Privacy Policy

1Introduction

Housatonic Holdings operates RentalMath. This Privacy Policy explains how we collect, use, disclose, and protect your information across all subscription tiers. By using the App, you agree to this Policy.

2Information We Collect by Tier

Without an Account (Signed Out)

No account information is collected. Deal data is stored only in your browser (IndexedDB and localStorage) on your device; we have no access to it unless you choose to create a share link, which stores that deal's payload on our server until it expires or you revoke it. To perform an analysis, the property address you type (and coordinates derived from it) is sent to our server and to the data providers listed in the Third-Party Services Disclosure; it is not linked to any user identity. We also count feature usage in anonymous aggregate (see "Anonymous Usage Metrics" in Section 5).

With an Account (Optional, Free)

Creating an account is optional and free. Core analysis works without one; signing in additionally enables property-level data lookups (RentCast) and cloud sync. When you have an account we collect:

• Account information: email address and authentication credentials, managed by Firebase Authentication (Google LLC). If you sign in with Google, we receive your name and email from Google. Our own server never stores your password; when the App makes an analysis request while you are signed in, it sends a Firebase ID token that our server verifies against Google's public keys to confirm signed-in status, to decide whether paid data calls are allowed, and (on the sign-in usage event only) to add your account ID to a cardinality sketch that stores no identifiers. Neither the token nor your account ID is persisted.
• Deal data: the property records you save, including addresses, financial inputs, notes, and timestamps, synced to Firestore under your account.
• Technical data: IP address, device type, browser, and sign-in event metadata collected by Firebase infrastructure. Our own server also sees your IP address on each request and uses it transiently for rate limiting (kept in memory only) and, in hashed form, for the distinct-network estimate described in Section 5 — it is not stored.

No paid subscriptions are currently offered, so we collect no billing or payment information.

3How We Use Your Information

• To provide, maintain, and improve the App for all users.
• To authenticate your identity and secure your account (if you create one).
• To perform property analyses: the address you enter is sent to geocoding and data providers to retrieve property and market data.
• To verify signed-in status before making paid third-party data calls (RentCast) on your behalf.
• To sync your deal data across your devices (signed-in users).
• To measure which features are used, in anonymous aggregate only.
• To respond to support and privacy requests.
• To comply with legal obligations.

4How We Share Your Information

We do not sell your personal information. We share data only as follows:

• Google Firebase/Firestore: cloud authentication and deal data storage for signed-in users.
• Google Sign-In: authentication confirmation when you use Google sign-in.
• RentCast: for signed-in users, the property address you analyze is sent to RentCast to retrieve property-level valuation and rent data.
• Public property and market data providers (US Census Bureau, FEMA, HUD, FRED, OpenStreetMap/Overpass/Nominatim, Walk Score, Urban Institute): the address you analyze, or coordinates derived from it, is sent to these services to perform the analysis. See the Third-Party Services Disclosure.
• CDN providers (jsDelivr, Google Fonts): your browser downloads App assets from these providers; they may log IP addresses.
• URL shorteners (is.gd, v.gd) — fallback only: if our own share-link server does not return a short link when you create a share, the full share link, which embeds the encoded deal data, is sent to these services to produce a short link. See the Sharing Disclosure.
• Law enforcement or legal process: if required by applicable law.

5Data Specific to Each Tier

Signed-Out Use

Your saved deal data does not leave your device unless you explicitly create a share link or export a file; it otherwise lives in your browser's IndexedDB and localStorage and is cleared when you clear browser data. Addresses you analyze are still sent to our server and data providers to run the analysis, but are not linked to you.

Signed-In Use

Deal records are stored in Firestore under your account and retained for the life of your account. Each user can only read and write their own data (enforced by Firestore security rules). Local storage remains the primary copy; Firestore is a write-through backup and sync layer. See the Data Retention & Deletion Disclosure.

Anonymous Usage Metrics

Our server counts feature usage in aggregate. Each stored record is a per-UTC-day counter keyed by an event name drawn from a fixed allowlist of twelve events: analyze, screening_opened, calculator_opened, strategy_selected, financing_selected, str_inline_applied, share_created, export_used, signed_in_session, signup_completed, verdict, grade. Two of these carry a value, also from a fixed list — verdict (GO, MAYBE, WEAK, PASS) and grade (A, B, C, D) — so the store can never become a free-text field.

Our server additionally maintains three counters the app never sends:

• Markets researched — a count per US state of the analyzed property's location. This describes property data, not your location.
• Property-data API calls — how many paid RentCast requests we have made, so we can monitor our own costs.
• Distinct visitors and distinct signed-in users — see below.

There are no analytics cookies, no fingerprinting, and no third-party analytics services. The counts are sent only to our own server.

How We Count Distinct Users Without Identifying You

To know how many different people use the App over a week or a month — rather than just how many visits there were — we keep a cardinality sketch (a HyperLogLog) for each day. A sketch is a small, fixed-size array of numbers. Adding a value updates at most one number in it; the array never grows, no matter how many values are added, and the original values are not recoverable from it. Critically, a sketch cannot answer "was this person here?" — it can only estimate how many different values it has seen. We keep two:

• Signed-in users: derived from your account ID. Because your account ID is the same on every device you sign in from, one person using a phone, a laptop, and a tablet counts once. The account ID itself is not stored in these metrics.
• Visitors: derived from the network address your request arrives from. This counts distinct networks, not people and not devices: several devices on one home connection count once, and one device moving between Wi-Fi and mobile data counts twice. Your IP address is not stored in these metrics. We do not attempt to identify signed-out visitors as individuals, because doing so would require fingerprinting, which we do not do.

These counts are estimates, accurate to within a few percent.

Your Choice: Turning Usage Counting Off

Usage counting stores no identifiers and sets no cookies, so it does not require your consent. We offer the choice anyway. Turning it off stops your device sending any usage events at all — nothing is sent and then discarded.

We also honor the Do Not Track and Global Privacy Control signals: if your browser sends either, usage counting is off automatically, both in the App and at our server, whatever this setting says.

Server-Side Caching

To reduce repeat fetching, analysis results and upstream data are cached on our server keyed by address or geography (roughly 24 hours for composite results, up to about 30 days per data source). These caches contain property and geography data, not user identities. Share links you create store the deal payload on our server until they expire or you revoke them — see the Sharing Disclosure.

6Billing Data and PCI Compliance

RentalMath does not currently offer paid subscriptions and collects no payment information of any kind. If paid tiers are introduced, payment processing would be handled by a PCI-DSS certified processor and this Policy would be updated before launch; we would never store, process, or transmit full payment card numbers ourselves.

7Data Security

We implement reasonable security measures including HTTPS, Firebase Authentication token management, and per-user Firestore security rules. No system is completely secure; we cannot guarantee absolute security of data transmitted over the internet.

8Children's Privacy

The App is not directed to children under 13 (or 16 where applicable). We do not knowingly collect information from children. Contact admin@housatonicholdings.com to report a concern.

9Your Rights

See the Consumer Privacy Rights Notice for jurisdiction-specific rights (CCPA, GDPR, etc.) and how to exercise them. To export your data, use the App's export feature. To delete your account and data, see the Data Retention & Deletion Disclosure.

10Third-Party Services

See the Third-Party Services Disclosure for a full vendor list, what data each receives, and links to their policies.

11Changes

We may update this Policy. We will post the revised version with a new effective date. Material changes will be communicated to registered users by email where feasible.

12Contact

Privacy questions: admin@housatonicholdings.com