Privacy Policy

Who we are

Property Pencil is a rental property investment analyzer available on the web, iOS, and Android. In this policy, "we" and "us" mean the operator of Property Pencil, and "the app" means the Property Pencil application and this website.

Your deal data stays on your device

Everything you enter to model a property — purchase price, financing terms, rents, operating expenses, tax rates, and the property profile — is stored only on the device you entered it on:

• Web: your browser's localStorage.
• iOS: the app's own storage (NSUserDefaults).
• Android: the app's own storage (SharedPreferences).

We use accounts for sign-in and plan access, but have no database of your analyses. We cannot see your deals, recover them for you, or sync them between your devices — a deal entered on the web app is not on your phone. Clearing browser data or uninstalling normally removes the local copy. Your operating system may preserve backups, especially on iOS; you manage those in system settings. Android excludes app preferences, files and databases from backup and transfer.

The PDF report the app generates is produced on your device and downloaded or printed from there. It is not uploaded to us.

What we do collect

1. Feedback you choose to send

If you use the in-app feedback button, submitting the form sends us:

Please note that the screenshot captures whatever was on screen, which will normally include the property figures you had entered. This is the only route by which your deal figures can reach us, and it only happens when you deliberately submit feedback. If you would rather not share those figures, close the feedback dialog and email us instead.

Feedback is stored in Google Cloud Firestore. It is write-only from the app: neither you nor any other user can read submitted feedback back out.

2. Waitlist signups

If you submit your email address on this website, we store your email address, the time of submission, your browser's user-agent string, and the referring URL — the last two so we can tell which referral sources bring people here. We use your address only to tell you when early access opens and to send occasional updates about the product. There is an unsubscribe link in every message.

So that we see new signups, your browser also sends the same details, plus the time and which form you used, to FormSubmit (formsubmit.co), a form-relay service that emails them to our business inbox. FormSubmit handles them under its own terms and may keep a copy for a limited time. When you ask us to delete your signup, we also delete that notification email.

3. Anonymous usage counts

Only if you enable usage sharing in Privacy & support, the app records a small set of events: the app opening, a report or spreadsheet being exported, the plan panel being opened, an upgrade prompt being shown, and a second deal being created. Each record contains only the event name, whether you are on the free or a paid plan, and a random identifier for that visit — one page load on the web, one launch of the app on a phone.

The event payload contains no property figures or direct contact details — no email address, no address, no figures, no licence key, and no identifier that outlives the visit. Because that identifier is discarded when you close the tab or the app, the event payload does not carry a persistent identifier. Authenticated requests and provider security logs may be associated with your account. There is no third-party analytics service and no advertising identifier. Like feedback, these records are write-only from the app. Sharing is on unless you turn it off, which you can do at any time under Privacy & support in the app. Our retention target is 90 days; see the retention section below.

4. Property lookups (Professional plan)

If your plan includes property lookups and you tap Look up, the app sends our lookup service the property address you entered, together with your signed plan access (from your account, or a web licence key) so the service can check what your plan allows. If you then ask for rent comparables, it also sends the bedrooms, bathrooms and square footage of one unit. Nothing else from your deal is sent — not your price, rent, financing or any other figure.

The service passes the address and unit details to RentCast, Inc., which returns the public record and nearby rental listings. It asks RentCast not to keep the request in its logs.

The service keeps two things: a monthly count of lookups for each licence, stored against a one-way hash of a web key or account identifier, so it can enforce the plan's monthly allowance; and the lookup results, which are public-record and listing data, so a repeat lookup of the same address is answered from that copy. Copies expire at 30 days; our deletion target is also 30 days, as explained below. It keeps no log of who looked up which address.

5. Accounts, website payments and abuse prevention

Firebase Authentication processes your email, password credentials and account ID for sign-in, verification and password recovery. We store account plan access in Firestore. Saved analyses are separated by account on your device; creating an account does not upload or synchronize them. Passwords are not stored in our application database.

Stripe processes website payments and retains transaction records. Our service stores the Stripe customer identifier and signed plan access against your account, and verifies subscription status to grant or remove paid features. We do not receive full card details. The mobile apps contain no payment checkout.

Firebase App Check uses Apple App Attest/DeviceCheck, Google Play Integrity, or web reCAPTCHA Enterprise to check app/device authenticity and protect requests. Google and Apple process app/device identifiers, integrity signals and network information for security. This is separate from optional usage analytics and is not advertising tracking.

