How your inputs are used
Birth details are sent over an encrypted connection to a Cloudflare Worker to calculate the chart. Casting and card-draw endpoints do not need your question. During a guest trial, Wenbu does not keep these inputs or results in its application database. After signing in with cloud history enabled, saved journal entries and Agent conversations are stored in a separate private Cloudflare D1 account database. Their contents are excluded from traffic analytics, R2 event archives and page URLs. Feedback excerpts are saved only when you choose to share them.
AI readings on the tool pages send the chart, question and selected context to the model provider’s API after you select the consent checkbox. Sending an Agent message shares up to 16 recent messages, 6 recent charts, 2 report versions and the birth details, notes and journal entries you explicitly select. The model provider processes them under its own privacy policy; Wenbu cannot promise zero retention on the provider’s behalf.
Conversations, local journal and exports
Guest journal entries and chats stay in this browser. Email sign-in with cloud history enabled syncs new conversations and journal entries you save. Older records are imported only when selected. Browser caches and pending changes are bound to one account. Accounts initially include 10 MiB of content storage, with a 256 KiB limit per journal entry or chat message. Limits prompt an export instead of silently removing older records.
With cloud history enabled, the Agent saves your message before generation and saves checkpoints as the response arrives. Guest and paused-history conversations stay in this browser. You can delete a conversation, export it as JSON or download reports as Markdown. Deselecting context does not remove the information from earlier messages or charts. Start a new conversation for an empty context. Closing the page interrupts the task; results that were saved successfully return after a reload. A storage failure prompts you to export a backup.
Pausing cloud history keeps new changes in this browser. Resuming does not upload those changes automatically; editing a record again will sync that record. Before signing out, you can export or discard browser-only changes.
Research searches Wenbu’s library and curated catalogue. External reading requests only listed public page URLs, without adding your question or birth details. Source websites may still process server request metadata.
You can delete individual journal entries and export JSON backups. Deletion leaves a content-free marker to prevent stale uploads from restoring it. The interface’s restore action creates a new copy. On a tool page, “Export for an agent” offers a preview and excludes original birth details unless you select them. A full conversation export includes the saved messages, context and results. Even without a birth date, a chart or question may contain personal information.
Optional usage statistics
Our first-party endpoint records page paths, source categories, registered campaigns, language, country-level region, device/browser categories, feature events, outcomes and durations in Cloudflare D1. It excludes birth details, questions, chat, chart contents, notes, raw IPs, full referrer URLs and URL query parameters.
Public page, Markdown/JSON guide and discovery-file GET/HEAD requests also record a known path category, response status, method, duration, client category and classification evidence, without browser visitor or session identifiers. Search crawling, AI search, training crawls and user-triggered fetches are classified separately. User agents can be spoofed; Cloudflare verification and scores are recorded only when supplied by the edge. Full user agents, URL queries and raw IPs are not stored.
A random browser identifier expires after 30 days; a session resets after 30 minutes of inactivity. These estimate browser visits, not individual people. Events also carry timestamps and random page, operation and Agent-turn IDs so we can understand usage journeys. Recent detail stays in D1 for 90 days; private R2 archives currently have no automatic expiry. Reports, individual events and archives require administrator credentials. Pending events can stay on your device for up to seven days, with a 1,000-event limit.
When measurement is enabled, the account database keeps content-free completion and save receipts. A separate random browser installation identifier helps measure continuing in another browser instance; it is keyed per account and is not joined to anonymous traffic identifiers or email addresses in traffic reports. Operation receipts and guest conversion cohorts are retained for 90 days; account installation records last until account deletion. Actions during an opt-out are not backfilled after re-enabling measurement. Account totals remain an operational count; activation and return metrics include only measurable accounts.
Disable measurement on this page at any time. A preference-only cookie also disables measurement of subsequent page requests. We also honor Do Not Track and Global Privacy Control. Disabling stops future analytics without affecting tools or conversations; previously received events remain subject to the archive policy above. Necessary quota and rate-limit controls continue. API, CLI and MCP record coarse feature, status, duration, country and device categories without browser identifiers by default. Send X-Wenbu-Analytics: off to disable; the CLI also accepts WENBU_ANALYTICS=off.
Page interaction analysis
We use Microsoft Clarity heatmaps and session replay to understand clicks, scrolling and page interactions, and identify usability problems. Clarity runs without analytics or advertising cookie storage permission. Microsoft still processes network request information, including IP addresses, page URLs and device information, under its own privacy and retention policies. Clarity data is not stored in our D1 database or R2 archive.
The main content of tool, Agent and journal pages is explicitly masked, including conversations, birth details, charts, results and notes. The entire account panel is masked, and opening it pauses Clarity. Clarity also masks input fields by default. We do not share our visitor identifiers through its custom identity API. Clarity does not load on the admin dashboard, history migration pages, local previews or sessions marked as tests.
The measurement switch on this page also controls Clarity. Do Not Track and Global Privacy Control prevent it from loading. Disabling measurement during a visit stops further interaction recording; it does not withdraw data already sent. Clarity’s cookie-less visitor and session counts cannot be added to Wenbu’s own counts.
Free allowances and infrastructure
Cloudflare processes request IPs for abuse controls. Network limits use daily keyed hashes. Guest trials use a signed HttpOnly cookie valid for seven days; signing in carries the current day’s usage into the account. Replay and claim guards expire after eight days. Mailbox rate limits use keyed hashes. Account counts are not a count of real people, and shared networks retain an additional abuse-control ceiling.
Authentication stores your email, verification status and necessary session data, excluding raw IPs and full user agents. Cloudflare Email Service sends the code. Codes are encrypted in the database and expire after five minutes; sessions use HttpOnly, Secure, SameSite cookies and last up to 30 days. Account content is kept in private application storage, not traffic logs. The application does not read external chats, files or location. Cloudflare infrastructure and AI model processing remain subject to their respective policies.
Feedback and updates
Updated October 5, 2026. The feedback button privately stores your rating, note, optional email and receipt ID. Excerpts are off by default; you can review and edit one before choosing to share it. Feedback still works with analytics disabled, without analytics identifiers. Feedback currently has no automatic expiry and is used for issue resolution and product improvement. To request deletion, send a new note with the original receipt ID. Shared excerpts and email addresses are excluded from event archives. Keep private information and credentials out of public GitHub issues. Account controls let you export cloud records, revoke other sessions and delete your account after a fresh email verification. Deletion blocks access and removes online data. Cloudflare recovery snapshots may retain older data for up to 30 days; an independent, content-free deletion ledger lasts 45 days. Recovery procedures must replay that ledger and revoke old sessions before reopening access. This is not a claim of immediate physical backup erasure. Unsynced and temporary browser copies can be exported or cleared locally.