Your data stays with you

WilmAI is an open-source hobby project by me, Antti Karjalainen, a parent in Finland. It is not affiliated with, endorsed by, or connected to Visma or the official Wilma service.

All of the code is public on GitHub, so you can check everything this page says.

The project never receives it. WilmAI's programs run on your computer and read Wilma with your own login, the way your browser does. Nothing goes through a WilmAI server, because there isn't one.

Where school data goes from your computer is up to you: to the AI assistant you connect, or in WilmAI Home to OpenAI, if you choose it. Both are described below.

The site is static pages served by Cloudflare. It has no analytics or advertising scripts and loads nothing from other sites; even the fonts come from wilm.ai.

Cloudflare handles each request, your IP address included, to deliver the page. The few addresses that run code at Cloudflare (sending you to your language, the download buttons, and the download and star counts) log their requests for three days, to catch errors.

I look only at totals that Cloudflare keeps anyway: how many times the pages were viewed and the installers downloaded, roughly how many visitors there were and from which countries, and how many update checks came in. They are counts, not people.

The download and star numbers on the pages are fetched by the site itself once a day. Your browser doesn't contact npm or GitHub for them.

They run on your computer. Your Wilma login is saved in ~/.config/wilmai/config.json, readable only by your user account, with the password scrambled, not encrypted. The current Wilma session is kept next to it for at most six hours.

When you connect an AI assistant (Claude, ChatGPT, Codex, OpenClaw or another), what it reads from Wilma goes to that assistant's provider under their terms, the same as if you pasted it into a chat. Your Wilma password doesn't: you type it into the login page, never into the chat.

Besides your school's Wilma, the CLI asks npm at most once a day whether there's a newer version (WILMAI_NO_UPDATE_CHECK=1 turns this off), and opens links in school bulletins when you ask for an attachment.

The app runs on your computer and talks to your school's Wilma directly. Messages, timetables, drafts and AI answers are stored in the app, on your computer.

When you sign in with a password, the app remembers it on your computer, scrambled, not encrypted, so signing in again is one click. On a shared computer, untick Remember on this computer. Forget it in Settings, or signing out, removes it. An OpenAI API key is kept the same way. Reset app in Settings deletes all of it.

No AI, the default: nothing goes to an AI service. Local AI: the models are downloaded once from Hugging Face, and the reading happens on your Mac, so no school data leaves it.

OpenAI, with your own API key: the app sends one message, bulletin or lesson note at a time, with your children's first names and classes so it can tell whom it's about, straight from your computer to OpenAI. It asks OpenAI not to store the readings. OpenAI handles the data under its API terms, and bills your key.

A few times a day the app asks wilm.ai whether there's a newer version. The request carries no identifier, only what any request carries: your computer's IP address, and the updater's name and version. Updates and installers are downloaded from GitHub. Look for new versions in Settings turns the checks off.

The app has no telemetry, no crash reports and no accounts. GitHub tells me only how many times each installer was downloaded.

wilm.ai has one cookie, and only when you set it: picking EN or FI with the language switch saves lang=en or lang=fi in your browser for a year, so the site opens in your language. It holds nothing else and goes nowhere but wilm.ai.

As it only remembers a choice you made, the law allows it without asking first (section 205 of Finland's Act on Electronic Communications Services, which follows the EU's ePrivacy rules). There are no analytics, advertising or third-party cookies, and so no cookie banner.

Cloudflare's bot-detection cookies are off for this site. Only if Cloudflare ever has to check a visitor during an attack does it set its own security cookie, cf_clearance, which is strictly necessary for that.

To remove the language cookie, clear wilm.ai's cookies in your browser. The CLI and WilmAI Home keep their data in files and app storage on your computer, not in cookies.

For this website and WilmAI Home's update checks, I'm the controller of the only personal data involved: the IP address and browser details in each request to wilm.ai. Cloudflare processes them for me under its Data Processing Addendum. I use them only to deliver the site and the updates and to keep both working and secure, which is my legitimate interest (GDPR Article 6(1)(f)). The site's logs are kept for three days and Cloudflare's own request statistics as its service sets; I look only at totals.

Visitors in Finland are usually served from Cloudflare's data centres in the Nordics, but its logs and statistics can be kept elsewhere, the US included, and as a US company Cloudflare is subject to US law. Such transfers rely on the EU–US Data Privacy Framework, which Cloudflare takes part in, and on the EU's standard contractual clauses in its Data Processing Addendum.

I'm not the controller of your Wilma login or your school data. The CLI and WilmAI Home process them on your own computer, at your direction, and I never receive them. When you send them on, to an AI assistant or to OpenAI with your own key, that service handles them under your own agreement with it. GitHub handles downloads under its own privacy statement.

Nothing on my side makes automated decisions about you or profiles anyone.

You have the right to access your personal data, to have it corrected or erased, to restrict or object to its processing, and to data portability where it applies. As I hold nothing that identifies you beyond three days of request logs, there's usually nothing to hand over or delete, but you can always ask: write to privacy@wilm.ai. You can also complain to the Office of the Data Protection Ombudsman, Finland's supervisory authority (tietosuoja.fi).

Ask on GitHub, or write to feedback@wilm.ai. Please leave out messages, children's names and logins. For anything about your personal data, write to privacy@wilm.ai. Open an issue →

When this page changes, the date at the top changes too, and every earlier version stays in the project's history. This page's history on GitHub →