Privacy · last updated 5 November 2026
What we keep, what we never keep.
Wherebase is a memory of where things are. It is built to hold as little about you as that needs. This page says exactly what is stored, where, for how long, and how to delete it. It is written to be read, not skimmed; it is short on purpose.
Who is responsible
Wherebase is an independent project run by Zygmunt Dyras, who is the data controller for the purposes of the GDPR. Contact: hello@wherebase.io. If and when the project becomes a company, this page will name it.
If you only visit
- No advertising, no tracking cookies, no fingerprinting. Page views are counted by Cloudflare Web Analytics, which uses no cookies and does not follow you to other sites; we see how many people read a page, not who.
- If you leave your email on the waitlist, we store it with the time, your country and the page you came from, send you one welcome email, and write again only when there is news: a few emails a year. Reply “remove” to any of them and the record is deleted.
- The site runs on Cloudflare, which sees your IP address to deliver the page and protect it, as any host does. Cloudflare Turnstile runs when you submit a form, to tell people from bots; it may set a cookie for that purpose.
- Fonts load from Google Fonts, which sees your IP address when it serves them. The one thing on the site we would rather not need; it may be replaced by self-hosted fonts.
The live demo
- Starting the demo creates an anonymous memory space with a random name. It holds the objects you place, the sightings your camera reports, and nothing that identifies you.
- The microphone is open only while you hold the button. The clip is sent to our cloud, transcribed, answered, and not kept.
- The camera in the demo runs entirely in your browser. No frame leaves your device; only labels and positions are sent.
- Demo spaces are deleted after seven days, or immediately with the Delete my data button.
If you create an account
- We store your email address, a sign-in cookie on your device (named
wb_s, valid 30 days), your API key, the tokens issued to assistants you connect through OAuth, and a daily count of calls and photos for the free-tier limits.
- Your memory space holds the rows you or your devices write: a label, a place, a time, a confidence, and the room you named. It is yours. It is not used for anything but answering you.
- Phone capture runs the on-device detector in your browser, and nothing but labels and positions leaves the phone, unless you choose a cloud fidelity level: then a reduced photo (512 to 800 pixels wide) is sent to a vision model to be named. We do not store that photo. See Who else processes data below.
- Delete account and data on the account page removes every row, the key and the tokens, at once. The same happens if you email us.
- We do not sell, share or use your rows or email for anything else. We will email you only for sign-in links, for account matters, or if you asked to hear about the pendant.
Who else processes data
- Cloudflare hosts the site, the storage and the memory service, sends our email, and runs Turnstile. When no Anthropic key is configured, or as a fallback, cloud photos are processed by a model on Cloudflare Workers AI.
- Anthropic processes cloud photos and spoken-answer text when Claude is the configured model, under Anthropic's API terms. We send the photo and the room name, not your email.
- No other third party receives your data.
Your rights
You can ask for a copy of what we hold, correct it, or have it deleted, at any time: use the account page, or write to hello@wherebase.io from the address you signed up with. You can complain to your data protection authority; in Poland that is the UODO.
Changes
If this page changes in a way that matters, the date above changes and account holders are told by email.