WavelyEnforcement
Law Enforcement Guidelines
On this page
These guidelines are for law enforcement officials and government agencies seeking information about people who use Wavely. They explain what information may exist, what legal process we require to disclose it, and how to reach us.
If you are a Wavely user, the Privacy Policy explains when we may disclose your information, and Notifying users explains when we tell you about a request.
Summary of changes
November 9, 2026: Corrects what Wavely holds: mobile numbers for accounts that sign in with one, the locations on posts, and waitlist sign-ups.
What information may exist
In short
Wavely keeps little, and keeps much of it only briefly. Requests for information beyond these periods, or for an account deleted more than 30 days ago, usually cannot be met.
| Information | Kept |
|---|---|
| Basic account information: email address or mobile number, username, display name, date of birth, when the account was created | For the life of the account |
| Waitlist sign-ups: email address, claimed username, and the time, IP address, and browser recorded when the person agreed to our emails | Until the person leaves the waitlist or the name is released. An address that bounced or reported our email as spam stays on our do-not-send list until removed, and a username removed for breaking our rules is kept, as the Privacy Policy describes |
| Sign-in and access records, including IP addresses | 30 days |
| Content: posts, media, comments, ratings, folders, and, when available, direct messages | Until deleted by the user or by us |
| Records of activity, such as follows, likes, and interactions with posts | Interactions 90 days; follows and likes until removed |
| Search activity | 30 days |
| Location attached to posts | A city or region the person chose, never their own position, until the post is deleted |
Wavely does not collect payment card details or precise location. It holds a mobile number only for an account that signs in with one. Direct messages are encrypted in transit and at rest but are not end to end encrypted. When an account is deleted, it is permanently removed after 30 days, and backups expire after 7 days.
Legal process we require
We disclose information about users only in response to valid legal process, except in an emergency as described below. Wavely is based in the United States, and requests are handled under US law, including the Stored Communications Act:
- Basic subscriber information, such as the email address and account creation date, requires a valid subpoena, court order, or search warrant.
- Other records about an account that are not content, such as access logs, require a court order under 18 U.S.C. § 2703(d) or a search warrant.
- Contents of an account, including posts that are not public and direct messages, require a search warrant issued under the procedures of the Federal Rules of Criminal Procedure or equivalent state procedures, on a showing of probable cause.
We review every request for legal sufficiency, and may push back on or decline requests that are overbroad, vague, or not properly issued. Public content can be viewed on Wavely by anyone and does not require a request.
Requests from outside the United States
Governments outside the US should use a Mutual Legal Assistance Treaty request or letters rogatory, or a process available under an executive agreement with the US under the CLOUD Act. We may provide information voluntarily only in an emergency, as below.
Emergency requests
If we believe in good faith that an emergency involving danger of death or serious physical injury to any person requires disclosure without delay, we may disclose information under 18 U.S.C. §§ 2702(b)(8) and 2702(c)(4). Send emergency requests to lawenforcement@usewavely.com with the subject “Emergency disclosure request”, describing the emergency, how the information requested will help prevent harm, and the specific account involved.
Preservation requests
On receiving a request under 18 U.S.C. § 2703(f), we preserve a one-time snapshot of the specified account’s information for 90 days while formal legal process is obtained, and extend it once for another 90 days on a renewed request. Because some information is kept only briefly, send preservation requests as early as possible.
Notifying users
Our policy is to notify users before disclosing their information in response to a request, so they can seek to challenge it. We do not notify a user if we are legally prohibited from doing so, for example by a nondisclosure order under 18 U.S.C. § 2705(b), in an emergency, or where notice would be counterproductive, such as in cases involving child sexual exploitation. Requests that ask us not to notify a user should include the legal basis for doing so.
What to include in a request
- The name of the agency, and the requesting official’s name, badge or identification number, official email address, and phone number.
- The username of the account, or the link to its profile or to the specific content.
- The specific information requested, and the date range it covers.
- The legal process, attached, and the legal basis for any request not to notify the user.
Send requests to lawenforcement@usewavely.com. To serve a request by post, email us first and we will send you the address to use. Requests must come from an official government email address. This address is for law enforcement and government agencies only; other messages will not receive a response. We may seek reimbursement for the costs of responding as permitted by law.
Requests to remove content
We review government requests to remove content against our Community Guidelines and applicable law. Content that breaks our rules is removed for everyone. We will report on removal requests in the Transparency Center.
Child safety
We report apparent child sexual exploitation to the National Center for Missing & Exploited Children through its CyberTipline, as US law requires, and preserve the related information as the law requires. NCMEC makes these reports available to law enforcement agencies around the world.