what this site keeps, and who holds it

we count visits with posthog, in its eu cloud. it records the pages you open and what you click, under a random id that posthog keeps in your browser.

those requests go to wayari.com/ingest first, and wayari.com passes them on to posthog.

some events carry a name of their own: a download button pressed, with the system the page guessed you are on, and a checkout opened or failed.

the buy pages add three: your key shown, your key asked for again, and the billing portal requested.

held byposthog, eu cloud

checkout happens on stripe's own page. stripe takes your email, and your card if you add one. no card number passes through wayari.com.

when checkout finishes, stripe tells us your email, your stripe customer id, and your subscription's plan, status and dates.

held bystripe

we keep one record per subscription: your email, your stripe ids, the plan, its status and dates, and whether the key email went out.

it sits in vercel blob storage under a name scrambled with a secret, never under your email or your subscription id.

your key is not stored. when you ask for it again, we sign it again from the record.

the buy button also makes a random claim ticket, so the thanks page can find your key.

we file the ticket with your subscription and email. your browser drops its copy once the key shows.

held byvercel blob

your key holds your email address, your plan and its dates, signed so the app can check it offline. anyone with the key can read the address in it.

the app and the command ask wayari.com for a renewed key when they start and every twelve hours. that request names your subscription.

resend delivers your key. it goes out when you buy, and again whenever you ask at /buy/recover.

replies go to jawad@wayari.com.

held byresend

your address is in a supabase table, with the page you signed up from and your browser's user agent. it gets one email per release.

posthog is told that someone joined, never the address itself.

held bysupabase

posthog's random id, and the claim ticket from the buy button until your key shows. this site has no accounts, so there is no login to remember.

to slow down guessing, the forms that send a key, open billing or join the release list count attempts from each ip address for a minute, in memory.

lost the key? /buy/recover sends it to the address you paid with.

to cancel or change your card, paste your key at /buy/manage and stripe's billing portal opens. you can also write to jawad@wayari.com and it is cancelled by hand.

besides renewing your key, the app sends seven events, each once in the life of an install.

they are the first, second, third, fifth and tenth launch, and an open after a week and after a month.

each carries the app's version, your operating system, a random id made on your machine, how many times it has launched, and how long since the first. never your code, your repos, your folders or your prompts.

set DO_NOT_TRACK=1 or WAYARI_TELEMETRY=0 and none of it is sent, and no id is made.

held byposthog, eu cloud

questions about any of this go to jawad@wayari.com.

your code is read by the coding agent you already use, under that company's terms, as it is without wayari.