# Data handling

## Server in our cloud

Device logs, locations, application lists and issued commands are stored on the Wyrd server. Our administrators have access to it for maintenance.

## AWS CloudFront

Phones connect to the Wyrd server in our cloud through AWS CloudFront. On top of TLS the traffic is encrypted with hybrid X25519 and ML-KEM-768 encryption, and the keys exist only on the phone and the Wyrd server. No sensitive data leaks through AWS. It receives only ciphertext – commands, locations, logs and device details are not visible to it. AWS sees the phone's IP address, the time and the volume of traffic.

## Server on your hardware

The Wyrd server keeps all data on your side and does not send it outside, including to us.

## The map

The Wyrd server loads the map from our bootstrap over an anonymity network (Tor) and discloses no identifiers of its own. Each part of the map is loaded once and then served from the server's cache.

## This site

The site and the documentation carry no counters, no ad networks and no resources from third-party addresses. Visitor addresses are not written to the logs.

## Account

An account is a random identifier and a password. You choose the name we address you by: support sees it, and it goes into the licence key. Purchases and support correspondence carry no direct link to your personal data.

## Demo

While a stand is out, the visitor's IP address is kept: one address gets one stand. When the time is up, the stand is wiped along with everything that appeared in it, including the data of connected phones.