Privacy Policy

wrktree is a public-profile builder for engineers and designers. We collect the minimum amount of data we need to run the Service, we never sell your data, and we give you tools to export or delete it.

This policy applies to wrktr.ee, your dashboard, your public profile pages, and the embed widget.

Account information. When you sign in with Google, we receive your name, email address, and profile picture. These are used to create and identify your account.

Profile content. Anything you add to your profile — display name, role, bio, project descriptions, links, uploaded images — is stored so we can display your public profile.

Integration data. If you connect GitHub or Dribbble, we store the OAuth tokens (encrypted at rest) and cache the public items you choose to display, so we don't hammer the third-party API on every page load.

Billing information. If you subscribe to Pro, Stripe processes your payment and stores your card details. We receive a Stripe customer ID and subscription status — we never see or store your card number.

Profile analytics. When someone views a public profile, we record an event with: the referrer domain (no full URL), an approximate country derived from the IP address (the IP itself is not stored), and a device-type hint. We don't use third-party trackers and we don't set analytics cookies.

We use the information we collect to:

• provide, maintain, and improve the Service;
• display your public profile and embeds;
• process payments and manage your subscription;
• send transactional emails (sign-in confirmations, billing receipts) and, if you opt in, the weekly digest;
• respond to support requests;
• detect, prevent, and respond to abuse, fraud, and security incidents;
• comply with legal obligations.

We do not sell your personal data. We share information only in the following circumstances:

• Service providers. Stripe (payments), Resend (transactional email), our cloud and database hosts, and the MinIO/S3-compatible storage we use for images. Each is bound by their own privacy commitments and processes data only on our instructions.
• Public profile content. Anything you publish on your public profile is, by design, visible to the public.
• Legal requirements. If we receive a valid legal request, we may disclose information to comply.
• Business transfers. If wrktree is acquired or reorganized, your data may transfer as part of that deal — we will notify you in advance.

We use only the cookies we need to keep you signed in and to remember your language preference. We don't set advertising or cross-site tracking cookies.

For profile analytics, events are stored server-side and tied to the profile being viewed — not to the visitor. Raw events are automatically deleted after 90 days; only aggregated daily counts are kept beyond that.

We keep your account data while your account is active. When you delete your account, we delete your profile, projects, links, uploaded images, integration tokens, and analytics events promptly. Some records (such as invoices) may be kept where required by tax or accounting law, in which case they are retained only as long as that law requires.

Depending on where you live (for example, under the GDPR, UK GDPR, or Swiss FADP), you may have the right to:

• access the personal data we hold about you;
• correct inaccurate data;
• delete your data;
• export a copy of your data;
• object to or restrict certain processing;
• lodge a complaint with your local data-protection authority.

The fastest way to exercise most of these rights is directly in your dashboard — you can edit, export, or delete your data without contacting us. For anything else, email info@raigeki.dev.

wrktree is operated from Switzerland. Some of our service providers process data in the European Economic Area, the United Kingdom, and the United States. Where data is transferred across borders, we rely on appropriate safeguards such as the EU Standard Contractual Clauses or equivalent mechanisms.

We protect data with industry-standard practices, including encryption in transit (TLS), encryption of sensitive fields at rest, hashed authentication tokens, scoped database access, and rate limiting. No system is perfectly secure — if you suspect a vulnerability, please report it to info@raigeki.dev.

wrktree is not directed to children under 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us and we will delete it.

We may update this Privacy Policy as the Service evolves. If we make material changes, we will notify you by email and post the updated policy with a new “Last updated” date.

Questions about this policy or how we handle your data? Email info@raigeki.dev.