Acceptable use

datafetch.wtf is for legitimate research, security investigations, journalism, compliance, and authorized investigations. By using the Service you agree to this Acceptable Use Policy (AUP) and our Terms.

• Lawful OSINT on identifiers you are authorized to investigate
• Security research and fraud prevention within your mandate
• Journalistic and academic research respecting applicable law
• Automation via the API within plan rate limits

• Hacking, unauthorized access, malware, or credential stuffing
• Harassment, stalking, doxxing, or threats
• Fraud, identity theft, or scams
• Illegal surveillance or interception of private communications
• Reselling stolen credentials or raw dumps as a product
• Bypassing rate limits, device binding, or access controls

We do not vet your cases, and a successful query is not our endorsement of it. Before you run a selector you should be able to answer, on the record:

• What is my lawful basis, and would I be comfortable stating it to a regulator?
• Do I have the mandate — client instruction, warrant, employer authority, editorial sign-off — that my profession requires?
• Is this proportionate to the question I am actually trying to answer?

Running lookups on ex-partners, family members, colleagues or people who have simply annoyed you online is not investigation. It is the behaviour this policy exists to prohibit, and it is the fastest way to lose an account.

Some findings carry more risk than others. Health, sexuality, religion, political affiliation, trade union membership and ethnicity are special categories under GDPR and need a stronger basis than ordinary personal data — usually more than the legitimate interest that covers a routine lookup.

Queries aimed at identifying or locating minors are prohibited except where you act under an explicit legal mandate, such as a child-protection or law-enforcement instruction. Collect the minimum you need, share it with the fewest people who need it, and delete it when the matter closes.

Results are leads, not verdicts. Breach and stealer corpora are historical and contain mistakes, stale records, and records about people who share a name or recycled an address.

• Corroborate before you act on anything, and keep the dead ends in your notes.
• Do not use results for credit, insurance, employment, tenancy or other consumer-reporting decisions — the service is not a consumer reporting agency.
• Do not republish raw records wholesale. Report the finding, not the dump.
• Presence in a breach corpus is not proof of wrongdoing by the data subject.

If you believe an account is using the service to stalk, harass or otherwise break this policy, tell us through the Telegram help desk or a console ticket. Include what you saw and when. Reports are reviewed by a person.

If you are the subject of a lookup and want identifiers reviewed or delisted, use Data removal — that route is open to anyone and does not require an account.

Violations may result in suspension or termination without refund. We may cooperate with lawful authorities when required. Where it is safe and lawful we will tell you what triggered the action and give you a chance to respond; where a risk to someone's safety is credible, we act first. See also Privacy and GDPR.