Privacy Policy

Last updated: September 11, 2026

1. Information We Collect

WakeLink stores the following data to provide its service:

Account data

  • Username (unique identifier for your account)
  • Email address (used for account recovery and notifications)
  • Hashed password (Argon2id — the plaintext is never stored)
  • API token hash (SHA-256 — the raw token is never stored after issuance)
  • TOTP secret for two-factor authentication (encrypted at rest)
  • Login timestamps and lifetime login / failed-login counters

Device data

  • Device names and MAC addresses you register
  • Last known IP address of each device (updated on activity)
  • Lifetime wake-command and error counters per device
  • Timestamp of the last wake command sent to each device

Billing data (Pro plan only)

  • Stripe customer ID and subscription ID (no card numbers stored by us)
  • Subscription status (active / cancelled / past_due)

Integration data (optional, if enabled)

  • Telegram user ID (if you link Telegram for password reset)
  • ntfy push-notification topic (if you enable push notifications)

Session data

  • Web session tokens stored in PostgreSQL — expire automatically after the configured session TTL
  • Active WebSocket/relay sessions stored in Redis — ephemeral, not persisted to disk

2. How We Use Your Information

Your data is used exclusively to:

  • Authenticate and authorize your requests
  • Route Wake-on-LAN packets to your registered devices
  • Enforce per-plan device limits and feature access
  • Send push/Telegram notifications you have explicitly configured
  • Provide customer support
  • Detect and prevent abuse (rate limiting, login-failure tracking)

3. Data Storage and Security

All traffic between clients and the relay is encrypted with ChaCha20-Poly1305 (EWSP protocol) and TLS. Passwords are hashed with Argon2id and never stored in plaintext. TOTP secrets are encrypted at rest. API tokens are stored only as SHA-256 hashes — we cannot recover a token once issued.

Persistent data resides in a PostgreSQL database. We do not sell, rent, or share your personal information with third parties. Stripe handles all payment processing — WakeLink never receives or stores card details.

4. Data Retention

All account, device, and billing data is retained until you delete your account. Deleting your account permanently removes all associated records from our database. Web session tokens expire automatically; relay sessions in Redis are ephemeral and disappear when the connection closes.

We do not maintain a rolling log of individual wake commands or connection events. Usage is tracked as aggregate lifetime counters and the timestamp of the most recent event per device.

5. Your Rights

You may request access to, correction of, or deletion of your personal data at any time by:

  • Deleting your account in the dashboard settings page, or
  • Contacting us at [email protected]

6. Cookies

WakeLink uses only first-party cookies, and only the two needed to run:

  • wl_session — an HttpOnly session cookie set by the relay after you sign in. It keeps you logged in and is required for the dashboard to work; it is not readable by JavaScript and expires after the configured session TTL.
  • wakelink_theme — stores your theme preference (light / dark and the accent palette).

No tracking cookies, analytics scripts, or third-party cookies are used.

7. Changes to This Policy

We may update this policy from time to time. Significant changes will be communicated via email or a notice on the website. Continued use of the service constitutes acceptance of the updated policy.

8. Contact

Privacy-related requests: [email protected]