Privacy Policy

Effective May 21, 2026

This policy describes what Wanderwhim collects, how it is used, and the third-party services it relies on. It is written to be read, not to cover anyone’s back.

What we collect

Account information. Email address and password hash (passwords are never stored in plaintext).
Content you create. Topics, sources, notes, writings, regions, and explorations. This is your data — we treat it as confidential and do not sell or share it.
Usage events. Page paths, referrer, IP address, user agent, session ID, and product events (topic created, exploration generated, etc.). Stored in our own database, not sent to a third-party analytics provider.
Billing details. When you start a paid plan, Stripe collects your payment method. We never see your card number — only the subscription state, customer ID, and billing email.

How we use it

To operate Wanderwhim and provide the features you ask for.
To generate AI responses against your sources. The text you submit to AI features is sent to our model gateway and embeddings provider. Their handling of submitted text is governed by their own policies.
To enforce usage limits and protect against abuse (rate limits, billing caps).
To send transactional email (sign-up confirmation, password reset, billing notices) via a transactional email provider.
To understand product usage in aggregate. We do not build advertising profiles and do not run third-party trackers.

Third-party processors

Wanderwhim runs on a small set of vendors. Each receives only the data needed to do its job. Our current subprocessors are listed below; we will update this list when it changes.

Supabase — authentication, database, file storage.
Render — application hosting and runtime logs.
OpenRouter — gateway to large language models from major AI providers. Receives prompts and source content you submit to AI features.
VoyageAI — generates embeddings from source text so the canvas can place related sources near each other.
Stripe — payment processing and subscription management.
Resend — transactional email delivery.
Sentry — error and exception logging from the app and server. Receives error context (stack traces, request paths, browser/OS info) when something goes wrong.

Retention & deletion

Your content is retained while your account is active. You can delete any item from inside the app. From Settings → Account you can delete your entire account; this removes your profile, topics, sources, writings, and usage history from our database. Stripe retains a record of past transactions for tax and audit compliance.

Cookies & local storage

We use first-party cookies for authentication (an auth-provider session) and localStorage for a session identifier used to dedupe analytics events. No third-party advertising cookies are set.

Your rights

You can export, correct, or delete your data at any time from inside the app. If you are in the EU, UK, or California, you may also have the right to request a copy of the personal data we hold about you, or to object to processing. Reach us at [email protected] and we will respond.

Children

Wanderwhim is not intended for users under 16. We do not knowingly collect data from children.

Changes

Material changes to this policy will be announced via email or an in-app notice before they take effect. The effective date at the top reflects the most recent revision.

Contact

Questions or requests: [email protected].