Privacy Policy

1. Account Creation

When you create an account, we store your email address and a cryptographically hashed password. Passwords are never stored in plaintext. Authentication data lives in Supabase (hosted on AWS) and is encrypted at rest using AES-256.

2. Portfolio Data

You may voluntarily save the following property details to your account:

• Property addresses and nicknames
• Loan balances, interest rates, and remaining terms
• Monthly rent, expense ratios, and vacancy assumptions
• Purchase price and current estimated value
• Free-form notes you enter

This data is stored in your private Supabase row, protected by row-level security policies so that only your authenticated session can read or write it. We never sell, rent, or share your portfolio data with third parties. We do not use your entries to train models or generate market benchmarks.

3. Analysis History

When you save an analysis from FlowSignal, Hold vs. Sell, or RefiSignal, we store the inputs you entered and the calculated outputs so you can revisit them in your portfolio. These analyses are scoped to your account under the same row-level security policies as portfolio data.

4. Market Data

To power our map, calculators, and rate widgets, we ingest and cache publicly sourced datasets:

• Zillow ZORI (rents) and ZHVI (home values)
• US Census Bureau American Community Survey (ACS)
• US Bureau of Labor Statistics (BLS)
• Federal Reserve Economic Data (FRED)

These datasets contain no personal information about you. We use them to display market context and to pre-fill sensible defaults inside the tools.

5. Your Rights

You can, at any time and without contacting us:

• Export your portfolio and analysis history from Account Settings.
• Delete your account and all associated data from Account Settings.

Residents of California (CCPA/CPRA) and the European Union (GDPR) additionally have the right to request a copy of their data, to correct it, and to be forgotten. The controls above satisfy those rights; email us if anything is unclear.

6. Data Retention

We retain your data for as long as your account remains active. When you delete your account, all portfolio data, analysis history, profile records, and your authentication record are permanently deleted within 30 days.

7. Cookies & Analytics

We use only strictly-necessary session cookies required to keep you signed in. We do not run third-party advertising, tracking pixels, or cross-site behavioral analytics.

8. Security

All traffic is served over TLS. Data at rest is encrypted with AES-256. Access to production systems is restricted to authorized engineers using multi-factor authentication. If we become aware of a breach affecting your data, we will notify you without undue delay.

9. Changes to This Policy

If we make material changes, we will update the "Last updated" date above and, where required, notify you by email.

10. Contact

Questions or requests: privacy@signalhq.co

Applied Decision Systems LLC