Privacy and analytics

This deployment uses Google Analytics 4 to count page visits and a short list of product events, so we can see which parts of the product people actually reach. That is the whole purpose. There is no advertising, no remarketing, no cross-site tracking and no data sold to anyone.

A page visit sends the path of the page — never the query string, so the listing link you pasted, the confirmation token in an emailed link and the reason a paywall appeared do not travel. A path with anything unexpected in it is replaced with :redacted before it is sent, rather than trusted. The page you arrived from is cut the same way: within this site to its path, and from anywhere else to the bare site name, never the full address.

Alongside that, every request to Google carries what any web request tells its recipient, whether we ask for it or not: your browser and operating system and their versions, its language, your screen size, a random identifier for this browser (the cookie below), and a coarse location — roughly city level — that Google derives from your IP address. We do not choose those, cannot see your IP address ourselves in this flow, and never attach your account to them.

Beyond that, these are all the events, and every value in them is either one of a fixed list of words or a number. There is no field anywhere in the instrumentation that could carry an address, an email address, a URL or free text — not by policy, but because the type of the event has no such field.

cta_click

A button on the marketing page was pressed. Sends which section of the page it was in — one of a fixed list, like “hero” or “pricing”.

sample_open

The public sample report was opened. Sends which section the link was in.

pricing_view

The pricing table scrolled into view on the marketing page. Sends nothing else.

sign_up

A signup form was submitted. Sends nothing else — not the address.

email_verified

A confirmation link was used successfully. Sends nothing else.

login

A sign-in succeeded. Sends nothing else — not the account.

property_add

A property was submitted for research. Sends only whether it came from a listing link or a typed address — never the link or the address.

report_queued

The research job for that property was accepted. Same two possible values, and nothing else.

report_ready

A research run finished. Sends how it ended — completed, failed, or stopped for want of anything to research — and how many seconds it took.

report_view

A finished report was opened. Sends nothing else — not which one.

report_pdf

A PDF export was started. Sends nothing else.

compare_open

The compare view was opened. Sends how many properties were being compared, as a number.

scenario_save

A named scenario was saved. Sends nothing else — not the name.

checklist_check

A verification checklist item was ticked. Sends nothing else — not which item.

begin_checkout

The upgrade button was pressed. Sends nothing else.

purchase

A subscription was confirmed by Stripe. Sends the plan price as a number and the currency. Sent once per browser.

subscription_cancel

A subscription was found cancelled. Sends nothing else. Sent once per subscription.

• Property addresses, in any form, including in a page title.
• Your email address, or any identifier for your account.
• Listing URLs, and any text you paste out of a listing.
• The contents of a report, or any figure in it.
• Anything you type into any field, anywhere.

Two first-party cookies, both set by Google Analytics: _ga, a random identifier for this browser so a returning visit is not counted as a new one, and _ga_<property>, which holds the state of the current visit. Both are readable only by this site.

Advertising storage is denied by default, before the analytics tag loads — as are Google Signals and ad personalisation — so no advertising cookie is set and nothing is joined to Google’s cross-device advertising graph.

Both are set on your first visit, unless you opt out. This is an opt-out model: the notice at the bottom of the page tells you what is collected and offers the switch, and Got it only closes the notice — it does not turn anything on, because nothing was waiting to be turned on. Opting out, here or there, is the control.

Listingprobe is a product about US property and is run from the United States, and that is the basis for this choice. If you are in the EEA or the UK and would rather not be counted, the opt-out below works the same way and takes effect immediately; a browser sending Do Not Track or Global Privacy Control is opted out without doing anything at all.

Separately, this app sets a session cookie when you sign in and stores your theme choice locally. Neither is analytics and neither is shared.

Both are honoured, and honoured before anything loads: a browser sending either signal never requests the analytics script at all. This is checked in the page’s own bootstrap rather than by the analytics provider, so it does not depend on anyone else’s good behaviour.

Addresses, listing links, pasted listing text and generated reports are stored in this application’s own database, tied to your account, and every read of them is scoped to your user id. Research runs fetch public records and listing pages, which means those sites see a request from our servers — never from your browser, and never carrying anything about you.

Payments are handled entirely by Stripe. Card details never touch this application.

Questions, or a request to delete an account and everything in it: the billing page has the contact route while you are signed in.