Privacy notice | ListedBy

The short version

We collect what it takes to sell a home safely: your email address, your legal name if you claim a home, what you put in your listing and your messages, and a record of who did what.
We never sell your information, and we never capture biometric identifiers. No selfies, no face scans.
Payments go through Stripe. We never see your card number.
You can ask us to show you, correct or delete what we hold about you.

What we collect, and why

When you look around

You can search, read listings and use the “What would you keep?” net sheet without an account, and we set no cookie until you sign in.
The net sheet doesn’t save your numbers in our database. With JavaScript on, your loan balance stays in your browser and out of the page’s web address.
When you look up an address to list, we search the county appraisal roll and show the owner’s name and mailing address masked to their first letters. If you use your location to find the home, your browser asks you first. We use the spot to find nearby parcels, and if you then enter the home by hand, it becomes the home’s map pin.
Our host, Cloudflare, handles every request and sees your IP address in order to deliver the page. We count requests per IP address to stop abuse.
To learn what helps people, each page reports to our page counter which page it was, where the visit came from (another site, one of our emails, a yard sign) and a few things done there, such as a home saved or a tour asked for. Never your name, email address, a street address, your messages or the numbers you type.
The page counter is Plausible Analytics, open-source software we run ourselves, reached through this site’s own address. Our server passes it only your IP address and your browser’s name, so it can count daily visitors and tell which city a visit comes from. No cookie, and nothing kept in your browser. For counsel — confirm: The page counter runs on an analytics server the founders operate, not on an account of the company's own. Confirm "we run ourselves" is right for that arrangement, or name who runs it; and whether to say that the counter keeps no IP address (it counts a visitor by a hash that changes daily).
If your browser sends Do Not Track or Global Privacy Control, your pages report nothing at all.
Our server also counts a few things as they happen, such as a payment, a listing going live or a tour booked: bare numbers, with nothing about who.
When someone scans the code on a yard sign, we count the scan for that day and show the count to the home’s owner. We keep nothing about who scanned: not their IP address, not their phone.
When a person opens a home’s page, we add one to that day’s count of views, which only the home’s owner sees. We keep only the count: not your IP address, not your browser, nothing about who you are.

Your email address, to send you sign-in links and notices. Your account is created the first time you use a link.
Each sign-in link works once, for 15 minutes. We keep only a keyed hash of it.
Your sign-in: a random token in one cookie. We keep only a keyed hash of the token, a keyed hash of your IP address (never the address itself), a rough device label such as “Safari on iPhone” (never your browser’s full identifying string), and when you signed in and were last seen.

When you claim a home

Your legal name, to compare with the owner on the county appraisal roll, and your role: owner, spouse, recent buyer, trustee, company officer, executor or heir.
The statement you confirm and the agreements you accept: which version, a fingerprint of the exact words, when, and a keyed hash of your IP address.
The county roll’s record for the home, including the owner’s name and mailing address as the appraisal district publishes them. We keep a copy with your claim and use it to address your postcard and check your name. You see the owner’s name and mailing address only masked.
The postcard: the name and address it went to, when, and the mailing company’s reference. The code on the card is never stored, only a keyed hash of it.
Papers, if we ask for them: a recorded deed, a certificate of trust, a Comptroller report and a company resolution, letters from a probate court, or a recorded affidavit of heirship. They’re kept in private storage that only our reviewers read. We never need a photo of you or of your ID.
Fraud checks: signs such as a vacant lot, an out-of-state mailing address, a company owner, or many claims from one account or one network address within 30 days. They decide whether a person reviews your claim. You don’t see them. For counsel — confirm: Claim fraud checks decide whether a person reviews a claim. Decide whether that counts as profiling that needs an opt-out.

When you build a listing

What you enter: the home’s facts, the price, the description, HOA details, showing times, what you offer a buyer’s agent, and your title-readiness answers.
Your own net-sheet numbers: loan payoffs, the tax bill and the closing month. They’re private and never appear on your listing.
Disclosure documents you upload, kept in private storage. You can open yours any time. Once your listing is live, anyone signed in can open them, and we record each time someone else does.

