InterfaceDelta Privacy Notice

Who operates InterfaceDelta

InterfaceDelta is operated by InterfaceDelta, Inc. Privacy questions may be sent to privacy@interfacedelta.com.

Account and authentication information

We process the email address used for passwordless sign-in, email-verification state, single-use verification-token records, database session records, and related authentication timestamps and identifiers. We do not store passwords. Authentication email contains a short-lived magic link.

Required account information

An email address is required for passwordless authentication and account and monitor functionality. Without an email address, we cannot provide those features.

Monitoring and notification information

We store account-to-target monitor subscriptions, alert preferences, verified notification destinations, notification state, bounded error codes, attempt timestamps, deterministic idempotency information, and an email-provider message identifier where supplied. Drift emails contain bounded factual change information and an InterfaceDelta detail link; they do not contain a complete Passport or raw protocol payload.

Workflow profiles

If you create a workflow profile, we store what you enter: the workflow’s name, an optional purpose, its steps, the monitored targets, endpoints, or capabilities it depends on, the access you expect for each (public, sign-in, or payment), acceptable substitutes, accepted payment methods and currencies, and an optional escalation owner. Profiles are private to your account, and a dependency can reference only a target your account already monitors. Please do not include other people’s personal information in a purpose or escalation owner unless you need it there.

We use workflow profiles only to show you which evidenced changes touch your workflows: on your monitoring pages, in the Impact Briefs you view there, in your alert emails, and through the Developer API when you use a token with the workflows:read scope. Relevance is computed when it is shown and is not stored. Workflow profiles never appear on public pages, in downloaded Impact Briefs or Signal exports, in other accounts’ views, in discovery or research, or in any AI model request.

Workflow details in alert emails

To name your affected workflows in an alert email, our recurring worker calls a narrow database function. It returns only the workflow names and dependencies of the account receiving that alert, and only while that alert is being sent. Each call records the alert delivery identifier, the database role that made the call, the time, and the number of rows returned. That audit record contains no workflow content, and only the database owner can read it. If the lookup is unavailable, the email is sent without workflow details.

Public target observations

For submitted public HTTPS targets, we process public endpoint metadata, canonical Passport observations, fingerprints, historical comparisons, and deterministic compatibility changes. Public Passport, history, share, and badge surfaces are separate from private account and delivery data. Public target history may persist independently of an account and is not automatically removed when an account is deleted.

When a signed-in account initiates a browser inspection, we store a private link between that account and the resulting public Passport observation so the account can find its inspection again. This link does not establish ownership of the inspected target and is not exposed through public Passport, history, share, REST, or MCP responses. Deleting the account removes the private link while the public observation may remain.

Monitored pages

When you monitor a specific page of a site, its path, without any query string or fragment, becomes part of that monitored target, and the page is read at each scheduled check for declarative WebMCP form tools. Observations of that page are public target data, like any inspected origin, and may persist independently of your account. Please do not monitor page paths that contain personal information.

Payment challenges from inspected endpoints

When a recorded observation reaches an MCP endpoint that answers HTTP 402 (Payment Required), we keep a structured copy of the payment challenge the endpoint declared. That copy can include the amounts, assets, and recipient addresses the endpoint states. We also keep a hash and the length of the response body, its content type, the endpoint, and the time. We never offer or make a payment. A one-time inspection that is not recorded keeps no such record.

Publisher-provided information

Public machine-readable metadata is supplied by target publishers and may contain names, contact details, descriptions, or other personal information. InterfaceDelta treats it as untrusted public target data, bounds and escapes it for display, and does not infer that the submitter owns or controls the target.

AI-generated capability interpretations

When an authorized InterfaceDelta operator explicitly generates a capability interpretation, we send a bounded selection of a recorded public target’s machine-readable interface evidence directly to Neuralwatt’s API. The selection may include the public service origin; protocol and self-reported service identity; capability identifiers, names, titles, descriptions, tags, and examples; compact input and output schema summaries; and InterfaceDelta’s deterministic evidence and completeness state. Operator semantic searches also send the operator’s search text and bounded generated profiles for candidate public targets.

We exclude InterfaceDelta account email addresses, account identifiers, sessions, API tokens, authentication data, WorkOS identity and credential data, notification destinations, alert-delivery data, unrelated raw response bodies, raw HTML, and internal logs from this inference projection. Public publisher metadata may nevertheless contain names, contact details, or other personal information supplied by a target publisher.

