Privacy Policy

We take the protection of your personal data very seriously. This privacy policy informs you about what data we process when you visit our documentation site, for what purpose, and on which legal basis.

Controller

The entity responsible for data processing on this website within the meaning of the GDPR is:

PUSHERY
℅ HYPERLINK Solutions GmbH
Ringbahnstr. 42
12099 Berlin
Germany

Email: hello@pushery.com
Phone: +49 (0) 30 / 398 216 398

Data protection contact: Andreas Wieser (hello@pushery.com)

Overview of Data Processing

WireKit Docs (docs.wirekit.app) is a documentation website for the WireKit Livewire UI component library. The public documentation section can be browsed anonymously. Authenticated access exists only for internal team members maintaining the content — there is no public registration and no sign-up form.

Personal data is processed only to the extent technically necessary to deliver this website, to secure it against abuse, to authenticate internal team members, to measure aggregated usage in a privacy-preserving way, and to receive and answer the feedback you choose to send us.

Hosting and Server Location

This website is hosted by HYPERLINK Solutions GmbH in Germany. Data processing therefore takes place within the European Union. No personal data is routinely transferred to a third country.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in stable, secure, and performant hosting of our own service).

Access Data and Server Log Files

Every HTTP request to this website is logged by our web server in the so-called access log. The following data is processed automatically:

IP address of the requesting device
Date and time of the request
Requested URL and HTTP method
HTTP status code and response size
Referrer URL (the page that linked here, if any)
User agent (browser type, version, operating system)

This data is required to deliver the content, detect and mitigate attacks (rate limiting, brute-force detection), and diagnose technical issues. Log files are rotated on a short cycle and are not combined with other data sources to identify visitors.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in the secure operation of the website).

When you switch a code example to its Live preview, each render is also recorded, with the time, the component, whether it was rendered or refused, and a hash of your IP address. The hash is made with the same daily secret as the page feedback described below, and that secret is deleted after 72 hours; from then on nobody, ourselves included, can connect a record to an address. The records help us notice misuse of the preview and are deleted after 14 days, on the same legal basis.

Authentication and Team Accounts

WireKit Docs offers no public registration. Internal team members receive an account created by an administrator (via an artisan command) and authenticate through Laravel Fortify.

The following data is stored for each account:

Name and email address
Password (stored only as a bcrypt hash — the plain-text password is never persisted)
A role: member, staff or admin
The time of the last sign-in, and the time the account was locked, if it was
2FA secret and recovery codes (see below)

Accounts with the admin role see an overview of all accounts with this data, except the password and the 2FA secret and recovery codes, together with each account's last activity and number of open sessions, taken from the server-side session records described below.

Legal basis: Art. 6 (1) (b) GDPR (performance of the contract of employment/collaboration with the account holder).

Two-Factor Authentication (2FA)

All authenticated accounts are required to enable a time-based one-time password (TOTP) as a second authentication factor. When activating 2FA, a secret and a set of recovery codes are generated and stored in encrypted form in the database. Both are deleted immediately if 2FA is deactivated.

Legal basis: Art. 6 (1) (b) GDPR and Art. 32 GDPR (contract performance and security of processing).

Session Data and Cookies

To keep authenticated users signed in and to protect form submissions, the following technically necessary cookies are set:

Session cookie — contains only an opaque reference ID. The actual session data is stored server-side in our PostgreSQL database. Lifetime: 120 minutes of inactivity, renewed on activity.
CSRF-Token (XSRF-TOKEN) — random token used to protect POST/PUT/DELETE requests against cross-site request forgery. Lifetime: session duration.
Remember-Me cookie (remember_web_*) — optional, only set when a team member checks "Remember me" at login. Lifetime: up to 5 years.

Server-side session records contain the IP address and user agent of the signed-in request so suspicious activity (e.g. session hijacking) can be detected. Records are deleted automatically after expiry.

No analytics, advertising, or tracking cookies are set. See our dedicated Cookie Policy for a complete list.

Legal basis: Art. 6 (1) (f) GDPR and § 25 (2) no. 2 TDDDG (technically necessary cookies do not require consent).

Browser Local Storage

The site keeps a small number of entries in your browser's own storage, so that it can remember what you set up and where you have been: your color scheme and theme, the groups of the sidebar you opened, the pages you marked as favorites, the last ten pages you opened, and a few switches. Our Cookie Policy lists every entry with its purpose, the moment it is written and how long it stays.

None of these entries leaves your browser, and none is transmitted to our server. The favorites and the list of recently viewed pages are not written while your browser sends a Do-Not-Track signal, and clearing this site's data in your browser removes all of them.

Email Communication

Outgoing email is used only for authentication flows (password reset, 2FA-related messages) triggered by team members themselves. We do not operate a mailing list and do not send marketing email.

Legal basis: Art. 6 (1) (b) GDPR.

