Privacy Policy

Effective date: August 2026
Last updated: October 2026

Wrengler is an environmental-analysis tool for architecture and urban design. This policy explains what data the application collects, how it is used, who receives it, how long it is kept, and your rights. The page at wrengler.dev/privacy shows this same text.

What Wrengler does

Wrengler runs ray-based studies (sunlight hours, view/visibility, solar radiation) on your own machine. The computation is local, and your geometry (the meshes and surfaces of your model) is never uploaded. Some things about your model do leave your machine, when you ask for them:

• Saving a study to a project uploads its settings and its summary results (the lowest, mean and highest value per group).
• Asking the assistant about the open Rhino scene sends a summary of it: the file name, the linked project's name, the units, the site's name and coordinates, the areas of what you selected, the names of its groups and layers, and the ids of the objects a program works on.
• Attaching a view to image generation sends that capture of your Rhino view.

The web panel loads over the network. What each of these sends, and to whom, is described below.

Account data

You need an account to use Wrengler, including to run a study. When you create one (with email and password, or with GitHub), Supabase stores:

• Email address — required. Used to sign you in and manage your account. It is also shown, with your display name, to the other members of an organization you belong to, and sent to Polar when you check out.
• Display name — optional, shown in your account settings and to fellow organization members.
• Password — stored as a bcrypt hash by Supabase; we never see or log it.

If you sign in with GitHub, GitHub gives us your name, email address, avatar and GitHub user id.

Account data is hosted on Supabase (Frankfurt, EU).

Who can see your data inside Wrengler

• Your projects are visible to everyone with a role in them. A project in a shared workspace is visible to that workspace's members.
• Conversations, their running summaries and goal logs are visible to everyone with a role in the project.
• Assistant run logs and answer ratings are visible to their author and the project's leads.
• Your email and display name are visible to the other members of your organizations.

Telemetry

What is collected

Wrengler records pseudonymous usage events:

Before you sign in, and inside Rhino, app_open and app_loaded events are anonymous. After you sign in, events carry your user ID — derived server-side from a verified token for plug-in events; browser and platform events use the signed-in session, and the database only lets a session attribute an event to its own account. Workflow events are not sent while signed out. No event contains your content, results, locations or project identifiers, and none is used to train a model. Every row also records whether it came from a production, preview or development build.

Operational records. The website keeps short operational records (app_events, 180 days) for payments, sign-ups, rate limits and refused AI requests: a request id, your user id where the record is about your account, and closed reasons and counts. Their extra fields are limited to a fixed list of short values, so free text or an email address cannot be stored in them. Vercel Analytics page views see the page's path with any id replaced by [id], and no query string.

On your machine only. The plug-in keeps a rotating log, wrengler.log, in the Wrengler folder of your OS's app data (about 4 MB at most). It may contain error messages and file paths, and it is never sent anywhere.

What telemetry never collects

• Your 3D model, geometry, or analysis results
• File paths or document names
• IP addresses. A salted hash of the address counts requests from one network for rate limiting; it is kept as that counter and deleted 7 days after its last use.
• Email addresses
• Browser or device fingerprints

Retention

Raw telemetry rows are deleted after 90 days. They are stored in the EU (Supabase, Frankfurt). Events the platform records itself (dashboard_opened, workflow_step, feature_use) pass through its server code on Vercel first (see "Who receives your data").

Opt-out

Set the environment variable WRENGLER_TELEMETRY to off (or 0, false, no) to stop the plug-in's telemetry. This also stops the plug-in's crash reports. It does not stop the events the Rhino panel, the web panel or the platform record; there is no switch for those yet.

Error reporting (Sentry)

• The Rhino plug-in reports errors only if you switch it on, by setting the WRENGLER_SENTRY_DSN environment variable. It then sends the exception type name (e.g. System.NullReferenceException), up to 20 method names from the stack, and the Rhino, OS and plug-in versions. It never sends exception messages, file paths, line numbers, or your geometry.
• The website (its pages, its server and its edge functions) and the Rhino panel report errors to Sentry whenever reporting is configured, without asking. A report carries the error and its stack (from the Rhino panel, the error's type without its message), the page or request it happened on without its query string, and recent clicks, page changes and requests, never console output. Errors on our server carry a pseudonym of your user id, not the id. Before a report leaves, a scrubber removes account, project and organization ids, email addresses, the place you searched for, sign-in tokens and credentials (sendDefaultPii is off). One page load in ten is also timed, to see what is slow.

