Privacy policy.

The short version.

Wiley is built to be privacy-first. We don't use cookies. We don't collect personal data. We don't track visitors across sites. We don't sell data. The tracking script does the minimum necessary to coach website owners — nothing more.

What the tracking script collects.

When a visitor loads a page with the Wiley script, we record:

• The page URL and referrer
• UTM parameters if present
• Scroll depth and time on page
• Outbound link clicks
• Goal events you've tagged
• Viewport size (mobile/tablet/desktop)
• Country (derived from IP address — IP is not stored)
• A daily anonymous fingerprint (see below)

We do not collect: names, email addresses, IP addresses (beyond country derivation), device identifiers, or any other personally identifiable information.

The anonymous fingerprint.

To distinguish unique visitors without cookies or personal data, Wiley generates a daily fingerprint — a hashed combination of signals like browser type and screen size, salted with the current date. This fingerprint resets every 24 hours and cannot be reversed to identify an individual. It's used only to count unique visitors within a day.

No cookies.

The Wiley tracking script sets no cookies — first-party or third-party. This means no cookie consent banner is required for Wiley's tracking under GDPR, ePrivacy Directive, or CCPA for most use cases. You should still consult your own legal counsel about your specific situation.

Data storage.

All event data is stored in Cloudflare's infrastructure. Data is associated with a site ID, never with a visitor identity. Wiley account holders can delete their site data at any time from the dashboard.

Public crawl data.

Wiley periodically crawls the public pages of sites enrolled in the service. This crawl behaves like any standard web crawler — it only accesses pages that are publicly available and respects robots.txt. No authentication is used and no private data is accessed.

Accessibility scanning (paid plans).

On paid plans, Wiley runs an accessibility scan against your site's public pages, cycling through your known pages roughly once a month. This has two layers:

• Structural checks — automated, rule-based checks (missing alt attributes, contrast ratios, heading structure, keyboard reachability, and similar) run against a rendered copy of the page. These never leave Cloudflare's infrastructure and don't involve any third party.
• AI-reviewed checks — a smaller set of checks that automated rules can't reliably catch (whether alt text is actually meaningful, whether color alone is used to convey information, whether text is baked into an image, and overall reading-level) are judged by sending screenshots of specific images and the page's visible text to Anthropic's Claude, via Cloudflare's AI Gateway. Only content already public on your site is sent — never visitor data, account details, or anything behind a login.

Claude's verdict for a given image is cached for up to 90 days, keyed to the image itself, so the same logo or photo reused across many pages of your site is only reviewed once rather than on every page it appears on. You can see everything this scan finds, including AI-reviewed findings, in the Accessibility tab of your dashboard, and mark issues as fixed once you've addressed them.

This scanning is automated and does not constitute a legal accessibility audit or compliance certification — see the disclosure shown alongside your results in the dashboard.

Do Not Track.

The Wiley script respects the Do Not Track browser setting. If a visitor has DNT enabled, no events are recorded for that visitor.

Account data.

When you create a Wiley account, we store your email address, your site domain, and your stated goal. We use your email to send the weekly Nudge and transactional emails (password reset, etc.). We don't send marketing email. We don't share your email with third parties.

You may also provide additional context — notes about your site, goals, or feedback on nudges. This is stored and used to improve the relevance of your nudges.

Content you create.

If you use Just Me (Wiley's page and blog publishing feature), we store the content you write — page blocks, blog posts, and layout settings. This content is associated with your account and stored in Cloudflare's infrastructure. You can delete it at any time. We do not collect data about readers of your published pages.

Google Analytics import (Pro).

Wiley Pro users can optionally upload a Google Analytics export to give Wiley historical context when generating nudges. Uploaded data is aggregated page-level traffic data — no individual visitor information is included in or extracted from these imports. The data is stored in your account, used only to inform your nudges, and can be deleted at any time from the Data page in your dashboard.

Search rank tracking.

On paid plans, Wiley automatically selects a set of search keywords relevant to your site and checks where your site ranks in Google results for those terms. This runs daily and the results are used to inform your nudges — for example, identifying pages that could rank higher with a small structural change.

To perform these checks, your site's domain and the selected keywords are sent to DataForSEO, a third-party service that queries Google on our behalf. No visitor data, account information, or personally identifiable information is included in these requests. You can see which keywords Wiley is tracking in your dashboard settings.

PageSpeed testing.

On paid plans, Wiley periodically tests your site's page speed and Core Web Vitals using the Google PageSpeed Insights API. This runs a standard Lighthouse analysis against your public homepage and returns performance metrics (load time, layout stability, interactivity). No visitor data is sent — only your site's public URL. Results are used to generate nudges about performance improvements that may affect search ranking and user experience.

Broken link and content checking.

During Wiley's regular crawls of your public site, we check whether any internal links return error responses (such as 404 Not Found), and we look for date signals on pages to understand how recently content was updated. This is done entirely using your site's publicly available pages. No personal data is involved. Findings are used to flag outdated content and broken links in your nudges.

Connections (paid plans).

Wiley's Connections feature explains what may have caused a change in your traffic — a site change, a backlink shift, a Google algorithm update, or a seasonal pattern — instead of just reporting that traffic moved.

Most of this runs on data Wiley already collects: referrer spikes are detected from your own traffic data, and possible Google algorithm updates are inferred from rank movement across the keywords Wiley already tracks for your site — no separate third-party call is made for either. Weekly, we also check your site's backlinks by sending your site's domain to DataForSEO to retrieve a summary of referring domains; no visitor or account data is included in this request.

Third-party services.

Wiley uses the following third-party services:

• Cloudflare — infrastructure, Workers, D1 database, and transactional email delivery
• Stripe — payment processing (we never see or store card details)
• Anthropic (Claude) — AI-powered nudge generation and accessibility review. Anonymized, aggregated site data is sent to generate nudges — this includes traffic metrics, crawl data, context notes you've provided, and imported analytics summaries. For the AI-reviewed accessibility checks (paid plans), screenshots of public page images and visible page text are also sent, routed through Cloudflare's AI Gateway. No personally identifiable visitor information is sent in either case.
• DataForSEO — Google search rank checking and backlink monitoring (paid plans). Your site domain (and, for rank checks, your selected keywords) is sent to retrieve ranking and backlink data. No visitor or account data is included.
• Google PageSpeed Insights — Page performance testing (paid plans). Your site's public URL is sent to retrieve Lighthouse performance metrics. No visitor or account data is included.

Contact.

Questions about privacy? wiley@fromwiley.com