Web Analytics (Matomo)

We use the open-source analytics platform Matomo to understand in aggregate which pages are viewed and how visitors move through the docs. Our Matomo installation is configured in a particularly privacy-friendly way:

Self-hosted on our own servers in Germany (no third-party processor).
Server-side and cookieless. No Matomo JavaScript tracker runs in your browser and no cookies are set. Page views are counted by our own backend; for interactions (theme and other UI events, outbound-link clicks, file downloads, site searches) and anonymous Core Web Vitals (loading-performance) measurements, your browser sends small requests to our own server, which records them in Matomo — nothing is stored on your device.
Do-Not-Track respected. If your browser sends a Do-Not-Track (DNT: 1) or Global Privacy Control (Sec-GPC: 1) signal, nothing is tracked at all.
IP anonymization. IP addresses are truncated before storage so that no individual visitor can be re-identified.
No cross-site tracking, no fingerprinting, no device IDs.

Because the tracking is cookieless (nothing is stored on or read from your device), respects Do-Not-Track, and the data is anonymous, no consent under § 25 (1) TDDDG is required.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in statistical analysis of usage to improve the documentation).

Error Monitoring (Flare and Laravel Nightwatch)

To detect and fix software errors, we use two server-side monitoring services:

Flare (operated by Flare App BV, Antwerp, Belgium, flareapp.io) — captures uncaught PHP exceptions together with a technical stack trace.
Laravel Nightwatch (operated by Laravel Holdings, Inc.) — application performance monitoring: aggregate request timings, query timings, and exception counts.

Neither service sets browser cookies or executes any JavaScript on this website. Error reports may incidentally contain the requested URL and the IP address that triggered the error, but no personal data is transmitted deliberately. Data is automatically deleted after a short retention window.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in the stability and security of the service).

Content Delivery and External Resources

All third-party JavaScript libraries used on this website (Chart.js, highlight.js, WireKit, web-vitals) are self-hosted from our own servers under /vendor/. No Matomo tracking script is loaded in your browser — analytics is server-side. We do not embed Google Fonts, Google Analytics, YouTube, social media widgets, or any other third-party scripts that would cause your browser to contact external servers.

Cloudflare (DNS and Caching)

Our DNS zone is managed by Cloudflare, Inc. (101 Townsend St., San Francisco, CA 94107, USA) and Cloudflare also operates as a reverse-proxy cache in front of our origin server. When you load this website, the request therefore passes through Cloudflare's edge network, which processes your IP address, connection metadata, and the URL you are requesting for the purpose of DNS resolution, caching, TLS termination, and mitigation of network-level attacks.

Cloudflare may set the following security cookies on its own behalf:

__cf_bm — bot-mitigation cookie, lifetime 30 minutes.
cf_clearance — security-challenge completion marker, lifetime up to 15 minutes.

These cookies are set only when Cloudflare's security layer requires them (e.g. during a suspected automated-attack event) and are used exclusively for security, never for advertising or profiling.

Apart from Cloudflare Turnstile — described in its own section below — we use no other Cloudflare product that would process visitor data beyond DNS, caching, and WAF. In particular we do not use Cloudflare Workers.

Data may be transferred to the United States. Cloudflare is certified under the EU-US Data Privacy Framework; the transfer is additionally secured by the EU Commission's Standard Contractual Clauses.

Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in the availability and security of the website). Further information: Cloudflare Privacy Policy.

Spam Protection (Cloudflare Turnstile)

The thumbs-up / thumbs-down buttons at the foot of each documentation page and the Send feedback form are protected against automated abuse by Cloudflare Turnstile (Cloudflare, Inc., USA).

Turnstile loads only when you actually vote or open the Send feedback form — never when you merely read a page. If you do neither, your browser never contacts Cloudflare for this purpose at all.

When it does load, the following is transmitted to Cloudflare: your IP address, a challenge token, and technical browser characteristics needed to distinguish a person from a script. Turnstile is designed to work without behavioral profiling and sets no cookie of its own; Cloudflare's security cookies described in the previous section may apply as they do to any request.

Legal basis: Art. 6 (1) (f) GDPR — legitimate interest in protecting publicly reachable feedback functions from automated abuse. Further information: Cloudflare Privacy Policy.

Page Feedback

At the foot of each documentation page you can tell us whether the page helped. Pressing one of the two buttons stores:

the page you voted on,
your answer (helpful / not helpful),
the time of the vote,
a pseudonymous token from a cookie in your browser (feedback_voter, see the cookie policy),
a hashed form of your IP address.

After voting you may add a comment of up to 1,000 characters. It is stored with your vote, shown to us in our internal feedback overview, and deleted together with the vote.

Your IP address itself is never stored. It is hashed together with a secret that changes every day, and that secret is deleted after 72 hours — together with the hashes it produced. After that window nobody, ourselves included, can connect a stored vote to an IP address or link votes from different days to one another.

