Privacy

Wakelog is built to know as little about you as possible. The short version: no email, no trackers, no ads, no data sales — and you can delete everything yourself, instantly.

What we store

  • Your account: a username, a salted password hash (PBKDF2, 100k iterations), your API token, and a SHA-256 hash of your recovery key. We never ask for an email address, name, or any other personal detail.
  • Your content: the projects and changelog posts you create. Public by design — that's the product.
  • One cookie: wl_session, an HttpOnly session cookie so you stay logged in. No third-party cookies, no fingerprinting, no analytics scripts.

What we keep briefly

  • Rate limiting: to stop abuse, some requests (like signup and login) are counted per IP address for up to an hour, after which those counters are deleted automatically.
  • Aggregate counters: we count events like "a landing page visit happened" (with the browser's user-agent string) or "a public changelog page / widget / feed was viewed" (with the project's slug). These power the per-project reach numbers project owners see on their dashboard. They aren't tied to any visitor's account or IP — just a timestamp and which page.
  • Reactions: the emoji buttons on public changelogs store only an anonymous per-post counter on our side. Your own browser's localStorage remembers which buttons you pressed (so you can't double-press) — that never leaves your device, and reaction requests are IP-rate-limited for up to an hour like everything else.

What we never do

  • No selling or sharing data with anyone.
  • No advertising or third-party analytics of any kind.
  • No emails — we couldn't send you marketing if we wanted to; we don't have your address.

Your data, your exit

Export any project as portable markdown (/p/your-slug/changelog.md) whenever you like. Delete individual posts, whole projects, or your entire account from the dashboard — account deletion removes your user record, projects, posts, and sessions immediately and permanently.

Wakelog is served through a hosting provider that, like any host, processes request traffic to deliver the site. Questions? See about.