Last updated: August 25, 2026
This Privacy Policy explains what information MyProperties collects, how it's used, who it's shared with, and the choices you have. By using this application, you agree to the practices described here.
Account information: username, email address, and a hashed (never plaintext) password.
Property and financial data you enter: property addresses, purchase price and date, current valuation, county assessor links, tags/folders, rental income entries, expense entries and categories, maintenance records, escalator and appreciation assumptions, saved analysis scenarios, property manager portal links, and any notes you add.
Billing information: if you upgrade to a paid plan, Stripe collects and processes your payment card details directly — we never receive or store your full card number. We do store your Stripe customer ID, subscription plan/tier, and subscription status so the app knows what you're entitled to.
Sharing/collaboration data: if you invite another user to view your portfolio, we store the invitation's scope (which properties and sections are shared), its status, and the invited user's account once they accept.
Automatically collected data: standard server logs (IP address, browser user agent, request timestamps) generated by our hosting provider (Vercel) for security and debugging purposes.
We do not use your data to train AI/machine learning models, and we do not sell it to data brokers or advertisers.
We do not sell your personal information. We share data only with:
We do not integrate with or transmit your data to Zillow, Redfin, Google, or your property manager's portal. Where the app links out to those services (e.g., a valuation lookup or portal login button), it opens a new browser tab under your control — no data is sent to us or through us in that process.
Passwords are hashed with bcrypt and never stored in plaintext. Sessions use signed tokens with server-side revocation. All traffic is encrypted in transit via HTTPS. Access to the underlying database is restricted to the application's server-side code — property and financial data is never exposed to other users' accounts except through a sharing invitation you've explicitly created and the recipient has accepted.
No method of transmission or storage is 100% secure. While we follow standard industry practices, we cannot guarantee absolute security.
We retain your account and property data for as long as your account is active. If you delete a property, its associated income, expense, and maintenance records are deleted with it. If you delete your account (by contacting the site owner), your account and associated data are removed from our active database, subject to any residual copies retained in routine backups for a limited period before they age out, and any records we're legally required to retain (e.g., billing records for tax purposes).
If you are located in a jurisdiction with statutory privacy rights (e.g., the EU/UK under GDPR, or California under the CCPA/CPRA), you may have additional rights to access, correct, delete, or restrict processing of your personal information, and to lodge a complaint with a supervisory authority. Contact the site owner to exercise these rights.
We use strictly necessary cookies only: one to keep you signed in (session authentication) and, where applicable, one to remember plan-related state. We do not use third-party advertising or tracking cookies.
This service is not directed to children under 13 (or the relevant minimum age in your jurisdiction), and we do not knowingly collect personal information from children.
We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date above. Continued use of the app after changes constitutes acceptance of the updated policy.
Questions about this policy or your data? Email us at erra.bot@errabot.com.
This policy describes the actual data practices of this application as built. It is provided as a good-faith, comprehensive description, not a substitute for review by a licensed attorney — have it reviewed by counsel before relying on it for a public or commercial launch, especially if you'll have users in jurisdictions with specific statutory requirements (GDPR, CCPA, etc.).