WingsuitSign in

Wingsuit on school networks

This page is for whoever manages the network at your school or college: what Wingsuit contacts, which ports and protocols it needs, and how to check it works from a school device.

What Wingsuit is

Wingsuit is a whiteboard for teachers, synchronised live across a teacher's devices, with view-only links students open to follow along. Teachers sign in to an account; students only ever open a view link and never sign in.

Allow list

HostWhyRequired?
this site's addressThe site itself: pages, the API and live sync. HTTPS on port 443, all paths.Required, for everyone.
checkout.stripe.com
billing.stripe.com		Only for teachers paying for a plan.Optional.

Nothing else is contacted. Fonts and scripts are served from the site itself, and there are no adverts or trackers.

Protocols and paths

Everything below runs on the site host over HTTPS.

  • /trpc/*: the JSON API.
  • /api/auth/*: sign-in.
  • /api/whiteboard-assets: picture and PDF uploads (POST bodies up to 200 MB) and /api/whiteboard-assets/:id: downloads.
  • /ws/*: live sync, over a WebSocket (wss://) with an automatic HTTP long-polling fallback on the same paths.
  • /assets/* and /pdfjs/*: static files.

WebSockets and TLS inspection

WebSockets are the normal channel for live sync. Filters that perform TLS/SSL inspection, or that proxy HTTP, frequently break the Upgrade: websocket handshake, or accept the connection and then hold it open without passing frames. Please exclude the site host from TLS inspection, or make sure the proxy passes HTTP/1.1 upgrades through.

If WebSockets cannot be allowed, Wingsuit notices within a couple of seconds, switches to long-polling and remembers that for a day, so lessons still work. The cost is roughly a request every ten seconds per open board, plus higher latency for live strokes, so WebSockets are strongly preferred.

Timeouts and caching

Long-poll requests are held for up to 25 seconds. Idle WebSockets carry a ping every 10 seconds. A proxy idle timeout of 60 seconds or more is fine; anything under 30 seconds causes reconnects.

Please do not cache /trpc, /api or /ws; the site's own response headers already mark what is cacheable.

Student devices

Students open /view/…, /room/… and /live/… links: read-only, with no sign-in and no cookies needed beyond the site's own. They need the same allowances as staff devices, including WebSockets or the long-polling fallback, to see the board update live. This covers Chromebooks and managed iPads too.

Checking it works

The network check page tests these connections from a browser. Run it on a staff device and a student device on the school Wi-Fi. Every row green means there is nothing more to do; a WebSocket warning with the fallback shown green means the app still works, but see the WebSockets section above. Its Copy report button produces text you can send to the app's author.

Data

See the privacy policy for what Wingsuit stores and who it is shared with.

Contact

Questions about any of the above: support@usewingsuit.co.uk.