Sign in

Privacy Policy

Short version

We store the wikis you write, the identity you sign in with, images you upload, basic server logs, error reports when something crashes, and aggregate page-view analytics from Google Analytics. The iOS app adds two of its own: which screen you opened, and a report when it crashes. We do not sell your data and do not show ads. Wikis you mark as public, and pages you publish with a share link, are readable by anyone on the web.

Who we are

WikiLayer is operated by Maxim Oranskiy PR Novi Sad, a sole proprietorship registered in Novi Sad, Serbia. Contact for any privacy question: info@wikilayer.org.

What we collect

Account. Signing in with Apple, GitHub or Google gives us the user id that provider assigns you, your verified email address, and your display name. We never see your password at the provider. Apple hands over the name only on the very first sign-in, and only if you let it, so a hidden name never reaches us at all. One account can hold several sign-in methods, matched by that verified address, so signing in a different way reaches the same wikis.

Content. Whatever you write into a wiki (pages, blocks, titles) is stored as you save it, together with a per-edit history row recording the actor, timestamp, and previous values.

Images. Pictures you upload, and the avatar shown next to your name, are stored in object storage under an address that is not secret: anyone holding it can fetch the file, whether or not the wiki it sits in is public.

Server logs. Every HTTP request is logged with: timestamp, IP address, User-Agent string, requested URL, and HTTP status. Kept for 30 days, then deleted.

Cookies. An opaque session cookie keeps you signed in. A few more remember preferences and carry you through signing in. Google Analytics sets _ga and _ga_<id>, holding the random visitor id behind the analytics described below. We embed no advertising networks.

Error reports. When the server hits an unexpected error, an event is sent to Sentry (operated by Functional Software, Inc., United States) containing the IP address, User-Agent, requested URL, and a stack trace. Used solely to diagnose the bug. International transfer to the US is governed by the Standard Contractual Clauses.

Analytics. Pages on the cloud-hosted WikiLayer.org load Google Analytics 4 (operated by Google LLC / Google Ireland Ltd.). It records page-view events tied to a randomly-assigned client id stored in your browser, plus the IP address (truncated by Google before storage), User-Agent, and referrer. We use the aggregate data to understand which parts of the site get used and to spot performance regressions; we do not use it to profile individual visitors. International transfer to the US is governed by the Standard Contractual Clauses.

Pages also load Umami (operated by Umami Software, Inc.), which counts page views without cookies and without an identifier that follows you between visits.

Self-hosted single-user installations of WikiLayer load neither.

The iOS app. The app keeps the wikis you follow on the device so you can read them without a network, and holds your sign-in token in the system keychain. It sends two things of its own, both to Google's Firebase (operated by Google LLC / Google Ireland Ltd.):

  • Analytics: which screen you opened and when, tied to an app instance id Google assigns to the install. It records no page titles and no wiki contents. Deleting the app ends that id.
  • Crashlytics: when something fails, a report with the device model, the operating-system version, a stack trace, and the short description we attach to the failure — what was being done and what went wrong. It carries neither the text you were reading nor your email address.

Neither is used to advertise to you, and the app asks for no tracking permission because it tracks you across nothing. International transfer to the US is governed by the Standard Contractual Clauses.

What we do not collect

No advertising trackers. No fingerprinting. No selling of any data to anyone, ever.

Where the data lives

The database, the application servers, and uploaded files are hosted with Akamai / Linode in Frankfurt, Germany (EU). Error reports leave that region as described above.

Public wikis and share links

When you mark a wiki Public, it is genuinely public: anyone with the URL can read it without signing in, and search engines may index it. Do not put information you want kept private into a public wiki.

A single page of a private wiki can also be published on its own by enabling a share link. Anyone holding that link can read the page without signing in; disabling it revokes access. Search engines are asked not to index share links, but that is a request robots honour voluntarily, not a barrier.

Sharing

We do not share your data with anyone except:

  • Apple, GitHub or Google, during the sign-in handshake, and only the provider you choose.
  • Sentry, for error reports as described above.
  • Google Analytics and Umami, for aggregate page-view data as described above.
  • Firebase, for the app's screen events and crash reports as described above.
  • Hosting and infrastructure providers (Akamai/Linode) that store the data on our behalf under contract.
  • Authorities, when required to comply with applicable law.

Your rights

You can email info@wikilayer.org at any time to:

  • ask what we hold about you,
  • correct it,
  • delete your account and all wikis you own,
  • export your wikis as JSON.

If you are in the EU/EEA you also have the right to lodge a complaint with your local data protection authority.

Retention

Account and wiki data are kept until you delete your account or ask us to. Server logs are kept for 30 days. Sentry events follow Sentry's default 90-day retention. Firebase keeps crash reports for 90 days and analytics events for 14 months. Backups are kept for up to 30 days and then overwritten.

What the app holds on your device — the wikis you follow, their pictures, and your sign-in token — stays there until you sign out or remove the app.

Children

WikiLayer is not directed at children under 13, and we do not knowingly collect data from anyone under 13.

Changes to this policy

If we change anything material we will update this page and its revision date. For changes that affect what we collect or how we share it, we will additionally notify signed-in users by email before the change takes effect.