Privacy and analytics

To research and draft a report, we assemble the following material for the configured research model:

• the property address and subject-property context.
• listing URLs and listing text you provide.
• relevant public-source URLs, citations and retrieved text.

This processing is used only to analyze the property materials and produce the requested report. It is separate from analytics.

The active research worker reports that it sends that material to Amazon Bedrock. AWS states that Bedrock data handling depends on the model and the account or project retention mode. Some models can require provider data sharing; for example, AWS says Claude Fable 5 prompts and completions are shared with Anthropic and retained for up to 30 days for trust and safety. Other configurations can use default or zero-retention handling, subject to AWS's current terms. We therefore do not promise zero retention or no provider sharing for every Bedrock configuration.

This deployment uses Google Analytics 4 to count page visits and a short list of product events, so we can see which parts of the product people actually reach. That is the whole purpose. There is no advertising, no remarketing, no cross-site tracking and no data sold to anyone.

A page visit sends the path of the page — never the query string, so the listing link you pasted, the confirmation token in an emailed link and the reason a paywall appeared do not travel. A path with anything unexpected in it is replaced with :redacted before it is sent, rather than trusted. The page you arrived from is cut the same way: within this site to its path, and from anywhere else to the bare site name, never the full address.

Alongside that, every request to Google carries what any web request tells its recipient, whether we ask for it or not: your browser and operating system and their versions, its language, your screen size, a random identifier for this browser (the cookie below), and a coarse location — roughly city level — that Google derives from your IP address. We do not choose those, cannot see your IP address ourselves in this flow, and never attach your account to them.

Beyond that, these are all the events, and every value in them is either one of a fixed list of words or a number. There is no field anywhere in the instrumentation that could carry an address, an email address, a URL or free text — not by policy, but because the type of the event has no such field.

cta_click

A button on the marketing page was pressed. Sends which section of the page it was in — one of a fixed list, like “hero” or “pricing”.

sample_open

The public sample report was opened. Sends which section the link was in.

pricing_view

The pricing table scrolled into view on the marketing page. Sends nothing else.

sign_up

A signup form was submitted. Sends nothing else — not the address.

email_verified

A confirmation link was used successfully. Sends nothing else.

login

A sign-in succeeded. Sends nothing else — not the account.

property_add

A property was submitted for research. Sends only whether it came from a listing link or a typed address — never the link or the address.

report_queued

The research job for that property was accepted. Same two possible values, and nothing else.

report_ready

A research run finished. Sends how it ended — completed, failed, or stopped for want of anything to research — and how many seconds it took.

report_view

A finished report was opened. Sends nothing else — not which one.

report_pdf

A PDF export was started. Sends nothing else.

compare_open

The compare view was opened. Sends how many properties were being compared, as a number.

scenario_save

A named scenario was saved. Sends nothing else — not the name.

checklist_check

A verification checklist item was ticked. Sends nothing else — not which item.

begin_checkout

A Stripe checkout button was pressed. Sends only which of four fixed offers it was — Pro, a Pro top-up, one buyer report, or a buyer-report pack.

purchase

A subscription or one-time purchase was confirmed in application state written by Stripe’s verified webhook. Sends only the fixed offer, price as a number, and currency. Eligible new fulfilments are sent at most once per browser; the first stored snapshot is deliberately quiet, and redirect query strings cannot trigger an event.

subscription_cancel

A subscription was found cancelled. Sends nothing else. Sent once per subscription.

These exclusions apply to Google Analytics, not to the report research processing described above.

• Property addresses, in any form, including in a page title.
• Your email address, or any identifier for your account.
• Listing URLs, and any text you paste out of a listing.
• The contents of a report, or any figure in it.
• Anything you type into any field, anywhere.

Two first-party cookies, both set by Google Analytics: _ga, a random identifier for this browser so a returning visit is not counted as a new one, and _ga_<property>, which holds the state of the current visit. Both are readable only by this site.

Advertising storage is denied by default, before the analytics tag loads — as are Google Signals and ad personalisation — so no advertising cookie is set and nothing is joined to Google’s cross-device advertising graph.

Both are set on your first visit, unless you opt out. This is an opt-out model: the notice at the bottom of the page tells you what is collected and offers the switch, and Got it only closes the notice — it does not turn anything on, because nothing was waiting to be turned on. Opting out, here or there, is the control.

Listingprobe is a product about US property and is run from the United States, and that is the basis for this choice. If you are in the EEA or the UK and would rather not be counted, the opt-out below works the same way and takes effect immediately; a browser sending Do Not Track or Global Privacy Control is opted out without doing anything at all.

Separately, this app sets a session cookie when you sign in and stores your theme choice locally. Neither is analytics and neither is shared.

Both are honoured, and honoured before anything loads: a browser sending either signal never requests the analytics script at all. This is checked in the page’s own bootstrap rather than by the analytics provider, so it does not depend on anyone else’s good behaviour.

Addresses, listing links, pasted listing text and generated reports are stored in this application’s own database, tied to your account, and every read of them is scoped to your user id. As described above, research inputs and relevant source material are also processed by the configured AI model service. Research runs fetch public records and listing pages, which means those sites see a request from our servers — never from your browser, and never carrying your account identity.

Payments are handled entirely by Stripe. Card details never touch this application.

To delete an account and its product data, use the password-confirmed control on the sign-in page. Signing in is the identity check and does not reveal whether any submitted address has an account. The control requires the current password again before it cancels billing and deletes local data.