Photos

Your photos exactly as uploaded, in private storage. They’re deleted 30 days after upload.
The location your camera saved inside each photo. We read it first and keep it on the photo’s record, where only our reviewers see it: they use it to check that the photo was taken at the home. No page shows it.
The copies anyone can see are re-encoded without any of the hidden data your camera saved: no location, no camera details, no comments. They sit at hard-to-guess web addresses. Until your listing is live, and again once it leaves the site, only you and our reviewers can open them; while it’s live, anyone can. A photo you add to a live listing stays that private until your change goes live.
Removing a photo from a draft deletes its copies and the original from our storage at once.
We compare each photo with the photos on other listings, to catch a listing made from someone else’s photos. For that we keep only a fingerprint of each photo: two short numbers worked out from a tiny grey version of it, which can’t be turned back into the picture. If one of your photos matches a photo on another owner’s listing, only our reviewers see the two side by side.

Messages

What you write to an owner or a buyer. Every message is screened before it’s delivered (how). A blocked message keeps no words, only which rules it broke.
For each message: where in it the screen noticed something (never the words themselves), a one-way fingerprint of the words to catch copy-paste blasts, and a keyed hash of your IP address.
If you write as a buyer’s agent, your Texas license number. The owner sees it, and whether we confirmed it. We don’t check licenses against the Texas Real Estate Commission’s records yet, and the owner is told so.
Who you block, what you report and what you archive.
When a message arrives, the other side gets an email with the home’s address and a link. It carries no words from the message and nobody’s email address.

Tours

When you ask for a tour: the times you picked, and your answers to the two questions every buyer is asked, when you’re looking to buy and whether you work with an agent. If you do, your agent’s name and Texas license number.
The owner sees the time and those answers, with tour visitors numbered “Visitor 1”, “Visitor 2” and so on. Nobody sees your email address.
We email both of you the time, and send the buyer the home’s address and a calendar invitation once a time is confirmed.

Reporting a listing

What you tell us: which listing, what’s wrong and any details, and an email address only if you’d like an answer. We never show your email address to the owner.
A keyed hash of your IP address, your account if you’re signed in, and which of our postcards’ codes came with your report (never the code itself).

Saved homes and searches

The homes and searches you save, and how often you’d like to hear about a saved search. You can remove them any time.
If a home you saved has its price cut, goes under contract, comes back on the market, sells or comes off the market, we email you. Every one of those emails has a link that stops them.

Paying

Stripe runs the checkout. We send Stripe your email address and our own order and listing references, and you give your card details to Stripe directly. Stripe tells us whether you paid, the amount and tax, and its payment reference. We never see or store your card number.

The record of what happened

We log important events, such as a claim moving on, a listing going live, a payment, a refund, a message held or reported, or a disclosure opened, with who did it and when. The log can’t be edited or deleted. It’s how we can show later how an owner was verified.

What we never do

We don’t sell your information.
We never capture a biometric identifier: no selfies, face scans, fingerprints or voiceprints.
We don’t use your information for advertising. The site runs no advertising trackers and no analytics company’s scripts.
We don’t share your information with agents, brokers, lenders, title companies or insurers for their marketing. The one exception will be an owner who asks for licensed help, and then only what that owner agrees to send. That service isn’t open yet.
We don’t put agent or lender ads on your listing.

Cookies and the bot check

We set one cookie, and only when you sign in: __Host-sid. It holds a random sign-in token, and we keep only a keyed hash of it. Page scripts can’t read it, it travels only over HTTPS, it stays with this site, and it lasts 30 days from your last visit (renewed at most once a day). Signing out deletes your sign-in.

We set no advertising or analytics cookies.

When you ask for a sign-in link, when you first message an owner, when you ask for a tour, when you report a listing, and when you claim a home (until your account has verified one), Cloudflare’s bot check (Turnstile) runs in your browser. It’s Cloudflare’s service, under Cloudflare’s privacy policy. For counsel: A link to Cloudflare's privacy policy, what Turnstile keeps in the browser, and whether Cloudflare sets cookies of its own (bot management, challenges).

