Privacy Policy
Effective: 2026-10-14
This is the privacy policy for wiki.wikantik.com, the public Wikantik wiki. I run it: Jacob Fear, jakefear@gmail.com
. Wikantik is the wiki software; this policy covers this site and the contact form on the www.wikantik.com marketing site. If you run your own copy of Wikantik, this policy says nothing about your copy.
The short version
- I do not sell your data. The wiki shows no ads and loads no analytics or advertising code.
- You can read most of the wiki without an account. Even then, your IP address and browser details pass through Cloudflare and are written to server logs.
- An account holds the basics: login name, email address, display name and, for password accounts, a hashed password.
- Edits and comments are public, along with the name they were made under. Page history is kept.
- You can delete your own account. Your past contributions stay in the page history.
What the wiki collects
Visiting. Every request reaches the wiki through Cloudflare, which sees your IP address and request headers. The wiki server then keeps ordinary logs: your IP address (as Cloudflare reports it), the time, the address you asked for, the response status and size, the country Cloudflare reports for the connection, and your browser's user-agent string. Application log lines written while handling your request can carry the same details plus a random request ID.
Searching. When you submit a search, the wiki saves the query text, whether it looks like a person or an automated agent, which search feature was used, how many results came back, and the time. It does not store your login name, IP address or cookie with the query. I read these to see what people look for and what the wiki is missing. The as-you-type suggestions in the quick-search box are not saved; only searches you submit are.
An account. The wiki stores your login name, email address, display (full) name, a wiki name, when the account was created and last changed, and when you last signed in. You can add a short bio (up to 1,000 characters), which only you and administrators can see. A password account stores a bcrypt hash of the password, never the password itself. An account created through Google sign-in has no password. If you create an API key, the wiki stores only a hash of the key, plus its label and the dates it was created and last used.
What you write. Page edits, comments and file attachments are stored under your account, and everyone else sees them under your display name: page history, comments and mentions show the name you chose, never your login name. Most pages are public, so anyone can read them and their history. Comments and attachments are visible to whoever can see the page. Comments, and edits made since 2026-10-14, follow your display name if you change it; older history entries keep the name they were made under. If a page's access rule names you, that line is shown only to people who can edit the page.
Your login name is private. Other people see your display name, never your login name. If you sign in with Google, your login name is your Google email address, and it is not shown in page history, comments, mentions, search results, feeds, the public data exports or the @mention box. Only you (on your preferences page) and the site administrator can see it. Signed-in users can look up other accounts by display name through the @mention box in comments; that lookup returns each person's display name and an anonymous account number, nothing else, and is not available to visitors who are not signed in. Display names are public and unique, so choose one you are happy to see next to your edits. Anything you type into a page yourself, such as an email address in the body, is shown as written; in a page's author or verified-by field, an account's login is shown as its display name and any other email address as "unknown contributor".
An audit log. The wiki keeps an append-only record of security-relevant events: sign-ins and sign-outs (successful and failed), access denied, page saves, deletes and renames, group and profile changes, and API key events. Each entry records who did it, what happened, the IP address and the browser's user-agent. Page reads are not recorded unless a page is specifically flagged for it. Entries are not edited or removed when an account is deleted.
Cookies and browser storage
| Name | Set when | What it does | Lifetime |
|---|---|---|---|
JSESSIONID | You load a wiki page or sign in | Keeps your session, including being signed in | Until you close the browser; the server drops an idle session after 60 minutes. Secure, HttpOnly, SameSite=Lax |
WikantikUID | You sign in with a password (not with Google) | The "stay signed in" cookie: a random ID, with the server remembering which login name it belongs to, so you are signed back in after a server restart or a session timeout | 14 days, or until you sign out. Secure, HttpOnly, SameSite=Lax |
This site has the "stay signed in" feature turned on, so WikantikUID is set every time you sign in with a password.
There are no analytics, advertising or cross-site tracking cookies. The site also keeps a few things in your browser's own storage, which is not sent to the server: your theme and editor settings, which panels are open, your recent searches and recently viewed pages, unsaved editor drafts, and whether Google sign-in is offered. Your browser's settings let you clear all of it.
Who else gets your data
Cloudflare. The wiki runs on a server I operate myself, and public traffic reaches it through a Cloudflare tunnel. Cloudflare therefore processes every request, including your IP address and headers. Its practices are in Cloudflare's privacy policy.
