Privacy Policy
Last updated: May 1, 2026
Watcher is local-first. The shortest accurate summary of this policy is that by default nothing leaves your machine, and where a hosted plan does store data, it stores the minimum needed to run the service and nothing more.
Local-first by default
The Watcher daemon runs on your own hardware. Your wiki is markdown on disk and your facts are a local store you can read, grep, and back up like any other file. We do not collect, transmit, or have access to the contents of what you index. There is no telemetry that sends your documents anywhere.
Nothing is sent off your machine unless you take an explicit action that requires it, such as calling a model provider or signing up for a hosted plan.
Your model keys are never persisted
Watcher is bring-your-own-key. When the daemon calls a model provider on your behalf, your API key is injected into the process at spawn time and held only in memory for the life of that process. We never write your key to disk, never log it, and never transmit it to us. When the process exits, the key is gone.
What you send to a model provider is governed by that provider's own privacy terms. We are not a party to those requests; the daemon makes them directly from your machine using your credentials.
Hosted plans store the minimum
For hosted plans we run an always-on daemon and store the minimum:
- Account identity: your email address and authentication state.
- Billing metadata handled by our payment processor; we never see full card numbers.
- The wiki, facts, and provenance chain you choose to host with us, encrypted at rest.
- Operational logs needed to keep the service running and secure.
We do not sell your data, and we do not use the contents of your hosted wiki to train models.
Deletion and restore
You can delete your hosted data at any time. When you do, we begin removal immediately and retain a recoverable copy for seven days so an accidental deletion can be reversed. After that seven-day window the data is permanently purged from our active systems, and from backups on their normal rotation thereafter.
For self-hosted use there is nothing for us to delete, because we never had it. Removing the files removes the data.
The open-source daemon
The Watcher daemon is released under the AGPL-3.0 license. You are free to inspect exactly what it does with your data, because the source is open and the behavior is auditable.
Contact
Questions about this policy, or a request regarding your data, can be sent to hello@wotw.dev. 3030 Labs LLC is the data controller for hosted plans.