# Privacy

> Wake is built so that the data it holds cannot identify a person or a machine. This page says what is kept and what is never kept.

## Kept, per site

- Coarse events from your collector: timestamp, method, page class, status code, operator family (a label such as `anthropic`, `openai`, `curl`), identity tier, country code, and a **daily nickname**.
- The nickname is an HMAC computed from an opaque hint that your collector derives from the client address with **your** secret, folded again with the UTC day and your site id on our side. The same machine tomorrow is a new nickname. Nothing in Wake can be joined back to an address.
- Your email with the hostname, the SHA-256 hashes of your keys, an AES-GCM-sealed copy of the ingest key so the install kit can be reopened, the verification method and time, and your listing plan.

## Never kept

Raw IP addresses, user-agent strings (used transiently to label the operator family, then discarded), query strings, request bodies, prompts, outputs, page content, cookies, referrers, tool arguments, fingerprints, precise location.

## Retention

Per-site event files keep the newest records (compaction) and the sensor deletes rows older than 30 days. Revoking an API key takes effect immediately. Rotating the collector keys restarts nicknames.

## What the API and MCP expose

Exactly what the desk shows: the rows above, aggregated. There is no endpoint that returns anything finer than a page class and a status code, so no key can leak more than that.