We use bounded text responses for internal semantic-notebook chunks, expansive synthesis, and final adjudication, and structured responses for semantic search. Neuralwatt directly processes the submitted data and technical metadata to return a result. We do not enable model tools, browsing, or external fetches, and we do not claim request-level Zero Data Retention or non-training for this processing.

InterfaceDelta retains bounded model-generated semantic notebook entries that pass technical admission, together with their server-authored chunk capability universe and bounded diagnostics. These are internal INTERFACEDELTA_INFERRED working artifacts, not canonical facts or independently searchable profiles. We also retain bounded final-adjudication prose inside a validated server-authored structured interpretation, evidence references, deterministic grounding, source Passport fingerprint, model and prompt identity, generation time, and bounded operational status metadata. InterfaceDelta does not retain the full inference prompt, provider response envelope or raw HTTP response, or hidden model reasoning. Capability Intelligence does not run automatically on every public inspection or recurring scan, and these data and interpretations are not used for advertising.

These interpretations are probabilistic discovery aids labeled INTERFACEDELTA_INFERRED. They are not canonical Passport facts, compatibility determinations, ownership or endorsement findings, or automated decisions producing legal or similarly significant effects. Deterministic InterfaceDelta inspection and compatibility functions continue to operate if inference is unavailable.

Transactional email

We send authentication magic links and opted-in qualifying drift notifications. We do not send marketing email. Open tracking and click tracking are disabled for these messages.

Service providers

We use Vercel to host the web application, Neon for PostgreSQL storage, Railway to run the recurring worker, Resend to send authentication and transactional alert email, and WorkOS to provide OAuth authorization when you connect an external agent or MCP client to your account. These providers process relevant technical, account, target, or delivery data to provide their services.

For Capability Intelligence only, we use Neuralwatt directly as an inference provider. Neuralwatt processes the bounded public machine-interface evidence and operator search text described above.

Connecting an agent or MCP client

Signing in to this website does not involve WorkOS. Website sign-in continues to use our own email magic-link system, and your account record stays with InterfaceDelta.

WorkOS is used only when you authorize an external client, such as a coding agent, to reach your account through our MCP interface. During that authorization we send WorkOS the minimum identity information it needs to issue and manage the client’s access: your InterfaceDelta account identifier and the email address on your account. We do not send your monitored targets, observation or alert history, API tokens, or browsing information.

WorkOS then shows you which client is requesting access, issues the access and refresh tokens that client uses, and records the authorization so it can be withdrawn. You can disconnect a client at any time; withdrawing the authorization stops it from renewing its access, and any access token it already holds expires within minutes. Deleting your InterfaceDelta account removes its access immediately.

Website analytics

When enabled, we use Vercel Web Analytics for high-level website visits, page views, referrers, and supported campaign attribution. Vercel states that Web Analytics does not use cookies and derives an anonymous visitor hash from the incoming request. Depending on the report, Vercel may process the page path, time, referrer, filtered query parameters, approximate geographic information such as country, region, and, where available, city, browser, operating system, and device category. InterfaceDelta excludes account, sign-in, operator, recorded-Passport, and review-fixture routes from this analytics layer and removes query strings and fragments from events it permits.

First-party product measurement

We record a small fixed set of product-usage events to understand aggregate use of the Inspector, human Passport and history pages, supported Developer REST API operations, the public InterfaceDelta MCP server, and successful copies of the public Codex MCP connection command. Event records contain a server timestamp, fixed event name, fixed surface, fixed operation where applicable, bounded outcome, and an optional internal account identifier. The current public web and MCP events do not create an anonymous visitor identifier. These events are operational measurement, may undercount if a best-effort write fails, and are not billing-grade metering.

Measurement data we do not collect

InterfaceDelta custom product telemetry does not store raw IP addresses, full User-Agent strings, browser fingerprints, advertising identifiers, emails, names, cookies, magic-link URLs or tokens, API tokens, Authorization headers, request or response bodies, arbitrary query strings or referrers, inspected target URLs, target keys, observation IDs, MCP arguments or results, canonical Passport JSON, or publisher metadata. We do not use session replay, heatmaps, keystroke capture, DOM recording, screen recording, advertising profiles, or cross-site tracking. The InterfaceDelta CLI and GitHub Action do not send product telemetry.

