Privacy
In plain English
Wikai is local-first: your wikis live on your disk and never reach our servers. We hold only what billing, licensing, support, security, and basic website operation require.
Who we are
Wikai is made by Atomic Bits BV, Bruinbeekstraat 7, 2820 Bonheiden, Belgium. KBO/CBE: 0837.568.373. VAT: BE0837.568.373.
For any privacy question, email legal@wikai.app.
What we collect
- Free users: nothing that directly identifies you. The update check logs an IP address per request, kept no longer than 30 days.
- Paying customers: licence key, email address, country, device labels you choose, and subscription metadata from Paddle, the merchant of record for Wikai orders.
- Website visitors: aggregate country and referrer via Cloudflare Web Analytics. No cookies and no personal identifiers.
- People who email us: whatever you put in your message, plus normal email metadata.
- Security reporters: contact details, report content, and any follow-up information needed to investigate the report.
What we don’t collect
- Your wiki content: it lives on your disk and never transits our servers.
- Your chat sidebar conversations: handled on your machine and by the agent backend you connect.
- Search queries, page views, time-in-app, product telemetry, usage analytics, or profiling data.
How we use personal data
| Purpose | Data | Legal basis | Why |
|---|---|---|---|
| Licence issuance and validation | Licence key, email, country, subscription status, device labels you choose | Contract | Needed to deliver Supporter licences and prevent obvious key abuse |
| Billing support and refunds | Paddle subscription metadata, email, refund request details | Contract and legal obligation | Needed to help with purchases, cancellations, refunds, tax records, and disputes |
| Update checks | IP address and technical request data | Legitimate interest | Needed to deliver security and compatibility updates with minimal data |
| Support | Email address and message content | Contract or legitimate interest | Needed to answer your request |
| Security reports | Contact details and report content | Legitimate interest and legal obligation | Needed to investigate vulnerabilities and meet security-reporting duties |
| Website analytics | Aggregate country and referrer | Legitimate interest | Needed to understand whether the public site works, without cookies or personal identifiers |
| Legal compliance | Records relevant to tax, accounting, disputes, security, or regulator requests | Legal obligation or legitimate interest | Needed to comply with Belgian, EU, UK, tax, accounting, consumer, and security law |
| Future opt-in newsletters | Email address and consent record | Consent | Used only if you opt in; you can withdraw consent at any time |
Cookies and similar technologies
Wikai sets no cookies — not on this website, not in the app. Cloudflare Web Analytics, which gives us aggregate country and referrer counts, works without them. That is why this site has never shown you a cookie banner.
Two small preferences are stored in your browser, both in localStorage,
both written only when you change the setting yourself, and neither ever
leaves your machine:
- Your light/dark theme choice — holds nothing but
lightordark, so the site does not flash the wrong theme on your next visit. - Your currency choice on the pricing page — holds nothing but
EUR,USDorGBP, so you are not shown a currency you already changed away from.
Neither identifies you, neither is sent anywhere, and neither is a cookie.
Checkout is Paddle’s surface, not ours. If you buy a Supporter licence, the payment step and the customer portal are operated by Paddle, our merchant of record and the seller on that transaction. Paddle may use cookies or similar technologies there to run and secure the payment. Those are Paddle’s, not ours — they are governed by Paddle’s privacy policy, and they come into play only if you start a purchase. Browsing this site never triggers them.
If we add something that sets a cookie of our own, this section changes and, where required, the site will ask for consent before setting it.
When you use the agent or web search
Two optional features send data off your machine, and only when you use them:
- The chat sidebar sends your prompt and the relevant wiki context to the agent backend you connected, such as your own Claude Code subscription or Anthropic API key. Wikai does not sit in the middle or keep a copy.
- Internet search is off by default. When you turn it on, search queries go to an external search provider, currently Tavily or Brave, not to Atomic Bits. Harvested pages are labelled and stay unapproved until you approve them.
Sub-processors
| Sub-processor | Purpose | Location | DPA / terms |
|---|---|---|---|
| Cloudflare | Hosting, DNS, Web Analytics, edge CDN | Global | Data Processing Addendum |
| Paddle | Payments, EU/UK/US tax, customer portal. Paddle is the merchant of record for Wikai orders | UK / EU / US | Data Processing Addendum |
| Resend | Transactional email, e.g. activation links and customer notices | US | Data Processing Addendum |
| Anthropic | Your chat prompts and the wiki context they need, only when you use the chat sidebar under your own Claude Code or API-key agreement | US | Your agreement with Anthropic |
| Tavily or Brave | Search queries, only if you turn on internet search | US / varies | Tavily terms / Brave Search API privacy notice |
| GitHub | Public feedback, if you choose to post there | US | GitHub Privacy Statement |
| Apple | Code-signing and notarisation of the macOS app | US | Apple Developer Program agreement |
| Microsoft (Azure) | Code-signing of the Windows app (Trusted Signing) | EU / US | Microsoft Products and Services DPA |
Apple and Microsoft sign the app we release to you. They receive no personal data of yours from Wikai; they are listed because they are part of how a trustworthy build reaches your machine.
If we add or replace a sub-processor in a way that materially affects customer personal data, we will give customers 30 days’ notice where practical.
International transfers
Where personal data leaves the European Economic Area, we rely on an adequacy decision where one covers the transfer, such as the UK, and otherwise on Standard Contractual Clauses, the EU-US Data Privacy Framework where applicable, or another safeguard permitted under Chapter V of the GDPR.
Retention
- Update-check IP logs: up to 30 days.
- Support and legal emails: as long as needed to handle the request, then normally up to 3 years for dispute history unless law requires longer.
- Billing, invoice, tax, and accounting records: normally 7 years, as required for Belgian accounting and tax records.
- Licence records: while the licence or customer relationship is active, then as long as needed for accounting, fraud prevention, chargeback defence, or legal claims.
- Security reports: as long as needed to investigate, fix, coordinate disclosure, and keep an audit trail for security obligations.
Backups may keep deleted records for a limited period after deletion from active systems. Backup copies are used only for backup integrity, security, disaster recovery, and legal compliance, not for ordinary customer handling.
Security
We use reasonable technical and organisational measures for the limited personal data we hold. No system can be made perfectly secure.
If a personal-data breach creates a legal notification duty, we will notify the competent authority and affected people as required by law. Security vulnerability reporting is described on the Security page.
Automated decision-making
We do not use your personal data for profiling or automated decisions that produce legal or similarly significant effects.
Your rights
You can ask for access, correction, deletion, restriction of processing, objection, or a copy of your personal data. Where processing is based on consent, you can withdraw consent at any time.
Email legal@wikai.app. We will respond within one month unless the law allows an extension. We may ask you to verify control of the relevant email address or licence key before acting on a request.
If something looks wrong, please tell us first so we can fix it. You can also complain to the Belgian Data Protection Authority:
Gegevensbeschermingsautoriteit / Autorite de protection des donnees
Drukpersstraat 35, 1000 Brussels, Belgium
contact@apd-gba.be
https://www.gegevensbeschermingsautoriteit.be
Children
Wikai is not directed at children under 16.
Archived versions and changes
If this policy changes materially, we will note it here and, for customers, give notice by email where we have an email address for them. We intend to keep archived versions of material legal policies so customers can identify the version that applied at the relevant time.
Last updated 2026-07-22.