What we hold, and what we don’t

When you sign in with LinkedIn we keep what LinkedIn’s sign-in hands us: your LinkedIn account identifier, your name, your email address and the URL of your profile photo. We do not keep a LinkedIn access token and we never see your LinkedIn password.

The first time you ask a member for an introduction we ask for a one-line headline and your LinkedIn profile URL, so the person you’re asking can see who is asking. Both are optional and stored only if you give them.

We ask for your mobile number when you join, and store it only after you confirm a code texted to it, together with the time you confirmed it. Members outside the US and Canada, where our texts can’t reach, continue without one. What we do with the number is spelled out under Texts below.

When your LinkedIn data export comes in through the WiseGoose app we keep, for each connection, what the file carries: their name, their job title, their company, their LinkedIn profile URL and the date you connected. We do not store the email address column from that file — it is read and discarded on the way in.

Your connections are visible to signed-in members of your flock and to nobody else. Flocks are separate from one another: members of one cannot search another’s. Nothing here is public.

A “honk” is one member asking another for an introduction. We record who asked, whom they asked, whom they asked about, the one-line ask, and what happened: pending, passed, or “introduced” when the member says so. We show that last one as what it is — the member’s word.

When a member writes the introduction from their own email, the draft we prepare adds a blind copy to an address of ours ending in @wisegoose.org. If they keep it, that copy tells us the email was sent: we record the date and the message id, and nothing else. The copy is not stored, and the email address of the person being introduced is not kept.

Texts are optional and only ever go to a number you verified. We send three kinds and no others:

• a one-time verification code when you add the number;
• up to two reminders per LinkedIn export you request — one about a day later, when the archive should be ready, and one about three days later, before LinkedIn’s download link expires;
• a nudge when a member of your flock asks you for an introduction.

That is all: no marketing, nothing on a schedule, nothing from anyone but us. Message frequency depends on how often you request an export and how often you are asked for an intro. Message and data rates may apply. Reply STOP to any text and our provider stops delivering to you; reply HELP for help. To change or take the number off your account, use Settings, or write to us at the address below. Texts reach US and Canada numbers only; every reminder also goes by email, so you miss nothing without a phone.

The WiseGoose Import extension, where it is offered, reads your own first-degree LinkedIn connections from a LinkedIn tab you are already signed into and sends them to your flock. That is its only purpose.

Concretely, it makes four kinds of request and no others:

• to linkedin.com, to read your connections list using your existing session;
• to your flock’s /api/import/token, to get a short-lived signed token proving you’re signed in;
• to your flock’s /api/ext-config, to fetch the current import settings;
• to your flock’s /api/import/linkedin, to deliver the connections.

It never sees or asks for your LinkedIn password, and it never sends your LinkedIn session cookie anywhere — the session stays in the browser, where LinkedIn put it. Your connection data goes to your flock and nowhere else: not to us separately, not to any analytics service, not to any third party. There is no tracking, advertising, or telemetry in the extension. It stores two things locally in your browser — your flock name, and the progress of an in-flight import so it can resume — and both are cleared when you remove it.

Reading LinkedIn this way is not something LinkedIn’s User Agreement sanctions, even though it is your own data and your own session. Bringing your LinkedIn data export in through the WiseGoose app does the same job and always works.

We don’t sell data, share it with advertisers, or use it to train models. We don’t build profiles of people outside the flock that imported them, and we don’t contact anyone in an imported connection list — introductions are written and sent by members themselves.

Cloudflare hosts the app and receives the blind-copy receipts; Supabase holds the database; Resend sends email; Twilio verifies phone numbers and sends texts; LinkedIn provides sign-in. Where a flock has semantic search turned on, Voyage AI computes and Turbopuffer stores search embeddings of connection names, titles and companies. Each receives only what it needs to do its job.

Write to privacy@wisegoose.org from the address you signed in with and we will remove you and the connections you imported. If you appear in someone else’s imported connections and want to be removed, write to the same address and say so — you don’t need an account. There is no self-serve deletion yet; a person does it.