This is an early release preview. You may encounter bugs.
WaySpace
Sign up

Legal

Privacy policy

Last updated 2026-10-05

Prototype notice. way.space is an early-stage prototype built by the Lineage Labs team (no incorporated legal entity at this time). Do not submit sensitive personal data. See the terms of service for the full disclaimer.

1. One policy, two services

way.space is operated by Lineage Labs, an unincorporated project team based in Denmark. Until a legal entity is formed, the individual operators of the project act as the data controller under the GDPR. The WayID Privacy Policy is the master document. It covers who we are, your GDPR rights, international transfers, and how to complain to Datatilsynet. This page adds what way.space itself does, and prevails for way.space where the two differ. Contact for everything: hello@lineage.fyi.

2. What way.space processes, and why

  • Account data. Email, name, avatar URL, and provider user ID from your Google or GitHub sign-in (Supabase Auth), and your verified GitHub username if you sign in or re-authenticate with GitHub. way.space runs its own EU-hosted Supabase database, separate from way.je's. We use your email to identify and link your account, not for marketing. Legal basis: performance of a contract.
  • Profile data. Your username, display name, bio, tagline, links, and avatar, mirrored from your WayID identity (see section 3), together with your verification status and credibility grade. Legal basis: performance of a contract.
  • Forum and vote data. Threads, replies, forum votes, and recommend votes, stored with your account and with the credibility grade you held at the time, which is displayed alongside them, and whether a post has been hidden by a moderator. Legal basis: performance of a contract.
  • Catalog contributions. Tool proposals, published blueprints, and tool claims. Claiming checks your access to a repository through GitHub at that moment. We keep the outcome and the evidence of the claim, not your GitHub access token. Publisher claims and their revocations are public. Legal basis: performance of a contract, and for the public claim log our legitimate interest in an honest record of who publishes a listing.
  • Agent access tokens. If you create a token for your AI assistant, we store a hash of it (never the token itself), its name and scope, and a log of when it was used, for what action, and with what result. Legal basis: performance of a contract, and our legitimate interest in security and abuse prevention.
  • GitHub activity of members. For builders with a GitHub username we fetch public contribution counts and recently active public repositories from GitHub each night, to show on your profile. Legal basis: performance of a contract.
  • Technical data. IP addresses and request logs processed by Cloudflare and Supabase to serve, secure, and debug the site. We run no analytics of our own and do not build visitor profiles. Legal basis: legitimate interests.

3. Data exchanged with WayID

way.space and WayID (way.je) share one identity layer. When you sign in here, way.space creates or links a WayID account using your verified email, passing your username, display name, avatar, and, for GitHub sign-ins, your GitHub username. Profile edits made here write through to WayID, and your verification badges and GitHub-derived stats are read back from it for display. Publisher attestations are also read from WayID. Both services are run by the same team under the same controller, so this exchange stays in-house.

4. People who have not signed up

The catalog describes public software, and that involves some data about the people who publish it, whether or not they use way.space.

  • Maintainers and contributors. Tool scores draw on public repository data (metadata, stars, contributor activity, releases). Most maintainers appear only as a link to their public GitHub page.
  • Curated profiles. For a limited number of well-known builders and organizations we publish a profile we have written ourselves from public sources: name, GitHub username, avatar, a short bio, links, the catalog tools they are behind, and recent public GitHub activity counts, refreshed nightly. Each such profile is marked as curated, shows its source, and can be claimed or removed by the person it describes.
  • Conference talks and launches. We list public talks and product launches about catalog tools, with speaker names as published by the event, linked to a profile only where the event's own page identifies the speaker's GitHub account.

We process this under our legitimate interest in describing publicly available software and the people who publish it. We have weighed that against your interests: the data is already public and professional in nature, we keep what we add to a minimum, and we do not calculate a personal credibility grade for people without an account. You can object at any time. Email privacy@way.space or hello@lineage.fyi and we will remove or correct data about you without asking you to justify the request.

5. Automated processing

Builder grades are calculated automatically from GitHub data, and your grade decides whether you can post without a WayID verification. If you think your grade is wrong, email us and a person will review it. You can also pass the gate by verifying with WayID instead. Tool descriptions, categories, and listing decisions are produced with automated tooling, including AI models, working from public project material. We do not feed your private data into them.

6. What is public

Builder profiles, tool pages, forum posts, published blueprints, publisher claims, and aggregate vote tallies are world-readable, indexed by search engines, and also published in machine-readable form (catalogue.json, forum.json, the /api/v1 endpoints, an MCP server, llms.txt, the sitemap, social-preview images, the agent guide) for AI agents to read. Your email address is never public. Anything you post here should be something you are happy to see republished, and copies that others have already taken are outside our control.

7. Service providers and third parties

  • Processors acting for us. Supabase (database and authentication, EU-hosted) and Cloudflare (hosting, edge network, and request logs).
  • Sign-in providers. Google and GitHub handle your login under their own privacy policies and are responsible for their own processing.
  • Services your browser contacts when you view a page. Tool logos load from the jsDelivr CDN, avatars from GitHub or Google, and talk thumbnails from YouTube. Each of these receives your IP address and browser details as part of the request. We send them nothing else, and we embed no video players or social widgets. Typefaces are served from way.space itself, so viewing a page sends nothing to a font provider.
  • Public data sources. The GitHub API, public package registries, and public event and launch listings supply catalog data. We send them no data about you.

Some of these providers process data outside the EU/EEA. The transfer safeguards described in the WayID Privacy Policy apply. We do not sell personal data or share it with advertisers.

8. Cookies and local storage

Only what the site needs to work: the Supabase Auth cookies that keep you signed in, a short-lived cookie (ws_claim_intent) that remembers which tool you are claiming while you re-authenticate with GitHub, and a browser storage entry for your light or dark theme choice. No analytics, tracking pixels, or advertising cookies, so there is no cookie banner.

9. Retention and deletion

We keep your data while your account exists. To delete your account and data across both services, email hello@lineage.fyi. On deletion:

  • your profile, forum threads and replies, votes, and agent tokens with their usage log are deleted;
  • tool proposals you submitted and blueprints you published stay in the catalog with your name detached, unless you ask us to remove them too;
  • your claims on tools are released;
  • request logs and routine backups held by our providers expire on a short rolling basis.

Curated profiles and other data about non-members are kept while the tools they relate to are listed, or until the person objects. If the service is discontinued, we will delete the data rather than keep it.

10. Your rights

Everything in the WayID Privacy Policy about your GDPR rights applies here: access, correction, deletion, a portable copy, restriction, and objection, answered within a month, with the right to complain to Datatilsynet or your local authority. These rights apply whether or not you have an account. way.space is for adults (18+). To exercise any right, email hello@lineage.fyi.

11. Changes

This policy changes as the prototype does. The “Last updated” date reflects the current version, material changes are announced on the site, and earlier versions are available on request.