Privacy#
Two things collect data in this product's orbit: the router, and this website. Both are short.
This website#
It loads nothing from anywhere else. No analytics, no tag manager, no hosted font, no
embedded video, no social widget, no session recording, no advertising pixel — nothing.
The Content-Security-Policy it is served with is default-src 'none' with 'self' for
scripts, styles, images and fonts, which is only possible because there is nothing
third-party to allow. The day someone pastes in a CDN tag, the page breaks loudly rather
than quietly phoning home.
There is no cookie banner because there are no cookies. The one thing kept in your browser is a light-or-dark preference in local storage, written only if you press the theme toggle, read only by this site, and sent nowhere.
The web server keeps ordinary access logs, the way every web server does.
The font is Inter, served from this origin under the SIL Open Font License. Search on the documentation site is a JSON index fetched from this origin and searched in your browser; no query leaves the page.
The router#
One request a day, four fields, to one host. That is the whole of it.
There is no telemetry, no analytics, no crash reporting, no usage metrics and no update check. Nothing counts your rules, your interfaces, your clients or your traffic and sends the number anywhere.
What the licence refresh sends#
| Field | Value |
|---|---|
key | your current licence token — the WHL1.… string |
fingerprint | 16 hexadecimal characters: the first 8 bytes of a SHA-256 over the machine id and a fixed string. It lets the server count how many routers are using one licence, which is what the plan's router limit means. It is one-way; the server never learns the machine id |
hostname | the router's host name, as you typed it at install |
version | the agent's version string |
That is the complete body. Nothing else is added, and there is no separate telemetry request.
The connection reveals what any HTTPS request reveals — your router's public address and the time of the request — and the licence server sees those the way any web server does.
When it happens#
Once about 20 seconds after the agent starts, then once every 24 hours, hourly after a failure until one succeeds, and immediately after you paste a new key so the page can show you the answer.
The address it posts to is shown on the Licence page in the interface, under Licence server, so the router tells you where it is talking rather than you having to believe this page.
What happens if it never runs#
Nothing breaks. A key is a signed statement the agent verifies offline against a public key compiled into its binary. A router that has never reached the licence server and never will still knows what it holds, and keeps working until its token expires plus a grace period.
Refresh exists so a renewal extends your token without you touching the router, and so a revoked licence stops working within a day.
Turning it off#
One flag: --license-server ''. With an empty server, the refresh function returns
immediately and no request is ever made. The Licence page then shows refresh disabled
so you can tell at a glance.
Understand the trade. With refresh off, the token you hold is the token you keep: it will expire on its own date, the grace period will run out, and the write plane will close. A renewal will not reach the router by itself. That is the correct arrangement for an air-gapped or egress-filtered site and the wrong one for a router you would rather not think about.
What is stored on the router about you#
In the agent's state file, mode 0600, on the persistent partition: your accounts and their Argon2id hashes and TOTP secrets; email addresses and display names, but only for accounts created through single sign-on and only what your own identity provider asserted; live sessions with their source address and user-agent; API token labels and hashes; the audit log; and your licence key.
None of it leaves the router. There is no mechanism in the agent to export the audit log anywhere — which is a gap for anyone who wants it in a SIEM, and a privacy property in the meantime.
Other things the router talks to, because you told it to#
None of these is Wheelhouse phoning home. Each is something you configured: your identity provider on every single-sign-on log-in, a container registry when you install or update an app, DNS and NTP as the router's own configuration names them, and whatever host a URL you paste points at.
And the internet at large, whenever you route a packet. It is a router.
Data held elsewhere#
Whatever a licence purchase would create — an account, an email address, a subscription — would live on the licence server and with the payment processor rather than on the router. Nothing is for sale yet, so nothing exists.
Checking this yourself#
The payload is built in one file in the agent, the fingerprint in one function beside it, and the schedule in one more. If you have the source, read it. If you do not, watch it from the router — the request is one POST a day and it is the only unprompted one there is.