Privacy

The address you type

When you search for your property, the address goes two places. First to a geocoding service (Nominatim, run by OpenStreetMap, or Mapbox) to turn it into a latitude and longitude. Then the house number and street name are sent to our own parcel lookup, so we can pick the right lot out of the county records instead of guessing from the coordinates.

Those two requests are logged differently, and the difference is worth spelling out. The geocoder gets the address in the web address of the request, so it lands in that company's logs the same way every URL does — that is a third party, and its policy governs, not ours. Our own parcel lookup gets it in the body of the request instead, which is not part of the URL, so what our host writes down for that call is your IP address, the time, your browser's user-agent string and the fact that a lookup happened — not the address itself.

That is a real difference, and it is not the same as us being unable to see it. The address is in a request our server handles, so our code sees it in transit and a future version of that code could write it down; we don't, and there is no database, no profile and no name to attach it to, because there are no accounts. Vercel, our host, still logs the request itself under its own retention policy, and those records are copied onward — see “Third parties” below. We'd rather say all of that plainly than tell you nothing is stored.

Your fence plan

The plan you draw is saved in your browser's local storage on your device. One thing takes it off your device, and it is something you ask for: creating a share link, which encodes the plan into a URL you choose who to send to. Nothing else does.

A share link is self-contained: the whole plan — including the owner name, phone number and address you typed into the permit fields — is packed into the part of the link after the #. Browsers never send that part to a server, so opening one does not tell us anything and does not put your details in our logs. It does put them in the link itself, which means in your browser history, in whatever you paste it into, and in the hands of everyone you send it to. Treat it like the plan it is.

Analytics

We count pageviews ourselves rather than through an analytics company. Opening a page sends one short message to factscore.mrcto.ai — another site we run — saying which page you opened and which page you came from. No cookies, no cross-site tracking, no advertising identifiers, and nothing about the fence you drew.

A few moments in the tool itself are counted the same way. When your permit packet PDF finishes generating, we send a short message saying that a packet was produced, which city you picked, and whether county lot lines were found for your lot. We also send the name of the step alone when a lot is located, when a fence is finished, when the download menu is opened, when a packet is asked for, and when the print dialog is opened — plus, for the lot, whether lot lines were found, which county dataset answered, and which US state your search resolved to, as a two-letter code and nothing finer. And when you download the filled-in city permit form or the neighbour consent letter, we send which of the two files it was, and the city for the permit form.

If you made a permit packet on this device, we ask you one question — whether your city accepted it — and we send the name of the step alone: when you tell us your city accepted the packet, when you tell us your city rejected it, and when you tell us you have not heard back yet, together with which city you picked. Answering is optional, there is no free-text box, and nothing about the answer beyond those three states leaves your device. To avoid asking twice we keep a small record on your device of the city you made the packet for and what you last answered; it is the third and last thing we write to your browser's local storage, after the plan and the identifier below. We ask because whether a building department accepts these packets is the one thing about this product we cannot find out on our own.

On the page for building departments, clicking the button that opens an email to us sends one short message saying that button was clicked. It carries nothing else. Your email itself goes through your own mail program and never touches this site, so we cannot see what it says, or whether you send one at all.

None of those messages carries your address, your name, the fence you drew, or the parcel number, and none of them carries any of the PDFs — those are assembled in your browser and never sent anywhere. We count these because otherwise we cannot tell the difference between someone who got a plot plan, someone who tried and stopped, and someone who only looked at the page.

That message carries a marker we set on your device, so it is worth naming precisely: the first time you visit we generate a random identifier and keep it in your browser's local storage, so that several pages in one sitting, and a visit next week, count as one person rather than as strangers. It is a random number attached to nothing else — not your address, not your plan, not an account — and because it is stored per site it cannot be used to follow you between ours. Clearing your site data deletes it.

Third parties

The map view loads satellite imagery tiles from Esri. Geocoding uses Nominatim (OpenStreetMap) or Mapbox — whichever one runs your search receives the address you typed, in the URL, and logs it. The site is hosted on Vercel, which logs every request to it — the URL that was requested, your IP address, the time and your user-agent — and those log records are forwarded to Datadog, a log-monitoring service we use to watch for errors and abuse. Datadog therefore holds a copy of the same request records Vercel does, under its own retention terms. Each of these companies sees the requests your browser makes and handles them under its own privacy policy, not ours.

What we never do

No accounts, no sign-up, no selling or sharing of data, no ads.

Questions

Email t@mrcto.ai.