Privacy Policy

Who we are

Cadastre is operated by [LEGAL ENTITY NAME] (“we”, “us”), [MAILING ADDRESS]. We decide how and why your personal information is used. You can reach us at support@getcadastre.com.

What we collect

Your account

Your name, your email address, and your password, which we store only as a salted hash, never in readable form. We also record when your email address was verified (you verify it by opening the sign-up link we email you), and each version of the Terms of Service and Privacy Policy you accepted and when (see Technical information). If you add a mobile phone number, we store it with your account; we do not send messages to it yet. If you add a passkey, we store its public key, a name you give it and when it was used; we never receive your biometric or device unlock data. When a passkey is added or removed we email the account’s address to tell you.

When you ask to sign up

Sign-up starts with your email address. We store a pending sign-up: the address, the name you gave, a one-way hash of the link we email you (the link itself is only in the email), and when it expires. No account and no password exist until you open that link and choose a password. The link works once and for 24 hours; a pending sign-up that nobody opens is deleted after 7 days, and asking again replaces it. If the address already has an account, we email that address to say so and store nothing new. When you set your password, on the page where you also tick the box to accept the terms, we create your account and record your acceptance of them (see Technical information).

If you forget your password, you can ask for a reset link. We email the address you type (at most three such emails an hour): a link to choose a new password if an account uses it, or a note saying no account does. For the link we store a one-way hash, the account it is for and when it expires (30 minutes); the link itself is only in the email, works once, and stops working when a newer one is asked for or the password changes. Choosing a new password, with that link or in Settings, ends your other sessions, forgets your remembered browsers and disconnects the apps you connected, and we email your address to tell you it changed.

Email that cannot be delivered

When our email delivery provider tells us that an email to an address bounced (the address does not exist, or keeps failing) or that the recipient reported it as spam, or that it stopped sending to the address, we record the address, what happened and when, the provider’s identifiers for the message and its description of the failure (with any email address in it removed), so that we stop sending email to that address. While an address is on that list we send it nothing, including sign-up and password reset links, and we count the emails we did not send. If it is your account’s address, Settings tells you and lets you ask us to try again once you have fixed it (which also asks the provider to send to it again); otherwise write to support@getcadastre.com. Our administrators with the highest access level can see this list and clear an address from it.

What you put into the service

Your projects: project names, client names, descriptions, the target regions, requirements and criteria you set, including the free text you type to describe a criterion, and the weights you choose. Also the snapshots you save, the rankings stored in them, and the reports and exports built from them. Client names are in this content, so they are personal information if a client is a person, and confidential business information either way.

Technical information

When you sign in, we store a session record with a session identifier, your IP address and your browser’s user agent. Our servers also log requests, which include your IP address, the page requested and the time. When you sign in we also remember the browser: we keep a one-way hash of a random identifier we put in a cookie there (see “Cookies and browser storage”), the browser’s user agent, shortened to 255 characters (Settings shows it as a short description such as “Firefox on macOS”), when it was first and last used, and when it expires or was forgotten. Settings lists these browsers and lets you forget them. A remembered browser is not stopped by the limit on failed sign-ins for your email address, so that someone guessing at your address cannot keep you out of the browser you use. Each time you accept a version of the Terms of Service and this Privacy Policy, we also record the version, the time, whether you accepted at sign-up (recorded when you set your password) or in the app, and the IP address and browser user agent the request came from, to keep a record that you accepted it. We filter passwords, email addresses, phone numbers, passcodes, link tokens, client names and passkey data out of the logged request parameters and out of our database query logs and error reports (as well as the IP address and user agent stored with a session), our application logs mask the secret part of share, invitation, sign-up and password reset links, and a logged email shows neither its recipient nor its body. Logs kept by our hosting provider or a proxy in front of the service may still show full link paths. Logs may still show other request details, such as your name, project names and the text of a criterion. When you add a passkey or sign in with one, we also keep, for five minutes, a one-way hash of a one-time code that proves the request is fresh, a random identifier that ties it to your browser, and the network your request came from (the first part of your IP address, not the whole address); once the five minutes are over the code can no longer be used, and the record is deleted.

