Last updated: at the 2.4 release.

wander is two things, and only one of them involves us at all.

• The app. A program on your Mac or iPhone that edits files in your own folders. No account, and nothing you write is uploaded unless you turn on wander cloud. Crash and performance reports, and anonymous counts of how the app is used, reach us unless you turn them off in Settings. If this is all you use, the parts of this page about the cloud do not apply to you.
• wander.md and wander cloud. The hosted half: you sign in and turn the cloud on for a vault, and that vault's contents travel to our servers. It is off until you switch it on, per vault.

The same split runs through the terms. What follows is exactly what stays, what leaves, and what we can read.

The short version

• A folder you open is a folder on your disk. The app edits the files and uploads none of them.
• None of your notes leave your device until you sign in and turn wander cloud on, and then only for the vaults you turn it on for.
• There is no end-to-end encryption. What you sync is stored so that our servers can read it, because the web editor, published pages, search and the history views are built on that.
• You can turn it off, and you can delete everything.

What stays on your device

Plain folders and single files, always. A vault with wander cloud off, always. That covers your notes, the version history in the hidden .wander folder, your comments, your tags and your local search index. Crash and performance reports, never your notes or file names, go to the developer unless you turn them off in Settings.

What the app counts

From 2.4 the app sends anonymous usage counts, so we can see what helps and decide what to build next. They say that something happened, never what you wrote:

• that the app was opened for the first time, and that a first note was written in a vault, with how long it took
• that the Wander Cloud Pro sheet was shown, and each step of a purchase from it
• that Wander Cloud was asked to sync a folder, that it connected, or why it did not (no network, the free trial already used, or a server error), with which part of the app led there; never the folder's name
• one line a day saying the app is still in use
• once per version: the screen size, light or dark, and the accessibility settings that change how the app draws
• on iPhone and iPad, once: the answer Apple's AdServices gives about whether an Apple Ads ad brought the install (the campaign, ad group and keyword numbers and the country, or not an ad)

Each count carries the app's version, the system's version and a random install id that belongs to no account and to nothing else. Never a note, a title, a file or folder name, a word you typed, your email or your name. Settings, Share Usage Data turns it off; off sends nothing more and forgets the install id. The counts go to jarkeeper, the analytics service we also build, which keeps them in a Postgres database in Ireland.

What leaves your device when the cloud is on

You sign in with Apple, once, for the app. Then you choose wander cloud per vault. For a vault you turned it on for, these travel to our servers:

• the files in it: notes, images, PDFs, attachments, everything in the folder
• its history: every version, the change that made it, and which device wrote it
• comments and ink
• the small state files in .wander that make a vault a vault: block ids, tags, favorites, folder styles
• a name for the device, so history reads "Anton's MacBook Pro" and not a random id. You choose it, and it starts as the computer's name
• your email address and the handle you claim
• once, at your first sign-in: which part of the app led you there (one word, such as "announcement card" or "settings") and, on iPhone and iPad, the answer Apple's AdServices gives the app about whether an Apple Search Ads ad brought the install: the campaign, ad group and keyword numbers and the country, or "organic". The app asks the system for that answer; there is no tracking permission and no advertising network involved. It is stored with your account and used only to see which ads and which parts of the app bring people who find wander useful
• a record of each sync: how long it took, how many objects moved, whether it worked. Counts and durations only, never a file name, never a path, never a line of your text

A vault with the cloud off sends none of it.

What we can read

Everything in that list. There is no end-to-end encryption today and we will not imply otherwise: the server reads your notes so it can render them, search them, show a diff, serve a page you published and answer an agent you authorized. If that is not the trade you want, leave the cloud off for that vault or for all of them. The app is complete without it.

We do not read your notes for anything else. No advertising, no model training, no selling, nobody here browsing your vault. Access is limited to what keeping the service running needs, and to support, and support means you asked us.

Modes where the server holds only ciphertext are designed and not built. This page changes when they ship.

What other people can read

A vault is private. Private means a request for it answers "not found" to everyone but you, and search engines are told to stay out.

Making a file, a folder or a vault public is publishing: anyone with the address can read those bytes and search engines can index them. It takes your click, per vault or per path, and you can take it back.

Where it is stored

Cloudflare, in Europe: files and history in R2, the index and your account in a Postgres database in Ireland. Email to you goes through tinysend, which we also build.

How long we keep it

• While the cloud is on for a vault we keep its full history. That is the point of it: the device folds and prunes old fine-grained edits after a month, the cloud is the long memory.
• Turn the cloud off for a vault and the server copy is scheduled for deletion. It goes about 30 days later. Turn it back on inside that window and it comes straight back.
• Sync records are kept 30 days, then deleted.
• Delete your account and all of it goes: tokens, devices, vaults, history, and the handle. Your vaults are turned off the moment you ask, so anything you published stops resolving right then, and your email, name and picture are erased in the same act. The rest is held for 30 days so a mistake is recoverable, then it is gone for good, and the username is held with it so nobody can take it in the meantime. Delete from your account page on wander.md, or in the app under Settings, Cloud. Recovering it inside those 30 days means asking us at wander@tinysend.com.

The website

wander.md serves the marketing pages, the manual, your account, and any pages you publish. There is no analytics script on it, no tracker, no cross-site cookie. Cloudflare records requests the way any web host does, ip address, browser, page, and we use that to keep the site up. Signing in sets a session cookie, and that is the only cookie we set. If you email us we use your message and address to answer it.

Other companies

• Apple: the App Store, purchases, and Sign in with Apple, under Apple's own privacy policy. We receive a name and an email address, which may be Apple's relay address. If you subscribe to Wander Cloud Pro, Apple tells us the state of that subscription (plan, price, currency, storefront country, start, renewal and end dates) and we keep it with your account, because it decides what your account can do. We never see your payment details.
• Cloudflare: hosting and storage, as above.
• tinysend: the email we send you.

No advertising networks. We do not sell or share your data.

Agents

An agent you authorize gets a token under your account and reads and writes through the same doors your own devices use. It sees what your account sees, so give one a token only when you mean it.

Children

wander is not directed at children under 13 and we do not knowingly collect their data.

Your rights

Export every vault as a zip from your account page, or one vault from its own settings page, any time and without asking. Ask us for a correction, or for anything the export does not cover, and we do it.

Changes

We date this page when it changes. A change that widens what leaves your device is said in the changelog too, not only here.

Contact

wander@tinysend.com