Privacy Policy

Last updated: July 23, 2026

Draft document. This is a starting template, not a substitute for legal advice. It has not been reviewed by an attorney and should be before the app accepts real paying customers or is offered broadly (see LEGAL-4 in monetization-readiness.md).

1. What we collect

Account information: name, email address, and (for credentials sign-in) a hashed password. If you sign in with Google, we receive your name and email from Google.

Client information you enter: if you use the Service to manage your own real-estate clients, we store the names, emails, budgets, and financing details you enter about them. This data belongs to you and your business relationship with your client — see our Terms of Service for your responsibilities regarding it.

Usage data: properties you search, the number of analyses you run each month (to enforce plan quotas), and general application logs.

Billing information: if you subscribe to a paid plan, payment details are collected and processed directly by Stripe — we never see or store your full card number.

2. How we use it

To provide and operate the Service (run your analyses, save your client list and search history)
To authenticate you and secure your account
To send transactional email (email verification, password reset, billing receipts) — never marketing email without separate consent
To enforce plan quotas and prevent abuse
To improve the Service and diagnose issues

3. Third-party services

Running an analysis sends the property address you enter to the following services. See docs/external-services.md in the project repository for full technical detail.

RentCast — property details, valuations, rent estimates, and comparable listings. This is the core data source the Service is built on.
US Census Geocoder, OpenStreetMap Nominatim — free, keyless address normalization and autocomplete.
Mapillary, Google Street View, Esri — street-level and satellite photos for the property you search.
Google OAuth — optional social sign-in.
Stripe — payment processing and subscription management for paid plans.
Resend — delivery of transactional email (verification, password reset, receipts).
Cloudflare R2 — encrypted off-site backups of the application database for disaster recovery. Not used for anything user-facing.

4. Data retention and security

We retain your account and client data for as long as your account is active. Property and valuation data fetched from RentCast is cached to reduce redundant lookups and cost. Passwords are hashed (never stored in plain text). The database is backed up hourly to off-site storage. We take reasonable measures to protect your data but cannot guarantee absolute security.

5. Your rights

You can review and update your account information from your account page. To request deletion of your account and associated data, contact us at the address below — as of this writing, deletion is handled manually rather than through a self-service control.

6. Children's privacy

The Service is intended for licensed real estate professionals and investors and is not directed at children. We do not knowingly collect information from anyone under 18.

7. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected by updating the "Last updated" date above.

8. Contact

Questions about this policy or a data request? Contact us at tophomerentalsllc@gmail.com.