Cookies and browser storage

The website and the panel keep these in your browser. None is used for advertising.

The map in the Rhino panel is Mapbox's: its code keeps Mapbox's own anonymous usage id (listed above) and sends Mapbox usage events. Vercel Web Analytics and Sentry run as scripts on the pages they measure (see "Who receives your data").

The website and the panel report errors through one seam each, so Sentry receives what it always did: the error, where it happened (an error page, a component, a bridge handler, an unhandled rejection) and a short operator string such as an event name. Never a payload, a scene, or what you typed.

Traces (operator-configured, off by default). When the operator sets OTEL_EXPORTER_OTLP_ENDPOINT, the website's server also sends OpenTelemetry spans to the operator's own collector: the route, its status and duration, the build and the environment. The collector removes anything that could identify you before a span is stored (ADR-0100). Unset, no span leaves the server except to Sentry.

Local data on your machine

The plug-in keeps these files in %LOCALAPPDATA%\Wrengler\ (Windows) or ~/.local/share/Wrengler/ (macOS), the session files in its session folder:

The session is encrypted (AES-256 with an integrity check) and its folder is readable only by your user. Signing out deletes the session files. device.id stays, so that signing in again on this machine counts as the same device. To remove everything, delete the Wrengler folder above after uninstalling the plug-in.

Billing (Polar)

Wrengler's subscriptions are sold by Polar, as merchant of record: Polar takes the payment and handles tax, and its own privacy policy applies to the payment and billing details it collects. We send Polar your email address and user id when you check out, and Polar tells us the state of your subscription. We never see or store your card number.

Project assistant

When you use the project assistant, your message and the project context needed to answer it (the project's facts and tags, relevant passages from its documents, the open Rhino scene summary, recent conversation and saved notes) are sent through the Vercel AI Gateway to a model provider, which may process them outside the EU (mainly the United States). A small evaluation model first classifies each request to choose the model that answers it. The assistant proposes; nothing is written to your project until you confirm it. An AI model writes the answers; it can be wrong.

When you set a goal, agents read the same kinds of project context on your behalf, only from the project the goal is set in and only what you can see there: its facts and tags, its saved studies' summary results, passages from its documents, its conversations and its notes. What they read is sent through the same gateway, with the same routing, to write the answer. A goal never changes your project. Its log (what it read, which model answered, token counts and cost) and its answer are stored in the EU with the project, visible to everyone with a role in the project, and deleted with the project.

When an organization's admins switch on housekeeping rules, they run on a schedule over the organization's files. To suggest how a file should be classified, the platform sends the file's record (its name, type and where it is filed) and an excerpt of its text through the same gateway to TypeSafe AI (Jev). These requests are attributed to the organization, not to a person. The fixes applied, with the file and who applied them, are kept for 365 days. A shared organization left with no members and no projects is deleted.

Every assistant request, including any fallback, is routed only to providers that do not train on it: the gateway's no-training filter is set on every call, and a request that no such provider can serve fails instead of going elsewhere. Retention is each provider's own:

We do not have a contract with the model providers directly; they are engaged through the Vercel AI Gateway under Vercel's agreements with them. Our contract with Vercel includes its Data Processing Addendum, which covers the personal data Vercel processes for us, including transfers outside the EU under the EU Standard Contractual Clauses, and flows its obligations down to its sub-processors. Zero data retention (providers that keep nothing once a request completes) is not switched on: each provider keeps requests as the table says.

