Privacy policy

Wirebook (wirebook.app) is operated by [TODO: legal name of the operator / company], [TODO: postal address], who is the data controller for the personal data described here. Questions or requests: privacy@wirebook.app.

• Account details — when you sign in with Google we receive your email address, name and a Google account identifier. We don't receive your Google password.
• Sign-in sessions — while you're signed in we keep a session record with the IP address and browser it was started from.
• Your content — the maps and diagrams you create: node names, tags, links, icons, layout, code snippets and notes, folder structure, and changes proposed by agents you connect.
• API keys — if you create an MCP key we store a one-way hash of it, its first few characters, an optional label and the creation date. We never store the key itself.
• Usage counts — how many agent writes your account made each month. These are counts, not contents.
• Technical logs — our hosting provider records request metadata (such as IP address, time and endpoint) and application errors, which can contain fragments of the request.
• Visit statistics — Cloudflare Web Analytics counts visits to wirebook.app: the page, the site you came from, your country, browser and device type, and how fast the page loaded. It sets no cookies and stores nothing on your device, and we see only totals, never who visited.

We don't use advertising or tracking cookies, and we don't sell or rent personal data.

• To provide the service you signed up for — storing, showing and syncing your maps (contract).
• To keep it secure and working — preventing abuse, fixing faults, limiting runaway usage (legitimate interests).
• To understand how many people visit and which pages they use, from visit totals only (legitimate interests).

Agents you connect yourself through MCP (for example Claude Code) are your own tools: what they do with a map they read is governed by that tool's provider, not by us.

• Cloudflare — servers, database, sign-in sessions, backups and logs; serves the website and carries all traffic between your browser or agent and our servers; domain name services. Data is stored in the EU (Cloudflare's EU jurisdiction). Also counts visits for us (Web Analytics, above); those counts aren't covered by the EU storage. Also forwards email sent to our addresses and sends our replies; that email isn't covered by the EU storage either.
• Google — sign-in, and the Gmail inbox that holds email you send to our support and privacy addresses and our replies.
• Sentry — error reports from the app and our servers: the type of error, where in our code it happened and which part of the service it affected, stored in the EU. Reports leave out your maps, names, notes, sign-in details and IP address.
• Amazon Web Services — ran our servers and database until 6 November 2026. A copy of the data held then stays in the AWS London (eu-west-2) region, unused, until we delete it, by the end of February 2027.

Where data leaves the UK/EEA (any processing by the US-based providers above), transfers rely on the providers' Standard Contractual Clauses / UK International Data Transfer Addendum.

• Your content and account details: until you delete them or your account.
• The code and notes of a node you delete from a wirebook: kept for 30 days so undo can bring them back, then removed.
• Sign-in sessions: until you sign out, or a week after you last used the app.
• Monthly agent-write counts: about 13 months.
• Application logs: up to 30 days.
• Backups: our database keeps point-in-time recovery for 30 days and we keep nightly copies for 30 days, so deleted data can persist in backups for up to 35 days before it's gone for good.

The app keeps your sign-in session in cookies, set only when you sign in, and interface preferences (color mode, open tabs, folded branches and similar) in your browser's local storage, and maps you make while signed out in its IndexedDB (their folders in local storage). These are needed for the app to work and never leave your device except as part of normal use. Sign-in cookies are the only cookies we set; visit statistics use none.

You can, at any time:

• Download everything — Menu → Plan & usage → “Download all maps”, or save a single map from the File menu.
• Delete your account — Menu → Plan & usage → “Delete account”. This removes your maps, content, proposals, API keys and sign-in immediately (backups age out within 35 days).
• Revoke API keys, and edit or delete any map.

You also have the right to access, correct, restrict or object to our use of your data. Email privacy@wirebook.app and we'll respond within one month. If you're unhappy with our response you can complain to your data protection authority — in the UK, the ICO.

Wirebook is not intended for anyone under 16, and we don't knowingly collect their data.

If we change this policy in a way that matters, we'll update the date above and tell signed-in users in the app before the change takes effect.