Privacy
In effect UNSET — effective date
What we collect, why we collect it, who else sees it, and how to get it back or have it deleted. Written to be read rather than to be survived — if anything below is unclear, ask and we will fix the wording.
1. Who holds your data
UNSET — legal entity name, at UNSET — postal address, is the controller of the personal data described here. Reach us at UNSET — contact email.
2. What we collect
Your name, email address and avatar, from Google or GitHub when you sign in, plus the identifier that provider gives us. We never receive your password.
Kept while your account exists
Your company name, any bio you write, the milestones you choose to feature, and whether your profile is public.
Kept while your account exists
Your saved runs, the buildings you hold, your transactions, and which seasons you joined. This is the product working rather than a side effect of it.
Kept while your account exists, and in season records afterwards
If you subscribe, Stripe takes the payment and holds the card. We store only the customer and subscription identifiers Stripe gives us, and your plan status. We never see or store a card number.
Kept as long as tax and accounting law requires
We use PostHog. It records the pages you visit and product events — a property bought, a season entered, a paywall reached — and it records sessions: a replay of your interactions with the page. Password fields are masked; other things you type may be captured. Once you sign in, we tell PostHog your account identifier, email address and name, so these are not anonymous records.
Kept per our PostHog retention setting
If you ask to be told when a place opens, we keep the email address, name and interest you gave us, for that.
Kept until you ask us to remove it, or the beta ends
Your IP address reaches our servers with every request and is used to rate-limit abuse. Server logs record errors.
Kept a short period, for security and debugging
3. Why we are allowed to
For your account, your saves and your subscription: because we need them to give you what you asked for — the contract between us.
For analytics, security and rate limiting: because we have a legitimate interest in knowing whether the product works and in keeping it up. You can object to this; see section 6.
For the waitlist and for anything we ask you separately to agree to: because you consented, and you can withdraw that at any time.
4. What is public
Your company name is public. It appears on every building you own, to every other player in the season, and in that season’s records. It is how a shared board works, and it cannot be hidden while you hold property.
Share links are public to whoever holds them. When you create one, the run it describes is readable by anyone with the URL, without an account. Your profile is public only if you turn that on.
5. Who else sees it
We use other companies to run the product. They process data on our instructions and are not free to use it for their own purposes:
Google and GitHub — sign-in. Supabase — the database holding your account, saves and holdings. Vercel — hosting and delivery. Stripe — payments. PostHog — analytics and session recording.
These are US companies and your data is processed in the United States. If you are in the UK or the European Economic Area, that is a transfer outside your jurisdiction, made under the safeguards those providers offer.
We do not sell your personal information, and we do not share it for cross-context behavioural advertising. We will disclose data if the law requires it, and we will tell you unless we are forbidden to.
6. Your rights
Whoever and wherever you are, you may ask us for a copy of what we hold, ask us to correct it, ask us to delete it, ask for it in a portable form, or object to our using it for analytics. Email UNSET — contact email and we will answer within 30 days.
Deleting your account removes your profile, your saves and your waitlist entry. Two things survive, and you should know before you ask: entries in a completed season’s record, which we keep so past seasons remain scoreable, and anything tax or accounting law requires us to keep about a payment. We will disconnect both from your name where we can.
In the UK or EEA you may complain to your data protection authority. In California you have the rights described above and we will not treat you differently for using them.
7. Cookies and similar
We set a cookie to keep you signed in. That one is essential — without it there is no session. PostHog sets its own to recognise a returning browser for analytics and session recording.
8. Children
PropertyLab is not for anyone under 13, and we do not knowingly collect their data. If you believe a child has given us data, email us and we will delete it.
9. Changes
If we change what we collect or why, we will update this page and, where the change matters, tell account holders before it takes effect.
Private beta · v0.1.0 alpha