The cookie token exists so that a second click on the same page is not counted twice and so the page can show you that you already voted. It identifies a browser, not a person, and we do not combine it with any other data we hold.

Legal basis: Art. 6 (1) (f) GDPR — legitimate interest in learning which documentation is useful, and in protecting that function from automated abuse.

Data Transfers to Third Parties

Personal data is not sold, not rented, and not shared for advertising purposes. Data is transferred to third parties only:

to service providers we rely on for infrastructure (Cloudflare, USA — see above),
where we are legally obliged to do so (e.g. in response to a court order), or
where you have given us explicit, separate consent.

All processors are bound by a data processing agreement pursuant to Art. 28 GDPR.

Storage Duration

Team accounts: for the duration of the collaboration; deleted on request.
Session records: 120 minutes of inactivity, then automatically deleted.
Remember-me tokens: up to 5 years from last use.
Password-reset tokens: 60 minutes.
Server log files: short rotation (days to a few weeks).
Live-preview records: 14 days; the hashed IP address in them can no longer be connected to an address after 72 hours.
Matomo statistics: stored aggregated; IPs are anonymized on write.
Error reports (Flare / Nightwatch): provider-default retention, typically 30–90 days.
Page-feedback votes and any comment attached to one: page, answer, timestamp and comment for 24 months; the hashed IP address for 72 hours, after which it is deleted along with the daily secret that produced it.
Visual feedback reports: sent to us by email and not stored in a database. Any screenshot or file you attach is written to the server only while the message is being sent, and is deleted as soon as it has been. A daily job removes anything left behind by a failed send, at the latest 24 hours after it was uploaded. The hashed IP address that limits how many reports one address can send is kept in our cache for one hour.

Visual Feedback ("Send feedback")

Every documentation page carries a Send feedback button. Using it is entirely voluntary; nothing is collected unless you open the form and submit it.

If you do, we receive: your message, the page you were on, whether you were signed in, the version of the component library the page was built with, and — only if you choose to attach one — a screenshot of the page as it looked to you, plus any files you add yourself. The screenshot is taken in your browser, shown to you before anything is sent, and you can black out any part of it or discard it entirely.

With the report your browser also sends technical details that help us reproduce what you saw: the address and title of the page, your browser and operating system as your browser reports them (user agent and platform), the size of your window and screen, the pixel ratio, how far you had scrolled, your language settings and time zone, and whether your device has a touch screen, was online, accepts cookies and had dark mode switched on. They are sent only with a report you submit, and we do not use them to recognize you or combine them with any other data.

Name and email address are optional. If you give an email address it is used as the reply address so we can answer you, and for nothing else.

The report is delivered to us by email. It is not written to a database, and there is no report archive on this site. The attachments exist on the server only for the moment it takes to send the message.

Your IP address is not part of the report. When you send one without being signed in, it is used only to limit how many reports one address can send per hour, and for that it is kept, as a hash, in our cache for that hour. Before the form accepts such a report, it asks you to confirm that you have read this privacy policy, and it runs the Cloudflare Turnstile check described under Spam Protection.

Please do not include personal data about other people, credentials, or anything confidential in a screenshot or a message. What you send is what we receive.

Legal basis: Art. 6 (1) (f) GDPR — legitimate interest in receiving, reproducing and answering reports about the documentation.

Data Security

We implement state-of-the-art technical and organizational measures to protect personal data against loss, alteration, and unauthorized access. In particular:

End-to-end TLS encryption (HTTPS-only, HSTS enabled).
Passwords are stored exclusively as bcrypt hashes (plain-text passwords are never persisted).
Mandatory two-factor authentication for all team accounts.
CSRF protection on every state-changing request.
Regular security updates for the operating system, PHP runtime, and all application dependencies.
Strict access controls and audit logging on the hosting infrastructure.

Your Rights

Under the GDPR you have, among others, the following rights regarding the personal data we process about you:

Right of access (Art. 15 GDPR) — to obtain a copy of the data we hold about you.
Right to rectification (Art. 16 GDPR) — to have inaccurate data corrected.
Right to erasure (Art. 17 GDPR) — to have your data deleted.
Right to restriction of processing (Art. 18 GDPR).
Right to data portability (Art. 20 GDPR).
Right to object (Art. 21 GDPR) to any processing we base on Art. 6 (1) (f) GDPR (legitimate interest) on grounds relating to your particular situation.

To exercise any of these rights, please contact us at hello@pushery.com.

Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU Member State of your habitual residence, place of work, or place of the alleged infringement, if you believe that the processing of your personal data violates the GDPR.

For our headquarters in Berlin, the competent authority is:

Berliner Beauftragte für Datenschutz und Informationsfreiheit
Alt-Moabit 59–61, 10555 Berlin, Germany
www.datenschutz-berlin.de

Changes to This Privacy Policy

We reserve the right to update this privacy policy to reflect changes in our practices or for other operational, legal, or regulatory reasons. The current version is always available on this page.