Privacy, research notice and terms.

About this site

Waypoint Reference is a research project. The relay API it describes is fictional and every record is a synthetic example; there is no live service behind it. The site exists so we can study how people and automated clients, including AI agents, find and use developer reference material.

For that research we observe and record visits as described below. We only observe: the site returns the pages, files and API answers you request, and does not send anything else to visitors or act on any client or its operator. Questions, corrections and deletion requests: team@schvaneveldt.co. Please include the approximate time of the visit and the IP address or conversation identifier, so records can be found.

What is collected

We record requested paths, request times, methods and response status when available. Links in our machine-readable indexes include a source marker; when a request carries `src=llms` or `src=llms-full`, we record that marker without adding the requested URL query string to the request record. The marker is supplied by the client and does not identify a person or prove that an agent followed the link. From the request itself we keep the names of all headers a client sends, and the values of user-agent, Accept, Accept-Language, Accept-Encoding, Referer, From, Sec-Fetch and client-hint headers, Web Bot Auth signature headers, and conditional-request headers. We never store the values of Authorization, Cookie or any other header not listed here. When the hosting platform supplies them, we also record IP address, approximate location (country, region, city, postal code, coordinates and time zone) and TLS connection fingerprints (JA3 and JA4). IP addresses, fingerprints and header patterns can be used to tell whether separate visits came from the same client. We also record which resource links are used and whether a client follows robots.txt.

If you use the assistant conversation API, we store your messages, a fixed service response placeholder, conversation identifiers, and service metadata. The scripted answer shown to you is reconstructed from your message; the broker does not store that answer as a separate message. For each scripted reply, we record the answer script version with the completion so that the answer can be reconstructed from the stored message and preserved versioned code. Access to a conversation requires its token; the site administrator can also access stored conversations. These conversations are not anonymous or end-to-end encrypted.

Deterministic API and MCP tools

Search text and example records submitted for validation are processed transiently and are not stored in application evidence. We record the operation, resource and schema version, returned resource identifiers, counts, validation issue codes, response outcome, processing duration, request and response byte counts, and request metadata described above. We do not store raw tool arguments, credentials or JSON-RPC bodies; from MCP initialization we keep only the client name, version, protocol version and capability names. These tools make no AI calls and cannot access conversations. The MCP ask_support tool processes your question transiently and records only its selected topic and script version, not the question text.

Use synthetic examples only. Hosting providers may process request data under their own policies. Public source links identify which published link was used; copied links do not identify a person or establish common ownership.

How it is used

Service data supports operating and securing the site, research into how people and automated clients, including AI agents, use reference material, understanding resource use, and reviewing unusual activity. Where the law asks for a legal basis, ours is legitimate interests in running a secure research site and studying how it is used. We do not sell this data, share it for advertising, or use it to make automated decisions about individuals. The current scripted assistant makes no AI calls. If AI replies are separately enabled later, assistant messages and relevant reference context will be sent through the AI service described below.

Do not send passwords, API keys, sensitive personal information, confidential instructions, or material you are not entitled to share. This reference does not need those details to answer a resource question.

Who receives it and where

The site is operated from the United States, where service data is processed. It is stored with our hosting provider (Vercel) and database provider (Neon) under their terms, and only we and those processors can access it. If the AI assistant is turned on, its messages are sent through the Vercel AI Gateway to the model provider it routes to (currently OpenAI), with provider-side prompt training disabled in our requests. We do not publish individual records; any published findings will be summaries that do not identify individuals. We may disclose records if the law requires it or to protect the site and others from abuse.

How long it is kept

We keep request records, including IP addresses and fingerprints, and assistant conversations for this research without a fixed deletion date. You can ask us to delete records about you at any time (see below). Conversation access tokens expire after 24 hours; that ends your access, not the stored transcript.

Hosting, database, and AI providers may process service data under their own retention policies. Deleting a record from the application does not delete every provider-held copy at the same time.

Your rights and choices

Depending on where you live, you may have the right to ask what we hold about you, to have it corrected or deleted, and to object to its use. Email team@schvaneveldt.co with the approximate time of your visit and your IP address or conversation identifier; we cannot find records without some identifier, and we will check that a request matches the records before acting on it. We will reply within a reasonable time and tell you what we found and did. You may also complain to your local data-protection authority. You do not need an account or any personal details to read this site, and it is not directed at children.

Terms of use

Use the reference for lawful, ordinary reading and testing. The content is provided as is, with no promise of availability or accuracy; it describes a fictional service and must not be relied on for any real system. Do not attempt to disrupt the site, to access anything that is not published here, or to submit confidential or personal data. We may rate-limit or block traffic that does. Code and documentation are published under the licenses named in the downloadable package.

Your browser

This site sets no cookies and loads no third-party scripts, fonts or trackers. The chat stores its conversation token in this tab's session storage so you can return to the same conversation. Starting a new conversation clears this tab's previous token; it does not delete the server's copy. Public resources remain available without using chat.