what this site keeps, and who holds it

we count visits with posthog, in its eu cloud. it records the pages you open and what you click, under a random id that posthog keeps in your browser. vercel web analytics also records pageviews and named events triggered in your browser. events sent from the server go to posthog, not vercel.

posthog requests go to wayari.com/ingest first, and wayari.com passes those requests on to posthog.

some events carry a name of their own: a download button pressed, with the system the page guessed you are on, and a checkout opened or failed.

we also count which article led to a download, article engagement, successful copy actions, pricing choices, checkout redirects, key lookup failures and download retries. an activation command copied is counted without its key.

docs search events carry the query length, number of results and selected section. they do not carry the search text. article engagement is counted when the end of the prose is on screen after at least 30 seconds of page-visible time.

the buy pages also count your key shown, your key asked for again, and the billing portal requested.

held byposthog, eu cloudvercel web analytics

checkout happens on stripe's own page. stripe takes your email, and your card if you add one. no card number passes through wayari.com.

when checkout finishes, stripe tells us your email, your stripe customer id, and your subscription's plan, status and dates.

held bystripe

we keep one record per subscription: your email, your stripe ids, the plan, its status and dates, and whether the key email went out.

it sits in vercel blob storage under a name scrambled with a secret, never under your email or your subscription id.

your key is not stored. when you ask for it again, we sign it again from the record.

the buy button also makes a random claim ticket, so the thanks page can find your key.

we file the ticket with your subscription and email. your browser drops its copy once the key shows.

held byvercel blob

your key holds your email address, your plan and its dates, signed so the app can check it offline. anyone with the key can read the address in it.

the app and the command ask wayari.com for a renewed key when they start and every twelve hours. that request names your subscription.

resend delivers your key. it goes out when you buy, and again whenever you ask at /buy/recover.

replies go to jawad@wayari.com.

held byresend

your address is in a supabase table, with the page you signed up from and your browser's user agent. it gets one email per release.

posthog is told that someone joined, never the address itself.

held bysupabase

posthog's random id, and the claim ticket from the buy button until your key shows. this site has no accounts, so there is no login to remember.

to slow down guessing, the forms that send a key, open billing or join the release list count attempts from each ip address for a minute, in memory.

lost the key? /buy/recover sends it to the address you paid with.

to cancel or change your card, paste your key at /buy/manage and stripe's billing portal opens. you can also write to jawad@wayari.com and it is cancelled by hand.

production builds report the first, second, third, fifth and tenth start of the background service, and a start after a week and after a month. each milestone is attempted once per install. opening the dock while the service is already running does not count as another start.

we also attempt five activation milestones once: the first time this instrumentation sees your install, the first job with an agent shift, a second distinct job, the first pull request created for an instrumented job, and the first confirmed merge saved by Wayari. sibling versions of one pin-up wall count as one job; another job need not be a return visit. an agent shift starting is not proof that the agent finished the task. older work and replays are excluded.

while a job has an open bound agent shift, a saved update can report one active-work event per UTC day, including ongoing jobs started before this instrumentation arrived. this measures observed work activity, not every launch or every action. replay experiments are excluded. a merge made on GitHub is only observed if Wayari later saves its confirmed merged record.

events carry the version, operating system, production environment and a random install id. launch milestones may also carry launch counts and time since first launch. we send no code, repository names, folder paths, prompts, channel identifiers or pull request URLs. there is no app autocapture or session replay. the website is measured separately.

set DO_NOT_TRACK=1 or WAYARI_TELEMETRY=0 to stop reporting. WAYARI_INTERNAL=1 also excludes internal use. development builds do not report. local launch stamps still maintain the trial clock.

held byposthog, eu cloud

your coding agents tell us how wayari went for them. this is on by default.

when a job ends, or when wayari got in an agent's way or helped it, the agent sends a short note about wayari itself. at most one per job.

a note says whether something went wrong, went well, or is an idea, and which part of wayari it is about, picked from a fixed list.

it carries a short summary and, if the agent writes one, a few sentences more. then the app's version, your operating system, which coding agent and model sent it, and a random id made on your computer.

before a note leaves your computer, paths, file names, links other than wayari.com, code, email addresses, keys, and names and ids are taken out. a note with too little left is not sent. wayari.com does the same again when the note arrives.

never sent: your code, your repositories' names, branches, file names, the job you asked for, diffs or prompts.

the note is kept in supabase. posthog is told that a note came in, with its kind, its part, the agent, the version and the system, never its words.

to slow a flood, wayari.com counts notes from each ip address for a minute and from each install for a day, in memory.

to turn it off, use the dock's settings or run wayari feedback --off. DO_NOT_TRACK=1 or WAYARI_TELEMETRY=0 turn it off too.

held bysupabaseposthog, eu cloud

questions about any of this go to jawad@wayari.com.

your code is read by the coding agent you already use, under that company's terms, as it is without wayari.