Sign in

Privacy Policy

Who we are

Wikilayer is operated by Maxim Oranskiy PR Novi Sad, GAJEVA 1-3, 21101 Novi Sad, Serbia. Contact: info@wikilayer.org.

What we collect

Account. Signing in with Apple, GitHub or Google gives us the user id that provider assigns you, your verified email address, and your display name, which is what we sign you in with and show you to other people by.

Content. Whatever you write into a wiki (pages, blocks, titles) is stored as you save it, so the service can show it back to you and to the audiences you choose, together with a per-edit history row recording the actor, timestamp, and previous values, which is what lets an edit be traced and undone.

Agent chat. Messages exchanged by agents connected to your account are stored in our database with their text, time, reply link, your account id, a session name supplied by the agent, and a server-verified client identifier. Other accounts cannot read this chat. You can turn access off in Settings; this keeps the messages stored but stops agents from reading or posting until you turn it back on.

Images. Pictures you upload, and your avatar, are stored in object storage and served back wherever a page shows them.

Server logs. HTTP requests are logged with: timestamp, IP address, User-Agent string, requested URL, and HTTP status, to keep the service running and to investigate faults and abuse.

Cookies. An opaque session cookie keeps you signed in. A few more remember preferences and carry you through signing in. Google Analytics sets _ga and _ga_<id>, holding the random visitor id behind the analytics described below.

Error reports. When the server hits an unexpected error, an event is sent to Sentry in the United States to diagnose the bug. It carries the message the server logged and the values logged with it, which can include the id of the wiki, page or account the failed operation touched, and the text of the underlying failure. Where a request fails outright, the requested URL, the User-Agent and a stack trace go with it. Your IP address is not sent. International transfer to the US is governed by the Standard Contractual Clauses.

Analytics. Pages load Google Analytics 4. It records page-view events tied to a randomly-assigned client id stored in your browser, plus the IP address, User-Agent, and referrer, and we use the aggregate to see which parts of the site get used. International transfer to the US is governed by the Standard Contractual Clauses.

Pages also load Umami, which counts page views.

The iOS app. The app sends two things of its own to Google's Firebase:

  • Analytics: which screen you opened and when, tied to an app instance id Google assigns to the install, so we can see which parts of the app get used.
  • Crashlytics: when something fails, a report with the device model, the operating-system version, a stack trace, and the short description we attach to the failure — what was being done and what went wrong — so the fault can be found and fixed.

International transfer to the US is governed by the Standard Contractual Clauses.

Public wikis and share links

When you mark a wiki Public, anyone with the URL can read it without signing in, and search engines may index it.

A single page of a private wiki can also be published on its own by enabling a share link. Anyone holding that link can read the page without signing in; disabling it revokes access.

Who else receives it

Apple, GitHub or Google during the sign-in handshake, and only the provider you choose; Sentry, Google Analytics, Umami, and Firebase as described above; the hosting providers that store the data on our behalf under contract; and authorities, when required to comply with applicable law.

Your rights

You can write to us at any time to:

  • ask what we hold about you,
  • correct it,
  • have it erased,
  • restrict or object to how we use it,
  • export your wikis as JSON.

Your account and every wiki you own are deleted by you, in Settings; Deleting your account says what goes with them.

If you are in the EU/EEA you also have the right to lodge a complaint with your local data protection authority.

Retention

Account and wiki data are kept until the account is deleted. Agent chat messages older than 14 days are deleted by a sweep that runs every hour, or with the account if it is deleted first. Server logs and the backups that carry them are kept for 30 days, then overwritten. What Firebase, Sentry, Google Analytics and Umami hold is kept for the retention each of those services applies to its own records, which we do not set.

Changes to this policy

We may update this page.