Measurement retention

Custom product-usage events currently have no automatic expiry. They are deliberately minimized and retained for operational product measurement until InterfaceDelta establishes and implements a different retention process. Vercel Web Analytics reporting windows depend on the active Vercel plan; Vercel states that data may be stored longer than the guaranteed reporting window. Infrastructure and security logs remain subject to operational needs and provider retention practices.

Authorized account support

Authorized InterfaceDelta personnel may access account email addresses and limited account-status information when needed for support and service operations. This may include account creation and email verification timestamps, active session count, monitor-subscription count, and aggregate API-token creation and use state. Support lookup is exact-address only and is not used to create a marketing directory.

Account-deletion receipts

For account deletions completed after this feature is activated, InterfaceDelta retains a minimal deletion receipt containing a random receipt identifier, deletion timestamp, digest-version identifier, and keyed pseudonymous digest derived from the normalized former email address. The receipt does not store the deleted email address in plaintext, the deleted account identifier, tokens, sessions, monitor data, notification address, or account JSON.

Deletion receipts are used only to confirm deletion completion for support. They are not used for marketing, advertising, analytics, identity proof, or account reconstruction. They currently have no automatic expiry. Receipt coverage is not retroactive, so deletions completed before activation may have no retained receipt.

Account deletion and public records

Deleting an account removes account-specific authentication, session, API-token, monitor-subscription, verified notification-destination, and related private delivery information under the product's deletion process. Public InterfaceDelta Passport observations and historical records of public services may remain independently of the deleted account.

Uses and disclosures

We use information to authenticate accounts, provide inspections and monitoring, maintain public observation history, send requested transactional email, enforce limits, diagnose failures, protect the service, and meet legal obligations. We do not create advertising profiles, sell user data as a product practice, or use account data for advertising.

Legal bases where applicable

Where data-protection law requires a legal basis, we process account and service information to provide the account, inspection, monitoring, and notification services you request. We rely on legitimate interests where applicable to secure and operate the service, prevent abuse, improve reliability, and maintain factual history of observed public interfaces. We rely on consent or user choice where legally required for optional notifications. You may change notification preferences through the product.

Retention and deletion

We retain account, authentication, and session information only as operationally necessary to provide and protect the service. Account-specific information is removed according to the account deletion behavior described below. Infrastructure-provider and security logs are retained according to operational needs and provider retention practices. Public target observations and historical comparisons currently have no automatic expiry.

Workflow profiles and their dependencies are kept until you delete them or your account; deleting a monitor subscription removes the dependencies that point to it. Payment-challenge records are deleted about 400 days after they are recorded by a process that runs at most once a day, or earlier with the observation they belong to. The workflow-annotation audit records described above currently have no automatic expiry.

Versioned AI-generated interpretations and bounded internal semantic notebook artifacts for public target observations may persist with public target history independently of an account. Semantic notebooks are not independently searchable profiles. A source change makes an older interpretation stale rather than silently rewriting it.

International processing

Information may be processed in the United States and other countries where InterfaceDelta and its service providers operate. Where applicable law requires safeguards for international transfers, we will use legally required safeguards.

Privacy rights where applicable

Depending on applicable law, you may have rights to request access, correction, deletion, restriction, objection, or portability of your personal information; withdraw consent where processing relies on consent; and complain to an appropriate data-protection authority. Contact privacy@interfacedelta.com to make a request. These rights may be subject to lawful limits and verification of the request.

Automated decisions

InterfaceDelta does not use account personal information for solely automated decisions that produce legal or similarly significant effects on the account holder. Deterministic compatibility classifications concern observed target interfaces.

AI-generated capability interpretations concern recorded public interfaces and are probabilistic discovery aids. They do not establish compatibility, ownership, endorsement, or authority.

Technical data and command-line tools

Hosting and infrastructure providers may process ordinary request, security, delivery, and operational logs. InterfaceDelta’s command-line tool does not include hidden product telemetry. Target services and network intermediaries can observe inspection requests sent to public endpoints.

Choices and contact

You can sign out, change monitor alert preferences, unsubscribe from targets, or delete your account through the product. Account deletion removes the account’s authentication/session data, subscriptions, verified email destination, related private delivery records, and private links to browser inspections initiated by the account, and stops future account email. It does not automatically remove public target observations or history. Privacy requests and questions may be sent to privacy@interfacedelta.com. We may update this notice; the displayed version and effective date identify the notice then in effect.

Account deletion also removes the account’s workflow profiles and their dependencies. It does not remove workflow-annotation audit records, which contain no workflow content.