Privacy Policy

Waku is a personal identity builder. You compose a profile page and a matching identity card in your browser, and that draft stays in your browser until you choose to publish it.

• Publishing is the only path that writes anything to our servers, and it requires an account.
• We do not run advertising trackers.
• We do not sell or rent your data.
• We do not build a profile of you to sell to anyone — everything below is the detail behind those three sentences.

Account information

• Signing in happens through GitHub or Google — we receive the name, email address and profile picture your provider shares with us, plus a token that keeps you signed in.
• We never see the password you use with that provider.

Profile content

• Anything you publish — name, role, bio, tagline, skills, social links and your photo — is stored so your page can be served to anyone who opens your link.

Ratings and messages

• A rating left on the rate page stores the name, the star score, the message you choose to write, and a fingerprint of your IP address and browser.

Server logs

• Our hosting provider records routine request metadata (IP address, timestamps, user agent) as part of operating the service and protecting it from abuse.

• Your unpublished drafts. They live in your browser’s localStorage. Clear your browser storage and they are gone — we never had them.
• Analytics or advertising profiles. There is no marketing pixel, no ad SDK and no cross-site tracker here.
• Payment data. Waku has no billing system, so there is nothing of the kind to hold.

• To create and keep your account, and to keep you signed in.
• To serve your published profile page at the link you own.
• To display ratings you submit, so other visitors can see them.
• To generate AI-written bios and taglines when you ask for them.
• To reply when you write to us.
• To keep the service available and protect it from automated abuse — the only reason the rating fingerprint exists.

• Published profiles and accounts are stored in a Neon Postgres database.
• Uploaded photos are stored and delivered by Cloudinary.
• Both are reputable, purpose-built services; neither gets access to anything beyond what is needed to run the feature it runs.

• To keep one person from flooding the ratings, we hash your IP address and browser user agent into a single fingerprint and store only that hash — not the raw values.
• The fingerprint is unique to you, so it also lets you revise your own rating instead of adding a second one.
• It cannot be reversed to identify you.

• When you ask for an AI-written bio or tagline, the fields you have filled in are sent to Google’s Gemini API server-side, purely to generate that text for you.
• The draft is yours to edit or discard before it is ever published.
• Nothing about the request is stored on our side beyond ordinary server logs.

• A published profile page is public — that is the point. It is reachable by anyone who has or guesses your link, and may be indexed by search engines.
• Please publish only what you are comfortable making public.

• You can edit or delete your published profile from the editor at any time.
• For anything else — a copy of what we hold about you, or complete erasure of your account and pages — write to sainrahul374@gmail.com and we will act on it without making you justify yourself.

• Waku is not intended for children under 13.
• We do not knowingly collect their data; if you believe a child has signed up, contact us and the account will be removed.

• Secrets (database credentials, API keys, OAuth secrets) never leave the server.
• Sessions are signed cookies.
• Uploads are validated before they are accepted.
• No service is immune to compromise, but nothing here is stored more broadly than it needs to be.

• If a change is material we will say so here and update the date at the top.
• Continuing to use Waku after a change means you are comfortable with the updated policy.

• Questions, requests, or a data-deletion ask — sainrahul374@gmail.com.
• The source code behind everything described here is public at GitHub, so you can verify any of it yourself.