Conversations and assistant run logs (timings, token counts, model names, and — only if enabled for development — message text) are stored in the EU (Supabase Frankfurt). Conversations and their summaries are visible to everyone with a role in the project; run logs to their author and the project's leads. When a conversation grows beyond what one answer can read, its older messages are condensed into a short running summary, stored with the conversation. Run logs are deleted after 30 days; conversations and their summaries are deleted with the project. Deleting a conversation hides it from the project's members at once. The person who started it and the project's leads can restore it for 30 days; then it is deleted for good, with its messages, summary, card decisions, ratings and run logs (a conversation whose messages count toward this month's assistant usage is deleted when the month ends). Messages you wrote in a colleague's project stay with that project after you delete your account, no longer attributed to you. Production run logs contain metadata only, even if full tracing was requested in configuration. An optional operator-configured HTTPS OpenTelemetry collector receives the same minimized trace metadata; its location depends on the configured collector. No collector receives prompt or answer content from production tracing.

If you rate an answer (thumbs up or down, and optionally a reason picked from a short list), it is stored with that answer in the same place, visible to you and your project's leads, and used to find and fix answers that went wrong. You can take a rating back by pressing it again. Ratings are included in your account export and are deleted with the answer, the project or your account.

Image generation

When you generate an image (Pro), the platform sends the description you typed, the wording of the genre, style and choices you picked, and the reference image if you attached one (which can be a capture of your Rhino view) through the Vercel AI Gateway to an image model provider, which may process them outside the EU (mainly the United States). Every request is routed only to providers that do not train on it.

Nothing else is sent. No study results, no project documents, no project facts and no file, layer or group names reach an image model.

A storyboard also sends the plan you approved (its subjects, places and frames) and the images you chose as its anchors: Rhino view captures, uploads, and earlier frames of the same storyboard. To plan it, your brief goes to the assistant's model; to rank a frame's candidates, the candidates, their anchors and the plan's questions go to it too, on the same no-training routing.

Wrengler does not store the images, your description or your reference image unless you save an image to a project: then the image, with the "AI-generated" label burned in, and a note of how it was made (the prompt the model received, the genre, the model and the caveats) are stored with the project's files in the EU, like a file you upload, and deleted with the project. A metadata record of each attempt (when, which genre and model, how many images of your allowance it used, whether it succeeded and what it cost) is kept in the EU (Supabase Frankfurt) to count your monthly allowance; it is included in your account export, deleted after 13 months, and deleted with your account. Images you download are saved by your browser, with the label burned into them.

Pilot requests

When you ask about a pilot at wrengler.dev/pilot, we store:

• What you send — your name, work email and organization, and, if you give them, your role, the studies you are interested in and your message.
• The notice version — which version of the short notice under the form you saw.
• Where it came from — the wrengler.dev page you sent it from and the one that linked there (paths only, never the query), and campaign tags (utm_source, utm_medium, utm_campaign) if the link you followed carried them.

Your IP address is not stored with it: a salted hash of it counts requests from one network for rate limiting, as for sign-in.

Why, and the legal basis. Only to reply to your request and arrange a pilot: steps you ask us to take before a possible contract (GDPR Art. 6(1)(b)). No newsletter or marketing, and we do not share or sell it. Your name, email and organization are needed to reply; the rest is optional.

Where, and who can read it. Wrengler's database in the EU (Supabase, Frankfurt). No one can read it through the website or with a Wrengler account; only the people who run Wrengler read it, in the database dashboard. Supabase and Vercel process it for us as hosting providers.

How long. Deleted 12 months after your request (a daily job does it) unless a pilot follows; then it is kept with that pilot's records for as long as the pilot and any contract after it need.

Your rights. You can ask to see, correct or delete your request, or to restrict its use, by replying to our email or through the contact below (please keep personal details out of a public issue). You can also complain to a data protection supervisory authority.

People we hear about from others

• Invited colleagues. When an organization's admin invites you, they give us your email address. We store it with the invitation, the role you are invited to and who invited you. No account is created and you join nothing: the admin sends you a link, and you decide. If you have an account, you accept or decline from that link or from Invitations in your account; if you do not, you can ask for one from the link, and Supabase then emails you to set it up. Once you accept, the organization's members see your name and email. The invitation is deleted when you accept or decline it, when it is withdrawn, or 30 days after it was last sent.
• GitHub sign-in. See "Account data" for what GitHub gives us.

