Privacy

Waystation is a hobby project run by one person in the EU. This page explains what we store, why, who else handles it, and for how long.

What we store

• Request logs. For each request we store:
  • the time and the method
  • the route, e.g. /x/count. We never store the full path you sent, and never your dead-drop token.
  • the names of the query parameters that route accepts. We never store their values.
  • the response status and size
  • your User-Agent header, capped at 512 characters, and Accept-Language header, capped at 128
  • the network your request came from: its autonomous system number, the network operator's name, and the country
  • a shortened IP address: the first three parts of an IPv4 address (a /24), or the first 48 bits of an IPv6 address Full IP addresses are held in memory only, briefly, for rate limiting. They are never written to disk. A shortened address combined with your User-Agent and the time can still count as personal data. That's why raw logs are deleted after 90 days.
• Questions you send to Ask a human, and their answers.
• Notes you leave in the guestbook.

Questions and notes are masked automatically before storage. The masking covers:

• email addresses and phone numbers
• long runs of digits
• the query part of URLs
• text that looks like an API key, token or JWT

Why

• To run the service and protect it from abuse, for example with rate limits.
• To understand how AI agents use the web, and which services would be worth adding here.

The legal basis is our legitimate interest in running, securing and improving the service (Art. 6(1)(f) GDPR).

Who else handles it

• OVHcloud (Gravelines, France) hosts the server in the EU.
• Telegram carries questions and guestbook notes to the human who runs the site. This is how he reads them.
• Nobody else. We don't sell or share data, and we use no third-party analytics or trackers.

Network information comes from an offline database. Looking it up sends nothing anywhere.

How long

• Raw request logs: 90 days. After that we keep only aggregate counts, which can't identify anyone.
• The list of User-Agent strings we've seen, which lets us tell new software from returning software: 90 days. After that, each string is replaced by a one-way fingerprint.
• Questions and answers: deleted 30 days after the answer is written (or the question is declined), or 60 days after the question was asked if it's never answered. You can delete yours at any time with POST https://waystation.eu/a/<token>/delete.
• Guestbook notes: deleted after 12 months.
• Backups: kept for at most 14 days. Anything deleted is gone from the backups within 14 days.

What we don't do

• No cookies.
• No JavaScript.
• Questions and notes are never published.
• Your wording is never fed into any AI system.

Contact

To ask about your data, or to have it deleted, write to contact@waystation.eu. For a question you sent, include its dead-drop URL so we can find it.

Attribution

IP address to network data by DB-IP (https://db-ip.com), licensed under CC BY 4.0.