Wigwam

Wigwam lets you control your terminal sessions from any device. This policy describes what information we collect, what we do with it, and what we don't do. The short version: your terminal content is end-to-end encrypted and our servers can't read it.

1. Who we are

Wigwam is operated by Vennify. Questions, deletion requests, or anything else: [email protected].

2. What we collect

Account information

Email address (from your chosen sign-in provider, or the one you sign up with)
Your name, username, and profile picture link, if your sign-in provider shares them
A unique account identifier from GitHub, Google, or Apple — or a hashed password if you sign in with email
User settings, templates, macros, keybindings, and saved layouts you create. These are stored on our servers without end-to-end encryption; a macro stores the keystrokes it sends.
If you connect GitHub to import repositories: your GitHub username, profile picture link, and the access token GitHub issues, which we use to reach GitHub on your behalf. Disconnecting GitHub deletes the token.
Messages you send us through the in-app chat

Device information

Device label, platform, and app version (e.g. "iPhone", "MacBook")
Device ID (a two-word identifier derived from the device's public key)
Push notification token (used to deliver alerts)
Your device's public encryption key (so notifications and your account's encryption keys can be encrypted to it)
When a device asks to join your account: its IP address and approximate location (city and country, as reported by Cloudflare), which your other devices show you so you can decide whether to approve it

Service metadata

To route connections and show your sessions across your devices, our servers store or handle some information that is not end-to-end encrypted:

The names of your machines running Wigwam ("huts"), which default to the computer's hostname, with their platform, Wigwam version, feature settings, and the AI agent tools detected on them — and, when direct local-network connections are enabled, their local network addresses.
Names and layouts of your tabs and views, the paths of files open in code panes, and, for artifacts that agents publish, the title, project name and folder, git branch and commit, and agent name.
Notification titles and text, which pass through our relay on their way to your web and desktop apps (see "Push notification content" below). They are held in memory and not written to our database.
For AI model servers you share between your machines (wigwam services): the service name, type, status, and list of model names, held in memory while the service is shared. The requests and responses themselves are end-to-end encrypted.
For synced projects and canvases: identifiers, sizes, revision and operation counts, and timestamps. Their contents are end-to-end encrypted.
Notes your agents save about a machine through Wigwam's agent tools, and the status of remote unlock (Smoke Signal) runs, including the prompts your machine reports.

Usage data

Product events (e.g. "session started", "button clicked", "started Claude Code in a pane") used to understand which features and AI tools people use, together with the app that sent them (web, desktop, mobile, or hut), its version, and the operating system. Events never include terminal content, prompts, file names, or command text. They are aggregated into daily metrics and the raw records are deleted after 30 days.
Connection metrics (bytes transferred, connect/disconnect timestamps, disconnect reason) for reliability monitoring.
Error and crash reports (component, error message, stack trace, app version, platform) when something breaks, linked to your account so we can follow up.
Server access logs: the IP address and request details (such as the address requested and your browser's user agent) of requests to our servers. Sign-in tokens and cookies are removed from these logs.
Download counts for Wigwam release files (the file, its size, the country, and the user agent — not your IP address or account).

Cookies and local storage

wigwam_token, wigwam_refresh, and wigwam_expires — secure cookies that keep you signed in. wigwam_refresh is http-only; the other two can be read by the web app.
Temporary cookies used only during OAuth sign-in and cleared afterwards.
Browser storage: your preferences (such as theme and layout), identifiers for this device, your encryption keys, and a local copy of content you open (such as synced project files and canvas recordings) so it loads quickly. Your encryption keys leave your device only in encrypted form — sealed to another of your devices when you approve it, or wrapped so your devices can recover access to synced projects — and we cannot open them.

