Privacy

The short version: we keep private counts of search queries to improve Wren, without attaching searches to an account or visitor identifier. The longer version is below, including the parts that are not entirely in our hands.

Searching

• Private query counts help us find problems. For first-page searches without optional result filters, we keep the query text and a daily count, alongside counts of searches displaying no results, searches over five seconds and failures, plus aggregate server timings. We do not retain an individual event, exact request time, network address, browser details, cookie, account or result list with a query. The owner may explicitly select a query and its aggregate counts for a private search-quality investigation. Those selected copies, together with review notes, are kept in a separate queue of up to 500 queries for up to 90 days since their last observation or selection; expired entries are removed the next time the queue is used. They remain unlinked to visitor identifiers. Copies enrolled in the scheduled analysis workflow are scheduled for deletion after 30 days on the next successful daily cleanup. An offline machine, changed files or storage errors can delay deletion pending review. Other private investigation exports require manual removal by their recorded deletion deadline. Live-counter cleanup does not itself remove exported files, and backups follow their separate retention policy. Live counters are scheduled for deletion once older than 30 UTC dates, with cleanup on collection and each minute. Storage failures can delay deletion. Encrypted server backups can contain older counters; backup retention keeps seven successful generations and the newest verified restoration backup, which can be older. These reports are private to the owner and are not sent to an analytics provider. Query text itself can contain personal information. Collection has bounded storage and can omit requests during contention or storage failures.
• You can also choose to send feedback. At the end of a page of results there is a link reading “Not what you were looking for?”, and pressing it sends us that one search so we can see what Wren is bad at. It says so before you press it. What we keep is the search text, the time, and the fact that it came from a results page — not your address, not which results you saw, not anything that ties it to you or to any other search you have run. The feedback form can also store a search you choose to send. A result issue report stores the selected result address, issue type and your optional note alongside that search, only after you press Send. A page suggestion stores the page address, optional search, note and reply address privately for owner review, only after you press Send. None of these reports happen on their own.
• No cookies for ordinary reading or searching. An ordinary visit sets none at all — no identifier, no session, nothing kept between visits. Opening the optional account sign-in page starts one session cookie for passkeys and account forms. It is not used to record searches or ordinary clicks. Owner admin sign-in uses a separate session cookie.
• No tracking scripts and no third-party requests. No pixels, no hosted fonts, no content delivery network. Every page is served whole from our own machine, which is why ordinary analytics uses no cookies or browser tracking script.
• We count page views on our own server, not in your browser. When a page is served, our machine notes it on a counter that also runs in this house. Your browser is not asked to do anything and never contacts it. What the counter is told is the address of the page — /search.php, never the words you typed — the site you arrived from, without whatever it had in its own address bar, and the language your browser asked for. Your network address is not passed on, so the counter cannot tell two visitors apart. That makes the visitor numbers a guess and the page counts exact, which is the trade we want.
• The web server keeps a line per request, with the search removed. It records that /search.php was served and when, never the words you typed. That stripping is done in web/bin/serve.sh, and it is the reason the system log cannot become a query log by accident.

Optional accounts and contributions

Accounts retain a pseudonymous display name, creation date, passkey public keys and counters, and your explicitly chosen public-profile setting. Email is not collected. Search text and ordinary click history are not attached to an account.

Voting stores the page URL, reason, time, a frozen vote weight and your account reference. A reading receipt is created only when you press the vote form's Open article button, and expires after an hour and is removed by the next minute of maintenance. For a “useful” vote, the question you explicitly send is retained only as a keyed hash. Adjudication events retain reviewed evidence. Public profiles show earned trust, never vote URLs, questions or reading receipts. Profiles are private until you choose otherwise.

Publisher claims retain the domain, a hashed ownership challenge and proof dates. Remeasurement requests retain queue status and reviewed dispositions. Published collections retain the URLs and notes you choose to share. Account deletion removes profiles, passkeys, claims, reading receipts and collections, and removes the account reference from retained vote labels and measurement requests.

There is no password or email recovery. Add a second passkey before losing your first. Sign-in sessions expire after an hour without an account action. Public API and account-abuse limiters retain salted stand-ins for network addresses or explicitly opened account sessions for at most an hour plus the next minute of maintenance, without searches.

What Cloudflare sees

Wren runs on a machine in a home, reached through a Cloudflare tunnel. Cloudflare is the network in front of us: it terminates the encryption, so it necessarily sees your address and the address of each page you request, and it keeps its own logs under its own policy. We cannot see or delete those, and we do not receive them. What reaches us through the tunnel does not include your network address at all.

If you send us a message

The feedback form stores exactly what you type into it, and nothing else about you. If you leave the reply field blank, we have no way to write back and no way to know who sent it. To stop one script filling the disk, the form keeps a scrambled stand-in for your network address for one hour and counts messages against it; it cannot be turned back into an address, and it is discarded after the hour.

To have a message deleted, send another one quoting it, and it will be removed.

The site suggestion form stores the submitted site address and time privately for owner review, with the same one-hour spam limiter and no cookies. Suggestions sent to the crawl queue are retained with crawl progress. To request deletion of a suggestion, send feedback identifying the site.

What we do not do

We do not sell queries or clicks, we do not profile visitors, we do not build a search history, and we do not sell advertising against what you searched for. Those are promises rather than settings, and they are listed with the rest on Not for sale.

Crawling, which is the other direction

WrenBot visits public web pages to judge how readable they are. It collects page text and load measurements, obeys robots.txt, and does not collect personal data or train models. Its full disclosure is at wren.is/bot.

Changes

October 17, 2026: clarified owner-selected investigation copies, the separate 90-day queue retention and cleanup of private analysis exports.

October 6, 2026: added private daily query counts to identify missing results, slow searches and failures. Earlier versions did not store ordinary search queries. Searches remain unlinked to accounts and visitor identifiers.

If any of this stops being true, it will be changed here, with the date and the reason, in the same way the promises are. This page describes Wren as it runs today, in beta: what beta means.