People who open a report you share

When you share a report with a link, we keep the link as a one-way hash (the link itself is shown to you once and is not stored), the report it opens, who created it and when, its expiry, the downloads it allows, whether it was revoked, and a count of how many times the report page was opened and when it was last opened. If you set a passcode, we store only a salted hash of it. The person who opens the link has no account; the first time they open it in a browser session we ask them to agree to the terms and record the version, the time, their browser’s user agent and the network their IP address belongs to (the last part of the address is removed, so a /24 network for IPv4 and a /48 for IPv6), not the full address. Our servers’ request logs include the viewer’s full IP address like any other request; our application logs mask the link’s secret part, though a hosting provider’s or proxy’s own logs may still show it.

Teams and invitations

When an owner or admin invites someone to an account, we store the email address they typed (in lower case), the role offered, who sent the invitation and when, when it expires and whether it was accepted or revoked, and a one-way hash of its link (the link itself is shown to the sender once and sent to the invitee, and is not stored). When email delivery is set up, we send the invitee one email containing the invitation link, the role offered and the date it expires, and nothing else about you or the account; resending sends another. (Without it, the sender is given the link to pass on.) The account’s name and the sender’s name are shown on the page the link opens, not in the email. The people in an account can see each other’s names and roles; owners and admins can also see members’ email addresses and the invitations waiting. We also keep a short activity log for each account (who invited, resent or revoked an invitation, who joined, left or was removed, role changes and renames, with the email addresses involved at the time), which owners and admins can read. The name of the person who created a project stays on it, marked as a former member, after they leave the account.

API keys and connected apps

If you create an API key, we store its name, who made it and for which account, when it was made, when it was last used (updated at most hourly) and whether it was revoked, and a one-way hash of the key with its first few characters so you can tell your keys apart; the key itself is shown to you once and not stored. The account’s owners and admins can see every key in it. If you approve an app, such as an AI assistant or our command-line tool, to use Cadastre for you, we store that approval: the app as it described itself when it registered (its name and where it sends you back to), you, the account, what it may do, when you approved it, when it was last used and whether it was disconnected, and one-way hashes of the short-lived codes and tokens it uses. For each API request we add one to a daily count for the account, the key or app, the endpoint and the response status, with the total time taken; the count does not include your IP address, what you asked for or what we returned. A request that presents a key or token that is not valid is counted against the network address it came from for a couple of minutes, to limit abuse. The API’s public datasets can also be used without an account: such a request is counted against the network address it came from for up to two days, to apply the rate limits for use without an account, and added to one daily count of all such requests by endpoint and response status, which does not include the address. Our servers log API requests like any other request (see Technical information), with keys and tokens filtered out.

How the service is used

We count page views ourselves, on our own servers, to see which pages and documents are read and how many people use the service; no outside analytics service, no analytics script and no analytics cookie is involved (for signed-in visitors we use the existing sign-in session to know who is signed in). For each page that is opened we add one to a daily count for that page (the kind of page, such as “a project’s page”, not which project, and without the query string), its format (web page, Markdown or plain text) and whether the visitor was signed in, not signed in, or an automated program such as a search engine or an AI agent, which we name from its browser user agent (“ClaudeBot”, “curl”). For visitors who are not signed in we also count whether they arrived from another site or typed the address. We do not store the IP address or the user agent for this, and nothing in these counts identifies a visitor who is not signed in. When you are signed in, we also record, per day, that you were active and how many pages you opened; and to count each signed-in person once per page per day we keep, until the day is over, a one-way hash of your user identifier and the page, made with a random key that changes every day; the hashes and the key are deleted the next day. Our administrators with the highest access level can see these counts, including each signed-in person’s active days and page views with their name and email address. We also count each account’s use of the API (requests per day for each API key or connected app, endpoint and response status, and the time taken).

Payment

Billing is not set up yet. When it is, payments will be handled by [PAYMENT PROCESSOR]. We do not store card numbers.

Why we use it, and our legal bases

• To provide the service you asked for: your account, your projects, rankings, snapshots and exports. (Performing our contract with you.)
• For security and to prevent abuse: keeping accounts safe, rate-limiting sign-in attempts, investigating problems. (Our legitimate interests.)
• To keep a record that you accepted a version of our terms: the version, the time, your IP address and your browser’s user agent. (Our legitimate interests; establishing or defending legal claims.)
• To let the people you share a report with open it, and to show you who opened it: the link, its settings, the view count and last-opened time. (Performing our contract with you.) We also keep a record that each viewer agreed to our terms, with a shortened IP address and browser user agent. (Our legitimate interests; establishing or defending legal claims.)
• To let teams work together and to keep a record of it: sending invitations, showing members to each other, and the account’s activity log. (Performing our contract with the account’s owner; our legitimate interests.)
• To understand how the service is used and improve it: the page-view counts and daily activity described under “How the service is used”, and the API usage counts. (Our legitimate interests.)
• To support you and to send the emails the service needs, such as sign-up and password reset links and a notice when your password is changed or a passkey is added to or removed from your account. (Performing our contract; our legitimate interests.)
• To comply with the law and to establish or defend legal claims. (Legal obligation; our legitimate interests.)
• With your consent where the law requires it. You can withdraw consent at any time.

