Privacy

What Passage Data keeps when you use passage-data.com, its tools for AI assistants and programs, and its workbench. In effect from 16 October 2026. A change is posted here with its new date.

In short

The public tools need no account and keep nothing that says who you are: no IP address, no conversation.
An assistant reaches your own sites only after you allow it, and you can revoke it at any time.
We count what is asked, so we can add the sources people need.
We keep an email address only when you give it to us, and only for what you asked.
We sell nothing about you and show no ads.

The tools for assistants and programs

When an assistant or a program calls a tool at https://passage-data.com/mcp or /api/v1/, we answer it and add one to a count for that day. The count records:

the tool, and the place, parameter or species asked about;
the first 40 characters of a search, with any permit number removed;
for fetch, the kind and name of the document; for get_permit, the permit number, which is EPA's public id;
the outcome: rows found, or why none;
the kind of caller (an assistant, a script, a browser) and the program and version it names;
the network the call came from as Cloudflare reports it: the operator's name, its AS number and its country.

It never records the values you send. For a check or a table we keep only counts, such as rows over, within or not comparable. For check_dmr and fill_dmr we keep only the permit's state. We name each species or parameter we could not answer, at most 20 a call.

To count callers, and each caller's free calls in a day, we keep a 6-character scramble of the IP address. Each scramble stands for about 256 addresses. It is never shown, and it is forgotten within a week. We never keep the IP address itself, the full user-agent text, your conversation, or anything you did not send to the tool.

The daily counts are kept with no end date. They name no person.

Files read without an account

A file dropped on the site without an account, or sent to build_dwc_archive or audit_archive, is not kept. We keep what we read from it, so our reader learns: column headings, the shape of its rows, the terms they became, answers and refusal codes. Names and contacts are dropped or replaced by a code, and protected species' locations are made coarser. A drop marked private keeps nothing.

A public document sent to cite_document is kept whole in our library and read into cited rows. A link on a file-sharing host, or one carrying a signature or token, is never kept.

The pages

Pages under /limits/ and /dmr/p/ count each view: the place, permit or parameter in its address, what the page showed, the kind of visitor and the program it names. Views on one day are grouped by the scramble described above, except a search engine's, which keep no place, permit or parameter.
The “add to your assistant” box counts when it is opened and which way is chosen, with one word for where you came from: a search engine, an AI assistant, this site, another site, or none.
The discharge-report check at /dmr/ runs in your browser. A PDF or .xls file you drop there is read on our server and not kept. It counts views, lookups and checks, never their values.
Cloudflare Web Analytics counts page views and load times in your browser, without cookies.

When you give us your email address

Watching a permit (/dmr/): we keep your address and the permits you watch, and email you when something changes. Reply to any of those emails to stop: the watch is deleted.
Ordering a renewal check: we keep the permit, your address and the day. We email the order to ourselves and answer you by hand. It is kept until you ask us to delete it.
Writing to us, by email to info@passage-data.com or in a “Suggest something” box: we keep the message to answer it.

The workbench

Signing in, with Google or with a link we email you: we keep your email address, and a cookie keeps you signed in for up to 30 days.
Connecting an assistant or another program to your account: it reaches your sites through /mcp after you allow it in the workbench, or with a key you make there. Its tools (list_sites, create_site, add_document, ask_site) act on your sites as the workbench does.
For each assistant you allow, we keep its name, when you allowed it and when it was last used. Its tokens are kept only as a one-way hash. An access token lasts an hour, and the sign-in lapses after 90 days without use. If you never allow it, what it gave when it registered is deleted after 24 hours.
A key you make is kept the same way: a hash, its label and when it was last used. The daily count records an account tool's name and outcome, never a site, a file name, a question or an answer.
Your sites: the files you add, and everything we derive from them, are sealed with your workspace's own key and kept apart from every other account. They are erased in one delete when you delete the site or the workspace.
Questions you ask about a site, in the workbench or through ask_site, are sent to Anthropic with the pages of your documents that may answer them, and with the web search the question runs. Web pages found that way are read for that answer and not kept.
An address you look up is sent to the geocoder named on the form (Natural Resources Canada or OpenStreetMap). If you connect ArcGIS, we call ArcGIS on your behalf.

Who else handles data

Cloudflare hosts the site, the tools and the workbench's storage, and counts page views (Cloudflare Web Analytics).
Modal runs our document readers and the counter.
Resend sends our emails.
Anthropic answers questions asked about a site. On a scanned page, it is shown the small image of a word our two text readers disagree on, never the page or the file. No other tool calls it.
Google, if you sign in with Google; the geocoder and ArcGIS, when you use them.

We do not sell data, and we do not share it for advertising.

Your choices

To disconnect an assistant or a key, revoke it on your account page in the workbench. “Sign out everywhere” ends them all, and deleting the workspace deletes them.
To learn what we hold about your email address, or to have it deleted, write to info@passage-data.com. We answer within 30 days.
To stop a watch, reply to any watch email. To erase a site, delete it in the workbench.

Privacy · Terms · Support