Privacy Policy

1. What we collect

Account data: your email address and sign-in identity, managed by our authentication provider (Clerk).

Usage data: metered counts of detailed location views, portfolio assets scored, and API requests, kept to enforce plan quotas and show you your own usage.

Content you upload: portfolio CSV files (asset coordinates or addresses) that you submit for analysis.

Saved locations, report snapshots and team settings: the locations you choose to save, reports you create, organization membership and configuration needed to provide these features.

Search queries: addresses you search are sent to a geocoding provider (Mapbox, with OpenStreetMap Nominatim as fallback) to resolve coordinates.

2. Essential storage and optional analytics

We do not sell personal data or run third-party advertising. Essential cookies and browser storage support authentication, application preferences and your privacy choice.

PostHog analytics is optional and is not loaded until you choose “Allow optional analytics”. It measures visits to public marketing and blog pages only. We disable session recording, automatic click/form capture and person profiles, use in-memory analytics identifiers, and remove query strings and fragments. Searches, coordinates, portfolio contents, report tokens, account pages and sign-in identities are not sent as analytics event properties.

Choose “Essential only” to keep optional analytics off without losing app features. Change or withdraw your choice through “Privacy settings” in the footer. We remember your choice in local browser storage for up to 180 days and respect Global Privacy Control and Do Not Track signals. Withdrawing stops future analytics; contact us about any previously submitted data.

3. Third-party services

Replit provides hosting, the database and file storage. Clerk provides authentication and session management. Stripe processes payments and subscription billing; card details are submitted to Stripe, not stored by Hexaflood.

Mapbox and OpenStreetMap Nominatim resolve address searches; Esri/ArcGIS supplies base map tiles. HoodEx supplies on-demand terrain scoring for requested coordinates. These providers receive the information needed for the requested function, such as a search query or coordinates.

If you opt in, public-page analytics is sent to PostHog’s US endpoint. Network providers can receive connection information such as an IP address even when our event properties exclude it; location enrichment is disabled in our analytics configuration. Services may process data outside your country. Their privacy policies and contractual safeguards apply to their processing.

4. Retention and deletion

You can delete portfolios and saved locations in the app and revoke shared report links in your account. Anyone holding an active share link can view and download that report; revocation stops future access through the link but cannot remove copies already downloaded.

We retain account and submitted content while needed to provide the service. Billing-cycle usage records and transaction records may need to be retained for billing reconciliation, dispute handling or legal obligations. Revoking a link does not itself delete the underlying report snapshot. Contact us to request account/content deletion and details of applicable retention; backups and records that must legally be retained may not be removed immediately.

5. Your rights

You can request a copy of the personal data we hold about you, ask for corrections, or request deletion at any time. If you are in the EU/EEA, you have the rights provided by the GDPR, including the right to lodge a complaint with a supervisory authority.

6. Contact

Privacy questions and requests: billtoug4440@gmail.com.