We do not use your information for advertising, and we do not build advertising profiles.

AI processing

When you type a criterion in your own words, we send the text of that criterion, together with the names, descriptions and summary statistics of the measures in our data catalog that are needed to compile it, to third-party AI model providers, so they can interpret it and propose how to measure it. Today the main provider is Anthropic. We may also use Fireworks AI (which hosts open-source models for us) or OpenAI, and other providers in the future.

An optional agent mode, which is off unless we switch it on, also sends the wording (shortened), measure, direction and cutoff of the other criteria in the same project, and how many of the project’s metros a trial cutoff would remove, so a new criterion does not repeat one you already have. We do not send your account details, and we do not send your project name, client name or account name for this purpose. Avoid putting confidential client information in a criterion’s text.

The providers act as our service providers. As of the date above, the providers’ published terms say that content sent to their business APIs is not used to train their models (Anthropic and Fireworks AI), or not unless the customer opts in (OpenAI). We do not opt in. Those are the providers’ terms, not a promise from us, and they may change.

Who else receives it

We share personal information only with:

• the AI providers named above, for the purpose described there;
• an app you approve to use the API for you (see “API keys and connected apps”), which receives the data you ask it to read, your name and user identifier, and the chosen account’s name, identifier and your role;
• our hosting provider, [HOSTING PROVIDER];
• our email delivery provider, Postmark, which sends you our emails;
• our payment processor, [PAYMENT PROCESSOR], once billing exists;
• professional advisers, such as lawyers, accountants and insurers, under a duty of confidentiality;
• law enforcement, regulators or others, when the law requires it or to protect rights and safety; and
• a buyer or successor, if the business is sold or reorganised, who must honour this policy.

We do not sell personal information, and we do not share it for advertising.

Cookies and browser storage

Cadastre uses what it needs to work:

• a sign-in cookie (session_id) that identifies your session record, so you stay signed in until you sign out or the session expires; it is set to last at most 90 days (see “How long we keep it”), and a small framework cookie (_cadastre_session) holding short messages such as “check your email”, the page you were heading to, an invitation you are accepting, for someone who has just sent an invitation, its link and address until the next page, and, for the few minutes it takes to add or use a passkey, a random identifier that ties the request to your browser (the one-time code that proves the request is fresh is not in the cookie: we keep only a one-way hash of it on our servers, see “What we collect”);
• a remembered-browser cookie (cadastre_device) set when you sign in, holding a random identifier that stands for that browser (we store only a one-way hash of it). It lets us tell your usual browser from someone else’s when we limit failed sign-ins, and it is what the “Remembered browsers” list in Settings shows. The cookie itself lasts up to a year, but we honour it only until 90 days after you last used the browser. It is signed so it cannot be altered, is kept out of reach of page scripts and is sent to nothing else, and is not used for tracking. Signing out does not remove it (you can forget a browser in Settings, or clear your cookies); and
• local storage in your browser for three preferences: your theme choice (cadastre.theme), the width of the left pane on the metro screen (cadastre.markets.leftWidth) and whether the power grid layer is switched on in a project (cadastre.powerGrid). They stay on your device and are not sent to us. We use no session storage.

A person opening a shared report gets no sign-in cookie and no framework cookie. Once they enter the passcode (if there is one) or agree to the terms, they get one cookie (cadastre_share), set only on that link’s address, that remembers for the browser session (and at most 12 hours) that they did so. A link that is unknown, expired or revoked sets no cookie. It is signed so it cannot be altered, kept out of reach of page scripts, and sent to nothing else. It is strictly necessary for the link to work, and it is not used for tracking.

We use no analytics, advertising or tracking cookies or scripts, and no third-party trackers load on our pages: the page-view counts described under “How the service is used” are made on our servers without any analytics cookie or script; for signed-in visitors they use the existing sign-in session. If that changes, we will update this policy first.

