tab — in-memory data goes with it.
- Clear site data for this domain in your browser settings if you want to be thorough.