Privacy

Updated 13 November 2026

WaveTrail is operated by Moai Labs LLC. It helps account holders create tracking links and images and see requests to them. It does not connect to or read your inbox.

Account information

We store your account name, email address, password hash and sessions to provide sign-in. Passwords are not stored as plain text. MCP tokens are stored as hashes. Session cookies are used for sign-in, not advertising.

Platform audit history and assistant connections

We record visits to application pages, account actions, MCP requests and tracking-tool calls for an account audit history. Records include a timestamp, action, severity, request method and route, result status, connection identifier, browser or client user-agent string and a hashed network reference. Platform audit records have no automatic age expiry at present. Detailed operational records are restricted to the service administrator. Account holders can view summaries of their own security and assistant activity. Explicit deletion, including account deletion, still applies. Anonymous or failed requests may be recorded without an account association. Passwords, credential values, cookies, request bodies and URL query strings are excluded from audit records.

When you connect an assistant using OAuth, we store its registered application metadata, your consent, signing keys and hashed token identifiers. Short-lived access tokens are limited to the WaveTrail MCP resource. You can disconnect applications or revoke manual tokens in the app. Anyone who possesses an exposed credential can burn that credential without account sign-in. Burn and revocation events are retained in audit history.

Account emails

Our verification and password-reset emails, including verification resends, use the same tracked links and images as emails tracked by our customers. We record image and link request times, which link was requested and possible automation signals. These records are held in our sender account, with destination URLs needed for redirects, under the same tracking limits and 30-day event retention. They do not prove a human opened or read an email: proxies, caching and scanners can create or hide requests. Deleting your recipient account does not delete records held by the sender. We do not store raw IP addresses or raw browser user-agent strings in tracking records.

Tracking records

We store the label, recipient reference and destination links you supply. Use an internal reference instead of a recipient's email address where possible. A tracked link identifies a message record, not a verified person.

When a tracked link or optional image is requested, we record its time, type and a possible automation signal. We do not store visitors' raw IP addresses or raw browser user-agent strings in tracking records. Short-lived hashed network identifiers are used for rate limiting.

Email content

WaveTrail does not accept, compose or send your campaign email bodies. Your agent or email tool inserts the tracking URLs and image HTML into the email. We receive only the tracking label, recipient reference and destination links.

Retention and deletion

Request history is kept for 30 days, with up to 1,000 events per tracking record. Additional requests can be omitted. Tracking records and destinations remain until you delete them or your account. Deleting a record disables its links and removes its stored activity. Account deletion removes your records and access tokens.

Service providers

Cloudflare hosts the service and database and may process network and security logs under its own policies. Cloudflare Email Service delivers account verification and password recovery messages. These operational systems may retain logs or backups separately from the activity shown in your dashboard.

Your responsibility as a sender

Only track messages you are entitled to send and measure. Give recipients any notice and choices required for your use. For tracking records created by your agent, open tracking is optional and off by default. Your agent must request an image when creating tracking. Opening your own Sent-folder copy can register an open. We do not sell tracking activity or use it for advertising.

Contact

Privacy or abuse concerns can be raised with Moai Labs through moailabs.io. Include the affected WaveTrail link where relevant.