Google Fonts. The page design uses fonts that your browser downloads from Google (fonts.googleapis.com and fonts.gstatic.com) after the page has loaded. Google receives your IP address, your browser details and the address of the page you are on. If you block those requests, the wiki still works, with your browser's fallback fonts. See Google's privacy policy.
Google sign-in (only if you choose it). The wiki asks Google for your basic profile and email address. It reads three things from the answer: your Google account's unique ID (to recognise you next time), your email address and your name. It creates your account from them: login name and email are your email address. Your display name starts as your Google name; if another account already uses that name a number is added, and if Google gives no usable name the wiki uses a neutral one such as "Member 3". You can change it at any time on your preferences page. The wiki never uses your email address as a display name. It does not read your contacts, mail, calendar or files, and I use the information only to sign you in and run your account. Google learns that you signed in to this wiki. If you never choose Google sign-in, nothing is sent to Google except the fonts above.
Email. The only email the wiki can send is a password-reset message to the address on the account. The production wiki currently has no outgoing mail service configured, so it sends no email at all. If I turn that on, mail will go through an outside mail provider and I will name it here.
Search engines and crawlers. Public pages are meant to be found. I publish a sitemap and can tell search engines about new or changed public page addresses through the IndexNow service (addresses only, nothing personal). Search engines and other crawlers can copy anything that is public, including page history with the names on edits, and I cannot recall those copies.
AI models. The wiki uses AI models to build its search index and to pull a topic graph out of page text. Those models run on computers I own. Page text is not sent to an outside AI service.
Backups. Backups contain a copy of the whole database and all pages, so they hold everything described on this page. Copies are kept on the wiki server, on a separate storage device at my home, and in a folder on that device that syncs to my personal Google Drive.
Other websites. Pages can link to, and embed images from, other websites. When a page embeds an image, your browser fetches it from that site directly. Their privacy practices are theirs.
The www.wikantik.com contact form. The form asks for your name, email address and what you would use Wikantik for. Submitting it sends those to a Google Apps Script that adds a row to a Google Sheet in my Google account. I use it only to reply to you.
How long things are kept
- Logs: weeks, not years. The central log store deletes entries after 30 days, the security log keeps at most 90 daily files, and the web server's own access log lives inside the application container and goes away when a new release replaces that container.
- Audit log: up to seven years.
- Search queries: no automatic deletion.
- Account details: until you delete the account.
- Page history, comments and attachments: kept indefinitely.
- Backups: daily copies for 30 days, weekly for 12 weeks and monthly for 12 months on the wiki server. The home storage device keeps them longer, up to about a year. Deleted data therefore remains in older backups until they age out.
Your choices
- Change your details. Sign in and open your preferences to change your display name, email address, bio or password. Login name and wiki name are fixed once the account exists.
- Delete your account. The Danger Zone at the bottom of the same page deletes it after you type your login name to confirm. That removes your profile (login name, email, names, bio and password hash) and your group memberships, revokes your API keys and signs you out. If you later sign in with Google again, a new account is created.
- What deletion does not remove. Your past edits and comments stay in the wiki. Once the account is gone they are shown under the name stored with them, which for a recent edit is your login name, or as "unknown contributor" when that was an email address. Audit log entries stay. Backups keep the old data until they age out, and anything search engines or others have already copied stays copied.
- Ask me. Write to me for a copy of what your account holds, to correct something, or to ask about removing your name from old contributions. I will look at each request and tell you what can be done.
Security
The site is served over HTTPS only. Passwords and API keys are stored only as hashes. The server accepts no inbound connections from the internet; traffic arrives through the Cloudflare tunnel. No system is perfectly secure, and I cannot promise otherwise.
Children
This site is not directed at children under 13, and I do not knowingly collect their information. If you think a child has an account, write to me and I will remove it.
Changes
When I change this policy I will update the effective date at the top, and the page history is public. 2026-10-13: rewritten from a generic template to describe what the wiki actually does. 2026-10-14: other people now see your display name instead of your login name, and display names are unique.
Contact
Jacob Fear, jakefear@gmail.com.
Cluster Hub: Wikantik Platform Development Hub: Architecture, MCP Protocols, and Agent Briefings (wikantik-development)