Privacy notice

Who runs this

wikiraceai is a personal project run by Yariv Barsheshat. Contact for any privacy question, complaint, or rights request: yariv@barsheshat.com. Under Quebec Law 25 you have the right to address concerns to a person; that person is Yariv.

What we collect

If you visit without signing in:

• Your IP address (used for rate limiting, not stored long-term)
• A row in our attempts table for each race you finish, with no account link. We keep this for aggregate statistics.
• Standard request logs at our hosting providers (Vercel, Fly.io, Cloudflare if enabled).

If you sign in:

• Your email address and the authentication provider you used (email/password, Google, or Facebook), via Clerk.
• An optional public alias (3 to 20 characters) you choose for the leaderboard.
• A leaderboard opt-in flag. Off by default. You turn it on yourself.
• One row per race you finish in attempts, linked to your account.
• Daily quota usage (how many fresh AI races you ran today).

We do not collect: your real name (unless you put it in your alias), your location beyond the country-level inference your IP carries, your browsing history outside the site, or any payment information (the site is free).

Why we collect it

• To run the game: account state, race history, daily quota enforcement.
• To prevent abuse: IP rate limiting on the API; email verification to stop trivial spam sign-ups.
• To run the leaderboard: only if you opt in and set an alias.
• To improve the product: aggregate stats on how races go (hop counts, win rates).

Your information is not sold, rented, or used for advertising. Quebec Law 25 requires us to be specific about purposes, so: that's the full list.

Who else sees your data

We use a small number of third-party services to actually run the site. Each one sees only what it needs to do its job:

• Clerk (United States) handles authentication. They store your email and authentication factors. Their privacy policy.
• Supabase (European or US region depending on project setup) hosts our Postgres database with your account row, alias, attempts, and quota usage. Their privacy policy.
• Vercel (United States) hosts the web frontend you're looking at, and provides our aggregate traffic analytics (Vercel Web Analytics) — which is cookieless and does not collect personal information. Their privacy policy.
• Fly.io (United States) hosts the API backend. Their privacy policy.
• OpenAI and/or Anthropic (United States) run the AI agent. They receive the prompt the agent uses to navigate Wikipedia. They do not receive your account information.
• Wikipedia (Wikimedia Foundation, United States) serves us article content via the public MediaWiki API. They see our server's IP and User-Agent, not yours.
• Google and Facebook, if you use them to sign in, handle the OAuth flow per their own policies.

Several of these processors are located outside Canada (mostly the United States). Quebec Law 25 requires that we tell you, and that we've assessed the privacy risks of those transfers. We have.

How long we keep it

• Account data (email, alias, opt-in flag): until you delete your account, at which point your alias is cleared and your account row is soft-deleted immediately on request. (Soft-delete keeps the row but flags it inactive; future sign-ins are blocked.)
• Attempt history tied to your account: kept indefinitely while your account exists. After deletion, the rows are de-identified (no user ID, no alias) and kept for aggregate statistics.
• Anonymous attempt rows: kept indefinitely, never linked back to you.
• Server logs: rotated locally on the API host (capped at ~20 MB total — 5 MB per file, 3 backups) and additionally at our hosting providers' default retention (typically 7 to 30 days).

Your rights

Under PIPEDA and Quebec Law 25 you have the right to:

• Know what personal information we hold about you.
• Receive a copy in a portable format.
• Correct it if it's wrong.
• Withdraw consent (which means deleting your account here).
• Object to or restrict certain processing (e.g. turn off leaderboard opt-in to remove yourself from public rankings, even if your account stays).
• File a complaint with the Office of the Privacy Commissioner of Canada or, in Quebec, the Commission d'accès à l'information.

To exercise any of these, email yariv@barsheshat.com. We'll respond within 30 days.

Cookies and similar

We use the minimum cookies needed to keep you signed in (Clerk session cookies) and to remember a UI flag or two (sessionStorage on your device, never sent to us). No analytics cookies, no advertising trackers, no third-party pixels. We do measure aggregate traffic (page views, referrers, rough country) through Vercel Web Analytics, which is cookieless — it stores nothing on your device and does not track you across other sites.

Security

Passwords are handled by Clerk, never seen or stored by us. Database credentials and API keys live as encrypted secrets in our hosting providers (Fly.io and Vercel). Traffic between you and the site uses HTTPS. We're a small operation; we don't pretend to be SOC 2 compliant. If you wouldn't trust us with it, don't put it here.

Children

wikiraceai isn't directed at children under 14 (the threshold under Quebec Law 25 for parental consent). If you're under 14 and signed up anyway, ask a parent to email us and we'll delete the account.

Changes

If we materially change how we collect or use personal information, we'll bump the "Last updated" date above and surface a notice when you next sign in. The history of changes lives in this site's public git repository.