Privacy Policy

1. Information you give us

• Account: your email address, an optional display name, and a password. The password is stored only as a salted hash; we cannot read it.
• Favorites and notes: parcels you save and any notes you attach. Notes are private to your account and shown only to you.

2. Information collected automatically

• Session cookie: a signed, HTTP-only cookie that keeps you signed in. It contains your account id, email, and name. There are no advertising or third-party tracking cookies.
• Server logs: our hosting provider records request metadata (time, path, status, and the network address of the request) for operations and abuse prevention. We use network addresses in memory to rate-limit sign-in and sign-up attempts; those counters are not stored.
• Map tiles: the map loads its base layer from OpenFreeMap, which receives the tile requests your browser makes.

3. Property records

The parcel, owner, assessment, tax, and sale records in the Service come from public county sources, not from you. They may include the names and mailing addresses of property owners as the counties publish them. We do not add to, verify, or sell those records, and we do not use them to make decisions about anyone. To correct a record, contact the county that publishes it; we will pick up the change on the next refresh.

4. How we use your information

• To sign you in and show you your saved parcels and notes.
• To keep the Service secure, including rate limiting and abuse investigation.
• To contact you about your account or changes to the Service, if ever needed.

We do not sell personal information and we do not run advertising.

5. Who can see it

Your account data lives in a managed database at DigitalOcean, our hosting provider, in the United States. Only the operators of the Service can access it, and only to run the Service. We share it otherwise only when the law requires it.

6. Retention and deletion

We keep your account until you ask us to delete it. To delete your account, favorites, and notes, email the address on the account’s sign-up confirmation or contact the operator; we will remove them within 30 days. Database backups roll off within seven days after that.

7. Security

Passwords are hashed with scrypt, sessions use signed HTTP-only cookies, all traffic is encrypted in transit, and the database accepts connections only over TLS. No system is perfectly secure; use a unique password.

8. Children

The Service is not directed to anyone under 18, and we do not knowingly collect their information.

9. Changes

If this policy changes, the effective date above will update. Material changes will be announced on the Service before they take effect.