Buyers and the public: Your listing: the address, map pin, facts, price, photos and description. Disclosure documents go to people who are signed in, once the listing is live. Never your name, email address or phone number, unless you type them into a message yourself.
The other side of a conversation: Your messages. Owners see buyers as “Buyer 1”, “Buyer 2” and so on, and see a buyer’s agent’s license number. Nobody sees your email address.
The other side of a tour: The tour’s time. Owners also see your two answers, and your agent’s name and license number if you have one.
Our reviewers: Claims and their papers, photo locations, and messages that were held or reported.
Stripe: Payments: your email address and our order and listing references.
A print-and-mail company: Postcards: the name and address from the county roll, or the home’s address, and the code printed on the card.
An email-sending service: Your email address and the emails we send you: sign-in links, new-message notices, and tour times and reminders. For counsel: The print-and-mail company and the email-sending service, once chosen. The code has only local stand-ins today.
Cloudflare: Runs the site, stores photos and documents, makes the photo copies and runs the bot check.
Our database host: For counsel: The database host's name. The plan names Neon; no account exists yet.
When the law requires it: For counsel: When we share information because the law requires it, or to protect someone from harm.

County appraisal rolls are public records. Appraisal districts publish owners’ names, mailing addresses and property facts, and we load them from the state’s statewide parcel release and from county appraisal district files. We show owners’ names and mailing addresses only masked.

How long we keep it

Sign-in links: Useless after 15 minutes, or after one use.
Your sign-in: 30 days from your last visit, renewed at most once a day. Signing out deletes it.
Photos as uploaded: Deleted 30 days after upload.
Photo copies: Until you remove the photo. For counsel: What happens to a photo's public copies when a listing is turned down, taken down or sold. Once a listing leaves the site (withdrawn, expired, turned down, taken down) its photos answer only its owner and our reviewers; a turned-down listing's copies are deleted, the others stay in storage. Sold listings stay public.
Photo locations: Kept on the photo’s record. For counsel: How long a photo's location stays on record. Today nothing deletes it.
Claim papers: Deleted 180 days after upload, or 90 days after the claim is withdrawn, turned down or expires, if that comes first.
Messages: Kept. For counsel: How long messages are kept. Today nothing deletes them.
Blocked messages: Their words are never kept.
Agreements and the event log: Kept for good. They’re how we prove what was agreed and how an owner was verified.
Payment records: For counsel: How long payment records are kept.
Everything else: While your account is open. For counsel: What happens to an account's information when it closes. There is no self-serve deletion; a person would do it.

Your privacy rights in Texas

Wherever you live, you can ask us to:

tell you whether we hold information about you, and show it to you;
correct it;
delete it;
give you a copy you can take elsewhere; or
stop selling it, using it for targeted advertising, or profiling you. We don’t sell information or use it for targeted advertising.

For counsel — confirm: Whether the Texas Data Privacy and Security Act applies to us (it exempts most small businesses), and its exact wording for these rights.

Some of this you can do yourself on your account page: see the homes you’ve claimed, see where you’re signed in and sign out anywhere, see what you agreed to, and stop tips emails.

For the rest, write to privacy@listedby.ai from the email address on your account. We answer within 45 days. For counsel — confirm: 45 days is the Texas Data Privacy and Security Act's deadline. For counsel: How to appeal our answer to a request, and the Texas Attorney General's complaint page.

Some records stay after we delete an account: the event log and agreement records, which can’t be edited or erased, and payment records. For counsel — confirm: What must stay after an account is deleted, and for how long.

We won’t treat you differently for asking.

How we protect it

Sign-in links, sign-in tokens and postcard codes are stored only as keyed hashes. So are IP addresses.
Claim papers, disclosure documents and the photos you upload sit in private storage.
The sign-in cookie can’t be read by page scripts and travels only over HTTPS.

Children

The site is for adults buying and selling homes. We don’t ask anyone’s age, the site isn’t meant for children, and we don’t knowingly collect information from anyone under 13. If you think a child has given us information, write to privacy@listedby.ai and we’ll delete it. For counsel: The age line (13 or 18), and whether Texas's SCOPE Act (HB 18) reaches a site where buyers and owners message each other.

Changes and contact

When we change this notice, we post the new version here with a new date.

Questions and requests: privacy@listedby.ai For counsel: privacy@listedby.ai is a placeholder: the mailbox doesn't exist yet.