Privacy

Updated 12 November 2026

WaveTrail is operated by Moai Labs LLC. It helps account holders create tracking links and images and see requests to them. It does not connect to or read your inbox.

Account information

We store your account name, email address, password hash and sessions to provide sign-in. Passwords are not stored as plain text. MCP tokens are stored as hashes. Session cookies are used for sign-in, not advertising.

Tracking records

We store the label, recipient reference and destination links you supply. Use an internal reference instead of a recipient's email address where possible. A tracked link identifies a message record, not a verified person.

When a tracked link or optional image is requested, we record its time, type and a possible automation signal. We do not store visitors' raw IP addresses or raw browser user-agent strings in tracking records. Short-lived hashed network identifiers are used for rate limiting.

Email content

WaveTrail does not accept, compose or send email bodies. Your agent or email tool inserts the tracking URLs and image HTML into the email. We receive only the tracking label, recipient reference and destination links.

Retention and deletion

Request history is kept for 30 days, with up to 1,000 events per tracking record. Additional requests can be omitted. Tracking records and destinations remain until you delete them or your account. Deleting a record disables its links and removes its stored activity. Account deletion removes your records and access tokens.

Service providers

Cloudflare hosts the service and database and may process network and security logs under its own policies. Account verification and password recovery messages use our email delivery provider. These operational systems may retain logs or backups separately from the activity shown in your dashboard.

Your responsibility as a sender

Only track messages you are entitled to send and measure. Give recipients any notice and choices required for your use. Open tracking is optional and off by default. Your agent must request an image when creating tracking. Opening your own Sent-folder copy can register an open. We do not sell tracking activity or use it for advertising.

Contact

Privacy or abuse concerns can be raised with Moai Labs through moailabs.io. Include the affected WaveTrail link where relevant.