1. What WayTrace does

WayTrace reconstructs the public history of a domain from snapshots stored by archive.org. It fetches a representative sample of those archived pages and extracts signals (technologies, endpoints, links, identifiers, etc.) with the dates they were seen. All source data was already public and archived by a third party before any scan. WayTrace is independent and not affiliated with the Internet Archive.

2. Permitted use

WayTrace is intended for lawful purposes only, including:

• education and learning about open-source intelligence;
• authorised security research and defensive security (your own assets, or with permission);
• journalism, investigation, and threat / fraud research you are entitled to conduct;
• historical and academic research on the public web.

3. Prohibited use

You must not use WayTrace to:

• stalk, harass, intimidate, dox or endanger any person;
• attempt unauthorised access, credential abuse, or to circumvent authentication;
• violate privacy, data-protection or anti-hacking laws in any applicable jurisdiction;
• conduct surveillance or profiling that infringes another person's rights;
• any other illegal or abusive activity.

Access used to facilitate any of the above may be blocked, and abuse may be reported to the relevant authorities.

4. Your responsibility

You alone decide what to scan and what to do with the results, and you bear sole responsibility for that use. You must comply with every law that applies to you and to the subject of your research, including in the subject's jurisdiction. Where results contain personal data, you act as the data controller for any further processing you perform. WayTrace only surfaces data a third party had already made public; it does not make that use lawful in your hands.

5. Personal data (GDPR / RGPD)

Archived pages can contain personal data (for example email addresses or names). There is no general exemption for publicly available personal data under the GDPR. WayTrace minimises exposure by design: it processes only data already archived publicly, performs no enrichment beyond those pages, retains finished scans for a limited period on the hosted service, and relies on a legitimate-interest basis (security research and web transparency) balanced against the rights of data subjects. Data subjects may request removal of a scan (see Contact).

Where it runs, and who else sees anything. The hosted service runs on a server in France (OVH). One third party is involved: when you ask for a sign-in link or a notification, your email address is passed to Resend, which delivers the message. Nothing else about you goes to anyone, and there is no analytics or advertising service on this site.

Your rights. You can ask for a copy of what is held about you, have it corrected or deleted, or object to it being kept, by writing to the address in Contact below. If the answer does not satisfy you, you can complain to your data protection authority; in France that is the CNIL.

6. What this instance keeps, and why

What is stored does not have the same lifetime everywhere. Some of it lives on this server. Some never leaves your browser.

• The results. Deleted from this instance at the end of the retention window shown on the scan page. The findings, and the archived page content behind them, go for good and the scan link stops working.
• The record that the scan happened. Kept beyond that window: the domain, when it ran, whether it succeeded, the account that ran it and the network address it came from. No findings, no page content.
• What stays in your browser. Your theme, your language and, while a scan is being prepared, the domain you typed. They are yours, they never reach the server, and clearing your browser data removes them.
• If you sign in, one more: a session cookie that keeps you signed in and nothing else. It carries no tracker, and there is no third-party script on this site to read it. And when you create an account, the page you arrived from is recorded with it: a referring site or a campaign tag, nothing more, kept for as long as the account exists so the operator knows where people come from.

The record is kept to run the service honestly: spotting abuse, blocking bots and scripted floods, protecting the relationship with the Internet Archive that the whole tool depends on, and being able to answer a removal request months later. The basis is legitimate interest, and the operator reserves the right to keep it for as long as those purposes require.

The operator also reserves the right to refuse or withdraw access, and to block an account, an address or a network, for abusive use, automated scraping of the service itself, attempts to bypass its limits, or anything listed in section 3.

If you would rather none of this existed, do not use the hosted service, run WayTrace yourself. The code is open source, the self-hosted build does the same work without the hosted snapshot ceiling, and nothing leaves your machine: github.com/thomashousset/WayTrace.

7. Source data & the Internet Archive

Every snapshot comes from the Internet Archive. WayTrace neither hosts nor controls that data, and its availability, accuracy and completeness are outside WayTrace's control; results may be partial or out of date (archive gaps). Your use of the archived data is also governed by the Internet Archive's Terms of Use, which you accept by using WayTrace: do not flood requests or attempt to bypass rate limits. To have a page removed from the archive itself, contact the Internet Archive directly.

8. Licence

WayTrace is open source under the MIT Licence. You may self-host it; the self-hosted build has no hosted-service snapshot ceiling and can scan a domain in full. The software is provided "AS IS", without warranty of any kind, express or implied; see the LICENSE file in the repository.

9. Disclaimer & limitation of liability

WayTrace is provided as a research aid, "as is" and "as available", without warranty of any kind. To the maximum extent permitted by law, the author and operator disclaim all liability for any direct, indirect, incidental or consequential damage arising from the use of, misuse of, or reliance on the tool or its output, and for the content of archived pages. You use WayTrace at your own risk.

10. Contact / abuse / removal

The hosted service at waytrace.org is operated by Thomas Housset, who is the data controller for the personal data described above.

Abuse reports and removal requests: housset.thomas@pm.me. Legitimate requests are reviewed, and a hosted scan can be deleted on request.