6. Ordinary technical requests

Loading the app or this website makes requests that reveal your IP address and user-agent string to the companies serving them. Specifically:

• Google Firebase Hosting serves the site and app and keeps standard server request logs.
• Railway serves the lookup service, for property lookups, account deletion and website billing, and keeps standard request logs: the time, your IP address and user-agent string, and which kind of lookup it was — not the address you looked up.
• Google (www.gstatic.com) serves the Firebase software library, and Firestore checks its connection with www.google.com. These requests go to Google directly from your device. Our typefaces are served from our own site.
• Google reCAPTCHA runs on the web app, the waitlist and the account page to check that requests come from a real browser. It loads from www.google.com and www.gstatic.com (its own hidden frame also downloads a font from Google's font service), collects browser and device signals for that check, and may set a security cookie on google.com. The Google Privacy Policy and Terms of Service apply.
• Google Cloud Firestore receives feedback and the usage counts above. In the iOS and Android apps, Google's Firestore library sends basic device information with those requests — the operating system version and device model — which Google uses to see which versions of its library are in use, and does not link to you or your device.

What we do not do

• No third-party analytics or telemetry service. The only usage measurement is the anonymous counts in section 3, which we keep ourselves.
• No advertising, no ad networks, no advertising identifiers.
• No third-party trackers or tracking pixels. Our sites set no cookies; the only third-party cookie is reCAPTCHA's security cookie described above.
• No selling or sharing of personal information, in any sense including the one used by the California Consumer Privacy Act.
• No location data, contacts, camera, microphone, or photo library access.

The app uses local storage for analyses, plan access and your usage-sharing preference. This website remembers early access locally. reCAPTCHA Enterprise may use storage and device/network signals for abuse prevention.

Who processes the data

Google LLC processes data via Firebase Hosting, Authentication, Cloud Firestore, and the Firebase library. Their handling is governed by Firebase's privacy documentation and Google's privacy policy.

Railway Corporation runs lookup and account/billing services, Neon stores its lookup counts and cached results, and RentCast, Inc. receives the address and unit details you look up and supplies the data. Stripe processes website payments. Apple and Google provide app attestation. FormSubmit relays waitlist signups to our email inbox, as described in section 2.

Data may be processed on servers in the United States. We do not transfer your data to anyone else.

Account deletion

Delete your account in the app under Plan → Account settings, or use the website account deletion page. Deletion requires your password, cancels website billing, removes sign-in and plan access, and clears this account’s local data when initiated in the app. Remove saved data on other devices and previously exported files separately. A minimal deletion marker prevents delayed billing events restoring access; its deletion target is 30 days. Stripe retains records required for tax and legal purposes. Contact the support address below if you cannot sign in.

How long we keep it

The periods below are our retention targets. Automatic cleanup is not yet enabled, so records may remain longer. You can request deletion using the contact below; required transaction records are subject to Stripe's legal obligations.

• Account and billing access: until account deletion; deletion markers for 30 days. Stripe transaction retention follows its legal obligations.
• Feedback: scheduled for deletion after 180 days, or sooner when a deletion request can be matched.
• Waitlist emails: scheduled for deletion after 365 days, or sooner on unsubscribe or deletion request. The signup notification in our inbox is deleted on request; FormSubmit's copy follows its own terms.
• Optional usage counts: scheduled for deletion after 90 days.
• Server logs: retained per Firebase Hosting's default retention, and for property lookups per Railway's.
• Lookup counts: one number per licence per month, held to enforce the monthly allowance; deleted after 13 complete months.
• Cached lookup results: public-record and listing data, targeted for deletion after 30 days.
• Your deal data: not applicable — we never receive your figures. A property lookup sends only the address and unit details described above.

Once automatic cleanup is enabled, it will run daily, so a record may remain up to 24 hours past its stated period.

Your rights

You can ask us to tell you what we hold about you, correct it, or delete it. For waitlist data, please write from the address you signed up with. For account or billing requests, write from your account email (never send payment details). Feedback submissions carry no identifier at all — if you want one deleted, tell us roughly when you sent it and what it said.

Depending on where you live, you may have specific rights under the GDPR, the UK GDPR, or the CCPA. We honour those requests regardless of where you live. We will not discriminate against you for exercising them.

Children

Property Pencil is a tool for real estate investors and is not directed at children. We do not knowingly collect personal information from anyone under 13. If you believe a child has sent us information, contact us and we will delete it.

Changes to this policy

If we change what we collect, we will update this page and move the date at the top. For material changes we will say so on the website rather than change it quietly.

Contact

Questions, requests, or corrections: privacy@propertypencil.com