Privacy Policy
This policy explains what HiddenLots LLC ("we", "us") collects when you use HiddenLots (the "Service"), why, who we share it with, and what you can do about it.
1. What we collect
- Account details: your sign-in email address, the name you give us, and a hashed version of your password. We never store the password itself.
- Contact details you add in Settings: phone number, mailing address, and an optional separate email for owner letters. We print these on the letters you generate so owners can reach you, and use them to contact you about your account.
- Your agreement to our Terms: the date and version you accepted when you signed up.
- What you set up in the app: the counties you watch, leads and parcels you save, dismiss or mark as contacted, your notes, your saved searches, and your alert settings (score threshold, push topic, email preference, optional webhook).
- Usage logs: standard server logs such as IP address, browser type, pages requested and timestamps, kept for security and troubleshooting.
- Payment status: your plan, trial and renewal dates, and a Stripe customer reference. Card details go directly to Stripe; we never see or store your card number.
2. Why we use it
- to run the Service for you — pulling records and posts for your counties, scoring them, and sending the alerts you asked for;
- to bill you and manage your subscription;
- to answer your questions and keep the Service secure;
- to send service emails, such as password resets, receipts, trial reminders and important notices;
- to send occasional product updates from HiddenLots LLC, which you can turn off in Settings;
- to keep a customer record — including exports to spreadsheets we use internally — so we can support you, reconcile billing, and meet our legal and tax obligations.
We don't sell your data, don't use it for advertising, and don't build profiles of you for anyone else.
3. Who we share it with
Only the companies that help us run the Service, and only what they need:
- Stripe — payments, subscriptions and receipts.
- Railway — the servers and database the Service runs on.
- Resend or an SMTP provider — delivering email we send you.
- ntfy — delivering push notifications, if you set up a push topic. Alerts are sent to the topic name you choose; keep that name private.
We don't sell personal data. We may disclose information if the law requires it or to protect the rights and safety of our members or the public.
4. Property-owner information
The Service shows owner names and mailing addresses for parcels. That information comes from government assessor and parcel records that are public by law, and we show it as the counties publish it, labeled with the tax-roll year it comes from. We don't verify it and don't add to it. If you are a property owner and have a question about how your public record appears in the Service, contact us and we'll help where we can; corrections to the record itself have to be made with the county.
Reply pages. Letters members print carry only the member's own name, phone and email — no link or code. A member may separately share a reply page unique to the parcel. If you open it, we record that the page was viewed and, if you answer, your answer (open / maybe / not now / never contact me), the asking price, name, contact details and message you choose to type, and the time. The page identifies the parcel, never the member. Your answer and any contact details you give are shared only with the members who had already asked for a letter to you about that parcel; if more than one member wrote, each of them receives it. Members who ask for a letter later see only that the owner responded. Your answer is kept for as long as the parcel is in the Service so it can be honored.
"Never contact me." If you tell a member, tell us, or choose this on a reply page, we withhold your name and mailing address from every member for that parcel and for every other parcel listed under the same owner name and mailing address, remove them from mailing-list exports, letters and the deal boards, and keep that flag indefinitely, including across re-pulls of the county record. Members can't undo it; contact us if you change your mind.
5. Cookies
We use one cookie: a signed session cookie that keeps you signed in. We don't use advertising or cross-site tracking cookies. The app may also keep small conveniences on your device, such as a remembered filter, which never leave your browser.
6. How long we keep it
We keep your account data for as long as your account exists. Server logs are kept for a limited period for security purposes and then deleted. When you delete your account, we delete your account details, saved items, notes and settings within 30 days, except for records we must keep for tax or legal reasons.
7. Your choices
- Update your email, contact details, alerts, product-update preference and password at any time in Settings.
- Cancel your subscription from Billing.
- Ask us for a copy of your data, or ask us to delete your account and data, by emailing support@hiddenlots.com. We'll confirm your identity and respond within 30 days.
- If you live in a place with specific privacy rights (for example, the right to know, correct, delete or opt out), you can exercise them the same way.
8. Security
Passwords are stored as salted hashes. Traffic to the Service is encrypted. Access to production systems is limited to people who need it to run the Service. No system is perfectly secure; if we learn of a breach that affects your data we'll notify you as the law requires.
9. Children
The Service is for adults. We don't knowingly allow anyone under 18 to create an account, and we delete accounts we learn belong to minors.
10. Changes
If we change this policy in a meaningful way we'll email you or post a notice in the app before it takes effect.
11. Contact
HiddenLots LLC · support@hiddenlots.com