What we collect,
and where it lives.
wrxstack is an independent company built by a small team. This page summarizes what data we hold, the one place it lives, how it is encrypted, who else can see it, and what happens when you delete your account. It does not describe controls we do not have. It is a summary of current practice, not a contract; the privacy policy and the Terms of Service have the detail.
The data we actually hold.
The main categories are the account and content you create when you use Atlas or Folio (our portfolio and personal-site builder), and the analytics the site records. The privacy policy has the full list. We do not sell personal data.
| Category | What it is | Why we have it |
|---|---|---|
| Account | Email address, and a password or a sign-in through Google, GitHub, or your organization's single sign-on, for Atlas or Folio | To create your account and let you sign back in |
| Customer content | Whatever you save into the product | It is the point of the product; we store it so you can use it |
| Contact messages | Whatever you type into the contact form | So we can answer you by email |
| Site analytics | Page views, coarse device and country data | To see which pages are read; not used to identify you by name |
We do not ask for and do not want regulated data. Do not put protected health information, payment card numbers, or government identity documents into wrxstack. There is no HIPAA mode, no PCI scope, and no BAA. See the Trust Center for why.
One place.Not six regions.
The application runs on managed hosting from Render. There is one region. There is no region menu, no per-region key hierarchy, and no cross-region replica, because none of that has been built.
Who else touches it.
A short summary of the main third parties involved in running wrxstack. The sub-processors page is the current list, and it controls if this summary differs from it.
| Vendor | Purpose | What it receives |
|---|---|---|
| Render | Application and site hosting | All application data, at rest and in transit |
| PostHog | Product analytics on the marketing site | Page views, coarse device and country data |
| Google Tag Manager | Analytics tag loading | Page load events |
| FormSubmit | Contact form delivery | Whatever you type into the contact form |
| Model provider | AI features only | The content you send to an AI feature, at the moment you use it |
When you delete, we remove it.
When you delete your account, we take reasonable steps to remove your content from the live database, subject to the exceptions in the retention policy. Provider backups roll off on their own cycle after that. We do not issue deletion certificates.
| Data | What happens on account deletion | How long backups persist |
|---|---|---|
| Account and customer content | Removed from the live database after you delete your account, except as the retention policy describes | Until the host's backup rotation overwrites it |
| Contact messages | Held in email so we can answer; you may ask us to delete them | Standard mailbox retention |
| Site analytics | Not linked to your account by us; retained by the analytics provider as the retention policy describes | See the retention policy |
| Model prompts | Not used for training under the provider terms we use | Per the provider's API terms |
To delete your account or ask what we hold about you, email contact@wrxstack.com. We handle requests as the law requires. For the legal detail, see the data deletion policy, the CCPA statement and the Privacy policy.
What gets written down.
Ordinary operational logs and an in-app audit log. There is no tamper-proof audit stream, no SIEM streaming, and no replay of every action.
Standard request logs
Render records the ordinary request and error logs any hosted app produces. They exist so the team can find and fix a problem, and they are kept as the retention policy describes.
Coarse and aggregate
PostHog and Google Tag Manager record page views and coarse device and country data on the site, subject to your cookie choices. We do not use it to identify you by name.
Review and export
Atlas records sign-in, admin, integration, export, and token events in a workspace audit log that admins can review and export on paid plans. There is no live stream to Datadog, Splunk, or another SIEM, and no compliance archive tier.
Said plainly, up front.
Rather than let you infer these from silence, here they are in one place. None of the following exists here today.
Ask about your data.
We aim to answer plainly.
Questions about what we hold, where it sits, or how to have it deleted. Email a human. Where the answer is "we don't do that," that is what you will get.