Privacy policy

What WorldSignals collects about visitors and early-access members, why, and what you can ask us to do with it. Last updated 23 October 2026.

Who we are

WorldSignals is operated by Yumankind OÜ, a private limited company registered in Estonia (registry code 16232402, VAT number EE102378229), Sepapaja 6, 15551 Tallinn, Estonia. Yumankind OÜ is the controller of the personal data described here. Write to hello@worldsignals.dev about anything on this page.

When you give us your email, we keep:

your email address, its domain, whether it looks like a work address, and when you confirmed it;
the event types, countries, delivery and plan you choose, and what you type in the optional fields (use case, company, role, “something else”);
details of the visit: approximate location (country, region and city, from the network), the network provider, the Cloudflare data centre that answered and the connection protocol, your device, operating system and browser (and the user-agent string your browser sends), languages, time zone, screen size, the page you came from and any campaign tags in the link, and how long you spent on the page.

Once your access key works, we also keep when it was first used and how many requests it makes each day: counts only, never which events you read.

If you connect an app such as an AI assistant to your account, we keep which app it is (the name and return address it gave us) and its access tokens as one-way hashes, until they expire, you disconnect the app on your Account page, or you delete your sign-up.

If you register a webhook, we keep its address, its filters, the secret we sign its requests with, and its delivery record: how many events it got, when, and the status code and our own short description of the last failure. We never keep what your server answers. A webhook is kept until you delete it or your sign-up.

We never store your IP address, only a one-way hash of it with a secret, so we can spot repeated sign-ups without knowing the address.

We email you a link to confirm the address is yours, and later the links you ask for: to sign in, to save changed choices, or to create a new access key. Each link works once: for 24 hours, a new-key link for one hour, and the link in the email that says you’re in for seven days. We keep a hash of it, never the link itself. The collected events open once your email is confirmed and you are let in: work emails at once, personal addresses after our daily approval. We send at most three links an hour and eight a day to one address, and one network can ask for at most twenty a day. Emails are sent through Cloudflare Email Service.

When you use the stream builder without signing up

If you change your choices in Build a stream and leave without saving, the page sends those choices, with the same visit details and no email, when you leave. We use them to see which sources people want. The builder says so above its save button.

Cookies and tracking

We use two cookies, both strictly necessary and neither used for tracking. ws_access, set when you confirm your email or sign in with an emailed link, signs this browser in so you can see collected events, and lasts a year. ws_next, set for one day when you ask for a sign-in link from an app’s connect page, takes this browser back to that page once you sign in. We use no advertising trackers. To count visits, Cloudflare, which hosts the site, adds its Web Analytics script to our pages. It sets no cookies, keeps nothing in your browser and doesn’t follow you across sites: it records the page, the site you came from, your country, the type of device and browser, and how fast the page loaded. The pages you reach from our emailed links block it. Between the two sign-up steps, your email is kept in your browser’s session storage for that tab only, so you don’t type it twice; it is gone when you close the tab.

Why we use it

To email you about early access and your sources (your consent, which you can withdraw at any time).
To decide which sources and countries to build first (our legitimate interest in building what people need; anonymous where you haven’t signed up).
To stop abuse and repeated automated sign-ups (legitimate interest).
To see whether WorldSignals is useful to the people who signed up, and to plan capacity, from those usage counts (legitimate interest).

We don’t sell your data or share it with anyone for marketing.

Where it is kept

The site and its database run on Cloudflare, which processes data for us under its data processing terms. Data may be processed outside your country, under the safeguards those terms provide.

How long we keep it

Sign-ups are kept until you delete them, with the link at the foot of every email we send, or ask us to. An email address that is never confirmed is deleted after 30 days, and so is a sign-up request an AI agent made for you, whether or not you answered it. Emailed links are deleted 30 days after they were sent. Anonymous builder choices are deleted after 24 months. These deletions run on their own, every hour.

Your rights

Every email we send ends with a link to stop our emails, at once, or to delete your sign-up and its data: for that we first email you a link to confirm, so a forwarded email can’t delete your account. Deleting also stops your access key. Stopping emails means no news from us: we send only the links you ask for. You can disconnect apps on your Account page. You can also ask for a copy of your data, to correct it, to delete it, or to stop us using it, by writing to hello@worldsignals.dev. You can also complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), our lead authority, or to the data protection authority where you live.

When an AI agent signs you up

An agent working for you can ask to sign you or your company up, through our API or command line tool. We keep its request (your email, the choices it made, its name, and details of its connection) for 30 days and send nothing to you: the agent gets a link to pass on, which works for seven days. Nothing becomes a sign-up until you open that link and confirm, and the collected events open only after you also confirm your email from the link we send you and are let in: work emails at once, personal addresses after our daily approval. If you decline, we delete your email and the choices from the request and keep only the fact that a request was declined. One network address can make at most ten requests a day.

Data sources and people in events

Public events come from official registers and journals, used under their reuse licences, with the licence and attribution on every event. Events describe companies and public bodies; we leave people’s names out where the source allows it, and mark any event that identifies a person with personal_data. To ask about an event that mentions you, write to hello@worldsignals.dev with its id.