Privacy

Curbnote is about properties, not people. The browser extension surfaces public-record red flags on real estate listings you choose to analyze. This page explains what we collect to provide that, what we deliberately don't do, and how to delete everything.

What we collect

• Your account email. You sign in with a one-time code sent to your email (handled by our authentication provider, Supabase). We use it to identify your account and contact you about the service.
• Listing details you analyze. When you run Curbnote on a listing, the extension sends that listing's address and public details (such as price history, property facts, and description text) to our backend so we can generate your report. We never extract listing photos.
• Usage for your plan. Plans include a monthly number of distinct properties. To enforce that, we record which properties you've analyzed this month and a count, tied to your account. We only learn about listings you actively analyze — not pages you merely browse.
• Billing information (paid plans only). Payments are processed by Stripe. Your card details go directly to Stripe and never touch our servers. We store your subscription status and a Stripe customer reference so we can apply your plan.
• Invite codes. If you join via a beta invite code, we record that it was redeemed so we can grant your access.
• Limited abuse-prevention data. When you run a search, and when you submit the waitlist or feedback forms, we store a one-way keyed hash of your IP address to rate-limit and detect abuse, plus a truncated user-agent string on form submissions. We do not store raw IP addresses anywhere. The hash is computed with a secret key held only on our servers, so it cannot be reversed or matched against a list of addresses to identify you. For searches we hash a network-level prefix rather than your exact address, which is enough to spot abuse and less precise than the address itself.

What we don't do

• We don't store the names of property owners or listing agents. Curbnote reports on the property, not the people tied to it. There is exactly one narrow exception, described below.
• We don't extract or store listing photos.
• We don't track your general browsing — the extension only sends us data for listings you actively run Curbnote on.
• We don't sell, rent, or share your data.
• We don't build cross-site profiles or run behavioral advertising.
• The extension contains no analytics SDK and no tracking pixels of any kind. This website uses Vercel Analytics for aggregate page counts: it sets no cookies, does not fingerprint your device, and does not follow you to other sites. We use no advertising or cross-site tracking anywhere.

The one exception: the listing agent's name

One rule checks whether the listing agent appears on a builder's own “About” or “Team” page. That affiliation can mean a listing is not an arm's-length resale, which is worth knowing on a to-be-built home. Detecting it requires the agent's name, so we treat that name as a narrow, transient input:

• The extension reads it from the listing page and sends it with the rest of the listing details.
• Our server uses it once, to match against a committed list of builders and the agent names those builders publish on their own websites.
• It is then discarded immediately. It is not saved to our database, not written to logs, not included in the report we send back, and not part of any cache key. The report names the builder and links to the builder's page, never the agent.

This is the only place any person's name reaches our servers. You can switch it off: the extension's account panel has a “Don't send the listing agent's name” setting. With it on, the name never leaves your browser at all, and that one check stops running.

How long we keep things

Search and abuse-prevention records are deleted automatically after 90 days, except for the current month's search counts, which we keep until the month ends because they are what your plan's allowance is measured against. Diagnostic event logs are deleted after 90 days. Your account and plan details are kept until you delete your account. Property records we look up are cached against the property, not against you, and are not part of your account data.

Deleting your data

In the extension's settings, “Delete my data” removes your account, your usage history, and your billing records, and cancels any active subscription. You can also email help@curbnote.net. Waitlist emails are kept until you unsubscribe or ask us to remove them.

Questions

Email help@curbnote.net with any privacy questions.