Privacy

Curbnote is about properties, not people. The browser extension surfaces public-record red flags on real estate listings you choose to analyze, and the address check on this site does the public-records part for an address you type or a listing link you paste. This page explains what we collect to provide that, what we deliberately don't do, and how to delete everything.

What we collect

• Your account email. You sign in with a one-time code sent to your email (handled by our authentication provider, Supabase). We use it to identify your account and contact you about the service.
• Listing details you analyze. When you run Curbnote on a listing, the extension sends that listing's address and public details (such as price history, property facts, and description text) to our backend so we can generate your report. We never extract listing photos.
• Addresses you check on this site. When you use the address check at curbnote.net/check, your browser sends us the address you typed or the address read from the listing link you pasted, and the listing link itself if you pasted one. A pasted link is read for its address only; we never fetch the listing page. The site keeps a random device identifier in your browser's local storage and sends it with each check; it is not tied to your name or email, and clearing the site's data in your browser resets it. Checks made without signing in are counted against a free allowance by that device identifier and by the keyed hash of your IP address described below; they are never tied to an account. If you sign in on the site, it is the same account and the same one-time-code sign-in as the extension, and your checks count toward that account's usage like any other search.
• How you found us. If you arrive from a tagged link (for example one we posted on Reddit or gave to a homebuyer counselor) or from another website, the site remembers that tag, or the other site's name without the page address, in your browser's local storage for 30 days and sends it with your checks. That tells us which places send people to Curbnote. Under a result we may ask once how you heard about Curbnote; your answer is one choice from a fixed list, stored with the site's device identifier, never with your name or email.
• Usage for your plan. Plans include a monthly number of distinct properties. To enforce that, we record which properties you've analyzed this month and a count, tied to your account. We only learn about listings you actively analyze, not pages you merely browse.
• Billing information (paid plans only). Payments are processed by Stripe. Your card details go directly to Stripe and never touch our servers. We store your subscription status and a Stripe customer reference so we can apply your plan.
• Invite codes. If you join via a beta invite code, we record that it was redeemed so we can grant your access.
• Waitlist signups.If you leave your email on this site to hear when Curbnote is available, or to have us email you the install link to open on your computer, we store that email address, plus the abuse-prevention data described below. If you sign up through one of our lead forms on Facebook or Instagram, Meta sends us what you submitted: your email address and your answers to the form's two questions (where you are in your home search, and which area you're looking in). With it we receive Meta's reference number for the submission, whether it came from Facebook or Instagram, and the names of the ad, campaign, and form it came from, so we can tell which ads people responded to. We use waitlist emails to send the install link when you ask for it, to tell you when the beta opens, and to send occasional product updates. You can unsubscribe at any time.
• Limited abuse-prevention data. When you run a search (in the extension or on this site's address check), when the address check looks up an address you typed, and when you submit the waitlist or feedback forms, we store a one-way keyed hash of your IP address to rate-limit and detect abuse, plus a truncated user-agent string on form submissions. We do not store raw IP addresses anywhere. The hash is computed with a secret key held only on our servers, so it cannot be reversed or matched against a list of addresses to identify you. For searches we hash a network-level prefix rather than your exact address, which is enough to spot abuse and less precise than the address itself.

What we don't do

• We don't store the names of property owners or listing agents. Curbnote reports on the property, not the people tied to it. There is exactly one narrow exception, described below.
• We don't extract or store listing photos.
• We don't track your general browsing. The extension only sends us data for listings you actively run Curbnote on.
• We don't sell, rent, or share your data.
• We don't build cross-site profiles, and nothing we collect about you is used to target ads.
• The extension contains no analytics SDK and no tracking pixels of any kind. This website uses Vercel Analytics for aggregate page counts: it sets no cookies, does not fingerprint your device, and does not follow you to other sites. Curbnote runs ads on Facebook and Instagram, but there are no ad pixels or cross-site trackers on curbnote.net or in the extension.

The one exception: the listing agent's name

One rule checks whether the listing agent appears on a builder's own “About” or “Team” page. That affiliation can mean a listing is not an arm's-length resale, which is worth knowing on a to-be-built home. Detecting it requires the agent's name, so we treat that name as a narrow, transient input:

• The extension reads it from the listing page and sends it with the rest of the listing details.
• Our server uses it once, to match against a committed list of builders and the agent names those builders publish on their own websites.
• It is then discarded immediately. It is not saved to our database, not written to logs, not included in the report we send back, and not part of any cache key. The report names the builder and links to the builder's page, never the agent.

This is the only place any person's name reaches our servers. You can switch it off: the extension's account panel has a “Don't send the listing agent's name” setting. With it on, the name never leaves your browser at all, and that one check stops running.

How long we keep things

Search records, including the hashed network prefix stored with each search, are deleted automatically after 90 days, except for the current month's search counts, which we keep until the month ends because they are what your plan's allowance is measured against. The rate-limit counters for the waitlist and feedback forms are deleted after a day. Waitlist signups and feedback submissions are kept until you unsubscribe from the waitlist or ask us to delete them, and the hashed IP and user-agent string stored with an entry are kept with it and deleted along with it. Diagnostic event logs are deleted after 90 days. Your account and plan details are kept until you delete your account. Property records we look up are cached against the property, not against you, and are not part of your account data.

Deleting your data

In the extension's settings, “Delete my data” removes your account, your usage history, and your billing records, and cancels any active subscription. The address check's device identifier lives only in your browser: clearing this site's data removes it, and the anonymous search records it was counted under are deleted after 90 days like every other search record. You can also email help@curbnote.net. Waitlist entries, including those that came from a Facebook or Instagram lead form, are kept until you unsubscribe or ask us to remove them.

Questions

Email help@curbnote.net with any privacy questions.