Privacy Policy

Address data. When you search or purchase a report, we collect the address you enter. This address is used to query public environmental databases and generate your report. It is stored in our database to enable report retrieval and future freshness notifications.

Email address. When you purchase a report or sign in, we collect your email address. We use it to: deliver your report, send you account access links, and notify you when report data is refreshed (approximately once per year). We do not sell or share your email.

Payment information. Payments are processed by Stripe, Inc. We do not store your credit card number, CVV, or full payment details. We receive a transaction ID and your email from Stripe. Stripe's privacy policy applies to payment data.

Usage data. We collect standard web analytics (pages visited, referrer, approximate location via IP) using privacy-respecting analytics tools. We do not use Google Analytics. We do not fingerprint individual users.

Chrome extension. The GroundReport browser extension works only on Zillow and Redfin home listing pages. When you view a listing, it reads the property address shown on that page and sends it to groundreport.app to compute the property's risk score. Like any address searched on our site, the address is processed by the service providers listed below (for example, Mapbox turns it into map coordinates) and may be stored in our database to speed up future lookups. It is not linked to you: the extension sends no cookies, account details, or other identifiers with the request. The score is cached in your browser for up to 30 days (listings viewed in an Incognito window are not cached). The extension keeps a count of how many times you've clicked its badge; that count stays in your browser and is never sent to us. The extension does not read any other page, does not collect your browsing history, and does not sell your data. When you click through to groundreport.app, this Privacy Policy applies as it does to any visit to our site.

• Generate and deliver the environmental risk report you purchased
• Provide account access via magic-link email authentication
• Notify you when the data underlying your report has been refreshed
• Improve the accuracy and coverage of our data sources
• Comply with legal obligations

We do not use your data to train AI models. We do not sell your personal information to third parties.

Reports are generated from publicly available government databases including EPA Envirofacts, SDWIS, ECHO, FEMA NFHL, USGS, CDC, ATSDR, AirNow, and others. All data points in your report are sourced and attributable to named public agencies. No private data about you or your property is purchased from data brokers.

Reports are private by default. Only you can access your report when signed in. You may opt in to make a report publicly viewable — publicly shared reports expire from public view after 24 months. The aggregate risk score (without detailed findings) for any address is always public.

Report data is retained indefinitely to support the freshness notification system. You may request deletion of your report and account data by emailing us at the address below. We will delete your data within 30 days.

• Supabase — Database and authentication (supabase.com/privacy)
• Stripe — Payment processing (stripe.com/privacy)
• Resend — Transactional email delivery (resend.com/legal/privacy-policy)
• Mapbox — Address geocoding and map rendering (mapbox.com/legal/privacy)
• Vercel — Hosting and edge delivery (vercel.com/legal/privacy-policy)

Our service is not directed to children under 13. We do not knowingly collect personal information from children under 13.

We may update this Privacy Policy from time to time. We will notify you of material changes via email if you have an account. The "Last updated" date at the top of this page reflects the most recent revision.

Questions about this Privacy Policy? Email us at privacy@groundreport.app.