Privacy
In short
Your roster lives in your own browser, on your own device. No account, no analytics, no advertising and no third-party scripts. The one exception is sharing. If you create or join a shared roster, that roster is stored on this server so the other person can edit it, and you can delete the room at any time.
What is stored, and where
- Shift types: names, hours, colours and icons
- Days: the shift on each date, a note of up to 140 characters, and a sticker
- Settings: language, week start, year style, theme, accent and appearance
- Theme photo, only if you choose one: scaled down to 1280 px and kept on the device
All of it lives in your browser's localStorage under the key wenta.v1. Only this site can read it, and only on this device. Clearing the site's data deletes all of it.
What leaves the device
By default, nothing. The app works with the network off, and a roster you have not shared is never sent anywhere.
If you create a shared roster, the parts two people need to agree on (shift types, the shift on each day, and any note or sticker) are stored on this server, in a database keyed by a 6-character room code. Who can get in:
- Anyone with the invite link, of the form
/app/#join=CODE&t=TOKEN. The token is about 32 random characters (24 random bytes), made when the room is created. The server keeps only its SHA-256 hash. - There is no password and no PIN to type. The link is the key, like a file set to "anyone with the link can edit": anyone you give it to can read and edit the roster.
- The code and token sit in the part of the URL after
#, which browsers do not send to the server. They are removed from the address bar once the link has been used. - Rooms made before links carried tokens still open with their original 4–6 digit PIN, stored as a slow PBKDF2 hash with a random salt.
Not sent, even when sharing: your language, theme, accent, appearance and week-start preferences stay on your device. There is no account, no email address and no profile. A room has a code, not an owner.
A shared roster stays on this server for as long as the room exists. Menu→Settings→Delete room removes it for both people. Stop sharing disconnects only your device and leaves the room for the other person.
Server logs
The server has access logging switched off and writes no request logs to disk. To stop anyone trying tokens in bulk, every attempt to join a room is counted in memory by IP address, whether it succeeds or not. Only the last 5 minutes count. After 8 attempts in that window, the server turns away further attempts from that address until the older ones drop out. These counts are the only thing kept about a visitor, and they are never written to disk.
Cookies and tracking
No cookies. No analytics, no tracking pixels, no fingerprinting, and no third-party fonts or scripts. The page uses the fonts your device already has. The language you pick on these pages is remembered in your browser's localStorage, on your device only.
Deleting your data
On the device, Menu→Settings→Delete everything clears every shift, note and setting straight away. To keep a copy first, use Export a backup. Your browser writes the file, and it is never uploaded.
On the server, if you are in a shared roster, Delete room removes it for everyone. Stop sharing does not delete the room, because the other person may still be using it.
Children
Wenta is not directed at children under 13, and it collects no personal data from anyone.
Changes
If this policy changes, the date at the top changes with it. Anything that sends roster data off the device stays opt-in, and is described here before it ships.