Who receives your data

These services process data for Wrengler, or receive it when you use the feature they provide:

Where a service processes data outside the EU, the transfer rests on its own terms. Vercel's Data Processing Addendum uses the EU Standard Contractual Clauses, and the model providers are engaged under Vercel's agreements (see "Project assistant").

How long we keep it

Error reports in Sentry, server logs at Vercel and backups at Supabase expire on those services' own schedules.

Your rights

You have the right to access your data and get a copy, to have it corrected, to have it deleted, to restrict how we use it, and to take it with you (portability). Where we rely on our legitimate interests, you have the right to object.

You can object at any time to processing based on our legitimate interests, on grounds relating to your situation.

To use any of these rights, use the self-service options below or the contact at the end. You can also complain to the Danish Data Protection Agency (Datatilsynet, datatilsynet.dk), or to the data protection authority where you live or work.

Export your data

Request an export of your account data from your account settings. The export is a JSON file. It contains:

• your account (email, display name, plan);
• the projects you own: their files' details (not the files themselves), tags, Rhino documents, geometry groups, saved studies with their results, the conversations you took part in (your messages, the answers to them with their proposals and program results, and what you decided on each proposal), the run records of your turns, and your ratings;
• the organizations and workspaces you belong to, and your roles;
• the knowledge you proposed, and the knowledge-desk items you created;
• the goals you set, each with its whole log;
• your image generations, your AI usage records, your workflow events and your other usage events (within their retention periods);
• the devices registered to your account, and the notes you keep or wrote;
• your presets, usage totals and your subscription's status.

It does not contain the files themselves (download each from its project), error reports and logs held by the services above, or the billing records Polar keeps.

Delete your account

Delete your account from Settings → Delete Account. This is irreversible. It:

• deletes your Supabase account and your profile;
• deletes the projects in your personal organization, and in any organization where you are the only member, with their files and conversations;
• hands the projects you own in an organization with other members to that organization's next owner or admin, with their files and conversations; the messages and studies you contributed there stay, no longer attributed to you;
• revokes your Polar subscriptions (not refunded);
• removes your name from your telemetry and deletes your workflow activity events.

Some things are kept: a record that the account was deleted, with its Polar customer id and a salted hash of its email address (to match billing and refund events, for 5 years); an entry in our error log with the deleted account's id, deleted after 180 days; the billing records Polar keeps as merchant of record; and error reports, logs and backups held by the services above until they expire.

Manage devices

View and remove devices from Settings → Devices. Free accounts are limited to 1 device; Pro accounts to 2.

Children's privacy

Wrengler is not directed at children under 16. We do not knowingly collect data from children.

Changes to this policy

We will update this page when our data practices change. The "Last updated" date at the top will reflect the latest revision.

Contact

For privacy questions, open an issue at https://github.com/aashkann/wrengler/issues or contact the project maintainer directly.

Provider-call accounting metadata

The platform records paid AI invocations separately from product telemetry: model, feature, step, status, duration, reported token counts and cost (or an explicitly marked estimate/unknown), provider generation ID and available account, organization, project and trace references. These records contain no prompts, answers, geometry, document text or free-form errors. They support operational cost reconciliation and are not training data. You can export your own records; organization owners/admins can read records attributed to their organization. Records expire after 13 months through the retention job and cascade when their owning account, organization or project is deleted. The database migration and retention job must be deployed for this policy to operate. No customer contribution or model training consent is inferred from product use.

AI admission metadata

When shared AI admission is enabled, the platform keeps actor-attributed call leases with the feature, reserved/accounted amount, state and server timestamps. They contain no prompts, responses, tools or document data. You can export your own leases; organization owners/admins can read their organization's leases. User, project or organization deletion removes their lease rows. A separate daily budget aggregate carries no actor references and is not refunded by account deletion. Leases and aggregates expire after 13 months through the retention job. These records are operational controls and do not supply training content or contribution consent.