3. What we do NOT collect

Terminal content. Keystrokes, output, pane titles, file contents, and images you paste into a pane are end-to-end encrypted as they flow between your devices. Our relay routes the encrypted bytes and rejects unencrypted terminal content at the protocol layer. We have no way to decrypt what you type or see. The metadata listed under "Service metadata" above is the exception.
Push notification content. Notifications sent to your phone are encrypted by your hut separately for each phone and decrypted on the phone. The push services (Firebase Cloud Messaging and Apple Push Notification service) see only "Wigwam — New activity", an opaque blob, and identifiers used to group and route the notification. Our relay does receive the notification's title and text in readable form so it can show them in your open web and desktop apps; it does not store them. Two kinds of notification are not encrypted: a request to approve a new device (which shows that device's label, platform, app version, IP address, and approximate location) and a notice that content you hid from a synced project is about to be permanently deleted.
Your code and canvases. When you sync a project between your machines, its file contents, file paths, and project name are end-to-end encrypted before they leave your machine. We store the encrypted data so your other machines can fetch it, and we cannot read it. Canvases, their edit history, and narration transcripts are stored the same way, encrypted with your account's key.
Microphone audio. Wigwam uses the microphone only when you start it:
- In the web app's canvas, the Record button records audio in your browser and sends it, end-to-end encrypted, to one of your own huts. That hut transcribes it with the transcription backend you configured in ~/.wigwam/transcription.json: either a speech-to-text server you run yourself, or an OpenAI-compatible cloud transcription service you chose. If you chose a cloud service, your audio is sent to that provider under your own API key and is governed by that provider's terms. Our relay passes the encrypted audio through and cannot hear it. The recording stays in your browser; the resulting transcript is stored with the canvas, encrypted as described above.
- Voice dictation in the mobile app runs on your phone, using a speech model on the device. The audio does not leave your phone.
- Dictating into a terminal pane in the web or desktop app uses your operating system's own dictation feature, under your operating system provider's terms. Wigwam receives only the resulting text, which is end-to-end encrypted like anything else you type.
Camera data. The camera is used only locally to scan pairing QR codes. Images from it are not transmitted or stored.

4. How your data is used

To operate the service (sign you in, route encrypted messages between your devices, deliver notifications you've opted into)
To keep your account secure (rate-limiting abusive traffic, showing your devices where a new device is joining from)
To debug and improve the product (aggregate usage, error reports)
To respond when you contact support

We do not sell your data. We do not share it with advertisers. We do not use it to train AI models.

5. Who processes your data on our behalf

We use a small number of infrastructure providers. They process data only to deliver the service:

Hetzner — hosting for our relay servers, database, and sign-in service (we run the open-source Supabase database and authentication software on these servers ourselves)
Cloudflare — website hosting, DDoS protection, the network connection in front of our relay servers, and storage for encrypted synced project data and server logs
Resend — sending account email (sign-up confirmation, password reset, welcome email)
Firebase Cloud Messaging (Google) — Android and iOS push delivery
Apple Push Notification Service — iOS push delivery (reached through Firebase Cloud Messaging)
GitHub, Google, Apple — sign-in providers you choose

If you configure a cloud transcription service, your hut sends audio to it directly, under your own account with that provider. That service is chosen by you and is not our processor.

6. Retention

Account data and settings: kept until you delete your account
Raw usage events and connection metrics: 30 days
Per-account daily usage summaries: 90 days
Aggregated daily metrics: retained indefinitely for long-term trends (no personally identifying data)
Error logs: 30 days
Session cookies: expire and are refreshed automatically

7. Your rights

You can:

Request a copy of the data associated with your account
Correct inaccurate information
Delete your account and its associated data

Email [email protected] and we'll handle it within 30 days. You can also delete your account yourself on the Delete account page. Deleting your account does not remove error reports, which are deleted on their normal 30-day schedule, or server access logs.

8. Children

Wigwam is not directed at children under 13, and we do not knowingly collect information from them.

9. Changes

If we change this policy materially, we'll update the date at the top and notify signed-in users by email. Continued use after a change constitutes acceptance.

Privacy Policy