Privacy Policy

What we store

Workspace data - projects, deals, budgets, tasks, contacts, file metadata, and searchable text passages extracted from supported documents - lives in a Cloudflare D1 database. Uploaded files (walkthrough photos, receipts, documents) are stored in Cloudflare R2 object storage. Extracted passages are used to answer workspace questions with source links. Every record and passage is tied to your workspace and isolated from other workspaces.

Sign-in & identity

You sign in with email and password or Google (Firebase Authentication). We store your user id, name, email, and a one-way password hash (never the plain password) so we can associate you with your workspace and team invites.

Newsletter & marketing communications

If you voluntarily sign up for Rehabfolio guides, we store your normalized email address, the page and form where you signed up, your consent time, and your subscription status. We use that information only to send the Rehabfolio guides and related product education you requested. Every marketing email includes a notification settings link and a one-click unsubscribe link that works without signing in. The confirmation page can turn those emails back on. That link stops the guide emails, the getting-started notes sent to a new account, a reminder if checkout is left unfinished, and product update emails. Product update emails also have their own unsubscribe link, which stops only those notes. Registered users can turn getting-started notes, product update emails, the morning digest, and workspace alerts on or off in notification settings. Guide mail is separate from the workspace morning digest, which has its own unsubscribe link. You can also contact [email protected].

Analytics and advertising measurement

We record first-party, anonymous product events - page views and call-to-action clicks - in our own database to understand which features get used. Our public marketing pages use Google Analytics (GA4) to measure page performance.

When Meta advertising measurement is configured, public marketing pages and sign-in pages load the Meta (Facebook) Pixel. That pixel sets cookies, including _fbp and _fbc, and records a page view on each public route change. It also records standard conversion events for a completed registration, the start of paid checkout, and a confirmed paid subscription (plan price and currency only). The same registration, checkout, and purchase events are sent from our servers to Meta's Conversions API, using a shared event id so Meta can count the browser and server events once. Email addresses are normalized and hashed with SHA-256 before they are sent. A name entered at registration is split into first and last name and hashed the same way. A hashed account id is included when an account exists. A phone number, city, state, postal code, or country is included only when we already have it, and those values are hashed too. The pixel and server events run on rehabfolio.com only. These events do not include workspace records, deal numbers, tenant details, or other financial data. Signed-in product pages are not tracked beyond the checkout and purchase events. If the pixel is not configured, the script does not load and no events are sent.

When a workspace authorizes tenant, contractor, lender, or investor access, we store the recipient's verified email, role, access grants, login history, and portal activity. External accounts use time-limited email sign-in links and can lose access when the workspace revokes a grant or ends the underlying relationship.

AI processing

Content you submit to AI features (listing text, photos, receipts) is processed by third-party AI providers acting on our behalf. Details are on the AI disclosure page.

What we never do

• Sell your personal data or workspace data.
• Share workspace records with anyone other than the infrastructure providers required to run the service (Cloudflare, and AI providers only when you use AI features). When Meta measurement is configured, Meta receives only the advertising events described above.
• Use your deals, comps, or numbers to train models.

Changes to this policy

We may update this policy as the product evolves. Material changes will be posted on this page with a new date.

Contact

Questions or deletion requests: [email protected].