Privacy Policy
Last updated 2026-11-14 · Operator: Hatchling Creative, LLC
This policy explains how Realistate handles information when you use our website and account features.
Information used to provide the app
- Searches and locations: addresses you type, map positions, commute destinations, and route endpoints are used to provide maps, address suggestions, and directions. If you choose “Find my location,” your browser asks for permission before providing your location.
- On your device: saved searches, onboarding status, and your analytics choice are stored in your browser. Searches can appear in URL fragments, browser history, and links you choose to share. Shared links may contain addresses and preferences.
- Accounts: when you create an account, we store your email address, display name, creation time, email-verification status, a salted Argon2id password hash, and feature-access permission. We do not store your password in plain text. Authentication uses secure session cookies, and temporary cookies support sign-in and invitation links.
- Access preferences: an invitation link may enable optional place categories for a new account. A feature permission describes access to a tool; it is not a statement about your beliefs. Administrators can enable or revoke access.
- Service requests: hosting and third-party providers receive technical details such as IP address, request time, browser information, and requested resources when serving the app.
Third-party services
The app sends relevant search text, coordinates, or route endpoints directly to Google Maps Platform, Photon (komoot), or the public Valhalla routing service, depending on the feature and availability. The base map loads from Google Maps. Google Fonts receives requests when fonts load. Cloudflare hosts the production site and account database. Cloudflare Email Service receives your email address and verification or password-reset link to deliver account emails. Links to Zillow, Google Maps, and other external sites are governed by those providers’ policies.
Public data files, such as NOAA temperature normals, are served from our site. Opening a public data file is different from sending a location to a routing or geocoding service.
Optional analytics
Usage analytics are off until you choose “Allow analytics.” With consent, we count page views and selected API request events. These events do not include entered addresses, coordinates, search terms, account identifiers, or the invitation parameter. Counts are aggregated by day and event type. We may enable Google Analytics to understand usage; it loads only after consent. Our page-view event omits URL parameters and fragments. Google may process device and network information and use analytics cookies. Advertising signals and ad personalization are disabled in our integration.
You can change your choice in Account → Privacy choices. Turning analytics off stops future events from this app; browser settings can remove existing cookies. Core map and login functions do not require analytics consent.
How we use and share information
We use information to provide searches and accounts, administer feature access, operate and secure the service, and understand consented usage. We do not sell account or search information or use it for targeted advertising. Service providers receive the information needed for their functions. Information may also be disclosed when required by law or to protect the service and its users.
Retention and deletion
Saved searches remain on your device until you delete them or clear site storage. Accounts remain until deleted. Sessions expire after 30 days; email verification links expire after 24 hours and password-reset links after 30 minutes. Expired records are removed by a daily cleanup job. Our aggregate event counts and access-change audit records are retained for up to 90 days. Hosting logs, provider records, and Google Analytics retention follow the relevant provider configuration and policies.
Signed-in users can delete their account in Account → Delete account. This removes the account, sessions, verification/reset tokens, and associated access audit entries from our active database. It does not erase browser-saved searches, previously aggregated counts, third-party records, or records retained in provider backups until they expire.
Your choices and requests
You can use the app without an account, decline analytics, decline location permission, delete saved searches, and clear browser storage. Depending on where you live, you may have additional rights to access, correct, delete, or receive a copy of information. Contact us to make a request; we may need to verify your identity.
Children and international use
Realistate is intended for adults researching places to live and is not directed to children under 13. Please contact us if a child has provided account information. Our service is focused on the United States; providers may process information in other countries.
Security and changes
We use HTTPS, restricted administrator access, and expiring sessions. No system can guarantee complete security. We will update this page when practices change and update the date above.
Contact
Hatchling Creative, LLC · info@realistate.app