Public research dashboard

Privacy notice

Site practices reviewed October 14, 2026

You can read WSLI without a site account. We do not ask visitors for broker credentials, payments or personal trading information.

What happens when you visit

The current site has no sign-up, contact form, advertising, analytics SDK, tracking pixel or visitor profiling. Its own code does not write cookies, local storage or session storage. Fonts and other visual assets are served with the site, without a request to Google Fonts.

The Home and Agents pages request an already-public paper-account snapshot from raw.githubusercontent.com, normally every 20 seconds while the page is open. If that request fails, they use the snapshot hosted with this site. Requests omit browser credentials; the pages do not connect to Alpaca, Azure, Discord or the private OpenClaw gateway.

WSLI is hosted on GitHub Pages. GitHub receives network information needed to serve requests, including IP addresses. GitHub explicitly states that Pages visitors’ IP addresses are logged for security purposes. WSLI does not operate or set the retention period for those hosting logs. See GitHub Pages data collection and GitHub’s privacy statement for its processing, retention, international transfers and privacy-request channels.

What we publish

The dashboard shows selected simulated balances, positions, fills, recorded rule-based entry evidence, timestamps and process-health summaries for the WSLI experiment. This is operator-authorized paper-account reporting, not information collected from visitors.

The exporter is designed to exclude API keys, account numbers and IDs, broker order identifiers, private host paths, raw journals, prompts and full AI responses. Public snapshots and repository history can be copied or retained by other people; deleting a current page does not erase all prior copies.

Credentials and security

Broker and model credentials belong in the private host environment or GitHub Actions secrets, not in website JavaScript, URLs or public data. The public site is read-only: it cannot place orders or control Gem. Site tests check the public-data boundary and prohibited credential patterns, but no automated check or security measure guarantees that an incident is impossible.

Do not send API keys, passwords, account numbers or identity documents through public GitHub issues. A private reporting address still needs to be confirmed by the operator.

External links and choices

Following a link to research, GitHub or Alpaca takes you to a separate service with its own policies. Those links are not embedded trackers. You can block cross-site requests in your browser; the dashboard then falls back to its hosted snapshot, which may be older. The timestamps remain visible.

We do not sell visitor data, use it for targeted advertising or send browsing activity to an AI model through this site. We do not deliberately collect children’s personal information.

Requests and changes

A dedicated private privacy contact has not yet been published. Operator details and a suitable request channel must be confirmed before adding forms, user accounts, mailing lists or other direct personal-data collection. For data processed by GitHub itself, use the privacy-request channels in its statement. Rights to access, correct, delete or object to processing depend on the applicable law and the relevant data controller.

We will update this notice if the site’s data practices change. Optional tracking must not be introduced silently or treated as consent merely because someone reads the site. See the cookie notice for the current storage inventory.