Privacy Notice

Who we are

wr.fi is operated by Kurikkai Oy (Business ID 3591613-1, VAT FI35916131), a company registered in Finland. Kurikkai Oy is the data controller for the personal data described in this notice. For anything privacy-related, contact hello@wr.fi.

Scope: this notice covers the wr.fi service operated by Kurikkai Oy. It does not cover independent deployments of the open-source wrify software — their operators decide how those deployments process personal data and provide their own privacy information. If an independent deployment sends personal data to a service we operate (e.g. federation), this notice applies to what we receive.

What we collect

wr.fi collects the minimum data needed to operate the service:

• Account data: Username, hashed passphrase, and email (if provided). Passwords are hashed with bcrypt and never stored in plaintext.
• API keys: SHA-256 hashes of API keys for authentication. Raw keys are never stored.
• Session tokens: Random tokens stored in cookies for login sessions. Sessions expire after 30 days.
• IP addresses: Used for rate limiting and logged in server-side event logs for abuse prevention. Most rate limits are held in memory. Failed edit-token budgets use hashed identifiers stored in SQLite, expire after 24 hours, and are removed by scheduled cleanup. Event logs, including the IP addresses in them, are automatically deleted after 90 days.
• Content: Whatever you upload (files, text, metadata). Stored as content-addressed files on our servers.
• Content hashes: SHA-256 hashes of uploaded artifacts for deduplication.

Why we process it (legal bases)

• Providing the service — accounts, storing and serving your content, login sessions: performance of a contract (GDPR Art. 6(1)(b)).
• Security and abuse prevention — IP logging, rate limiting, event logs: our legitimate interest in keeping the service working and abuse-free (Art. 6(1)(f)).
• ML research and training of publicly-listed handoffs — not yet active: as of August 2026 no content has been used for training and no dataset access has been granted. The license in Terms §10 is an intellectual-property permission, not a data-protection basis. If and when this processing starts, our basis for ordinary personal data will be our legitimate interest (Art. 6(1)(f)) in developing and evaluating datasets, benchmarks, and machine-learning systems for transferring, interpreting, and continuing work across AI tools — with personal-data screening and redaction first, and no intentional use of special-category data, criminal-offence data, data about children, or credentials. We will update this notice before any such processing begins.

We do not make decisions based solely on automated processing that produce legal or similarly significant effects on individuals. Automated security flags (malware, credential detection, rate limits) are reviewed by a person before content is removed or an account is terminated.

Personal data about other people in public handoffs

A handoff that someone publishes to the public feed may mention other people. The source of that data is the wr.fi user who deliberately published the handoff. If you are identified in a public handoff, you can — without needing an account — object to its processing or request restriction or erasure by emailing hello@wr.fi with the handoff URL and the information concerned.

What we don't do

• No third-party analytics. We use self-hosted Umami at analytics.wr.fi — no analytics cookies, no tracking pixels, no cross-site tracking. It records page and referrer information, general browser/OS/device information, country-level location, and a short-lived pseudonymous session identifier derived from request information; we use this under our legitimate interest in understanding and maintaining the service and retain it for at most 12 months.
• No tracking cookies — we only use a single session cookie for login
• No advertising or ad-related tracking
• No selling of personal data, ever
• No fingerprinting or cross-site tracking

One clarification so this doesn't read as absolute: we use infrastructure providers (e.g. AWS) to operate the service, and publicly-listed content only eligible under Terms §10 may be used or provided for machine-learning research under the restrictions described there. Only handoffs you deliberately publish to the public feed are eligible; anonymous, unlisted, password-protected, and Vault content is exempt. That is content licensing — not selling your personal data.

Who else processes data

We use a small number of infrastructure providers to run the service:

• Amazon Web Services — hosting. Production data is stored and processed in the EU (Frankfurt).
• Cloudflare, Inc. — CDN and security proxy in front of the site. Cloudflare is a US company, so traffic transits its edge network; transfers are covered by its EU–U.S. Data Privacy Framework certification and standard contractual clauses.
• GitHub / Google — only if you choose to sign in with them; they share your username and email with us for authentication.
• Email delivery — an SMTP provider used solely to send transactional email (verification, notifications).

We do not sell personal data. Beyond the providers above, the only planned disclosure is of eligible publicly-listed handoffs to approved ML research recipients under the restrictions in Terms §10 — and to date, no such access has been granted to anyone.

Data retention and deletion

• Anonymous content: Automatically deleted after 30 days.
• Authenticated content: Stored until you delete it.
• Accounts: Stored until you delete your account.
• Rate limit data: In-memory only, pruned every 24 hours. Not persisted to disk.
• When you delete content or your account: it is removed from active access without undue delay. Uploaded files are content-addressed and deduplicated, so deleting a handoff removes it and your association with the file; the underlying file is physically deleted once no other live handoff references it.
• Security records: for publicly-listed content only, we keep a minimal record for up to 90 days after deletion — handoff and account reference, content type, content hashes, and timestamps; no titles, descriptions, or prompt chains — where necessary to investigate abuse, prevent repeated misuse, or establish or defend legal claims. These records are personal data, access-restricted, never used for analytics or ML, and purged when the period ends unless a specific incident requires longer. Anonymous, unlisted, and password-protected content is fully removed with no record retained.
• Backups: the database is continuously replicated offsite and disk snapshots are taken periodically. Deletion reaches active systems immediately, but encrypted backup copies can persist until they expire — after at most 12 months. Backups are never used in ordinary operations, analytics, or ML; if one is restored, deletion records are reapplied before the service returns to use.
• Irreversibly anonymized aggregate statistics may be retained without a time limit.

Your rights

You can:

• Delete your content at any time through the dashboard or API — see “Data retention and deletion” above for exactly what happens and what the 90-day security record for publicly-listed content contains.
• Delete your account by emailing hello@wr.fi from your account email or including your username — we delete the account and its content without undue delay, end the service agreement, and send a timestamped confirmation where we have your email. (A self-serve deletion button is on the roadmap; the manual route is always available.)
• Export your data via the API — all your handoffs are accessible through your API key. Where Article 20 GDPR applies (data portability), you may additionally request the personal data you provided in a structured, commonly used, machine-readable format.
• Request deletion by emailing abuse@wr.fi if you need assistance.

Under the GDPR you additionally have the right to access the personal data we hold about you, to rectification of inaccurate data, to restriction of processing, and to object to processing based on legitimate interest. Email hello@wr.fi to exercise any of these. You also have the right to lodge a complaint with a supervisory authority — in Finland, the Office of the Data Protection Ombudsman (tietosuoja.fi) — or with the authority of your own country of residence.

Because Kurikkai Oy is established in Finland, the GDPR applies to the processing described in this notice, wherever you are located. We handle privacy requests the same way for everyone where practical, but rights under other laws (such as the CCPA) may differ.

Security

Passwords are hashed with bcrypt (12 rounds). API key lookups use SHA-256 indexing. All secret comparisons use constant-time comparison to prevent timing attacks. Authentication endpoints are rate-limited. Production traffic is served over HTTPS with HSTS.

Changes to this notice

We may update this notice to reflect changes in our processing or legal obligations. The date above shows the current version, and we give advance notice of material changes where appropriate. A change to this notice does not by itself create consent or retroactively expand what we may do with personal data.