Security & data
Your data, handled straight.
We hold as little as we need, protect what we hold, and let you take it or delete it whenever you want. Here's exactly how.
Your account
Passwords are stored only as a secure hash — never in plain text — and your session runs on a signed, http-only cookie that JavaScript can't read. Sign-in and sign-up are rate-limited to blunt brute-force attempts.
In transit
Traffic is served behind a hardened reverse proxy with strict security headers (content-type, framing, referrer and a content-security policy). A dedicated domain with full HTTPS is on the near-term roadmap.
Export your data
One click gives you a complete JSON download of everything we hold for your account — profile, analyses, saved properties and alerts. Your data is portable, by right.
Delete your account
You can permanently erase your account and everything attached to it at any time, from your settings — no email, no waiting. Deletion is immediate and irreversible.
What we keep, and for how long
Account data lives until you delete it. Access logs are kept up to 90 days; pasted listing text 24 hours; market caches from an hour to 30 days. Old alert history and archived saves are purged automatically.
No data resale — ever
We have no listings to sell and take no agent commissions or lender referrals. That means we have nothing to sell to the industry, and no reason to. Your portfolio is yours.
Under GDPR (EU / Ireland / UK) and LGPD (Brazil) you have the right to access, export, correct and erase your data. See our Privacy & data page, or get in touch.