How long we keep it

• Account and content: while your account exists. There is no button in the app yet to close an account or delete a project; you ask us (see “Your rights”), and we do it by hand. After we close an account we delete it within [RETENTION PERIOD], unless we must keep something for legal reasons.
• Record of your acceptances of our terms (version, time, IP address and browser): kept with your account, and deleted with it as above, unless we must keep it for legal reasons.
• Pending sign-ups: deleted when you finish signing up; one that is never opened is deleted after 7 days.
• Password reset links: deleted when used, when a newer one is asked for, or when your password changes; an expired one is deleted the next time a reset link is sent to anyone.
• Share links and the record of viewers’ agreement (shortened IP address, browser and version): kept as long as the project exists, so you can see what you shared; deleted with the project or the account. Revoking a link keeps its record.
• Invitations and the account activity log: kept as long as the account exists (an invitation, whether waiting, accepted, expired or revoked, and the log are not removed earlier), and deleted with the account within [RETENTION PERIOD] of its closure. If you are invited and never accept, your address stays in the invitation until the account is closed; ask us at support@getcadastre.com to delete it sooner.
• Sessions: a session record is deleted when you sign out, or when you use “Sign out of all other devices” in Settings (which ends your other sessions). Expired sessions are also deleted by a daily job. A session also expires on its own after 30 days without use, and 90 days after you signed in at most.
• Remembered browsers: a browser is remembered for 90 days after you last used it, and is deleted by a daily job after that, or after you forget it in Settings. Using “Sign out of all other devices” in Settings forgets your other remembered browsers, and so does changing your password. Signing out does not forget the browser you sign out from.
• Passkey one-time codes (a one-way hash, the browser identifier and the network): usable for five minutes, deleted when they expire (a daily job removes any left).
• API keys, connected apps and API usage counts: kept while the account exists, including the records of revoked keys and disconnected apps, and deleted with the account within [RETENTION PERIOD] of its closure. An app’s codes and tokens are removed by a daily clean-up once they are at least a day past expiry, and an app registration nobody has approved is removed after a week. Your approvals of an app are deleted with the account; an app’s registration itself, which other people may also have approved, can remain.
• Page-view counts and activity: the daily counts per page, format and kind of visitor are kept indefinitely; they name no one, although on a day with few visitors a count of signed-in views can say little more than that someone looked. Your daily activity record (the days you were active and how many pages you opened) belongs to you as a person, across every account you are a member of, and is deleted when your user profile is deleted. The one-way hashes used to count each signed-in person once per page per day, and the day’s key that made them, are deleted the next day.
• Undeliverable email records (an address that bounced or reported our email as spam): kept while we are not sending to the address; deleted by a daily job 90 days after it is cleared, and a failure that did not stop our email (an occasional soft bounce) 90 days after it happened.
• Server logs: for up to [LOG RETENTION PERIOD].
• Backups: deleted data can remain in backups until they expire in the normal course.

Security

We take reasonable measures: connections to Cadastre are encrypted, passwords are stored as salted hashes, and access to accounts and administration is controlled. No system is perfectly secure, and we cannot guarantee that your information will never be accessed without permission.

Your rights

You can ask us to give you a copy of your personal information, to correct it, or to delete it. There are no self-service tools for closing an account, deleting data or exporting it yet. To close your account or to get a copy of your data, write to support@getcadastre.com; we do this by hand. We may need to confirm who you are first, and we will reply within the time the law allows. (You can already download reports and exports of your own projects from the app.)

If you are in the European Economic Area or the United Kingdom, you may also object to or ask us to restrict some uses, and complain to your data protection authority. If you are a California resident, you may ask what we collect and have it deleted, and we will not discriminate against you for asking. We do not sell or share personal information as those terms are used in California law.

This section describes what we will do. It is not a statement that we meet every requirement of any particular privacy law.

Children

Cadastre is not for anyone under 18, and we do not knowingly collect information from them. If you think a child has given us information, contact us and we will delete it.

International transfers

We are based in the United States, and our providers may process information in the United States or elsewhere. If you use Cadastre from outside the United States, your information may be transferred to, and processed in, countries whose data protection laws differ from yours.

Changes to this policy

We may update this policy. The date at the top shows the current version. For material changes we will give notice, by email or in the service, before they take effect.

Contact

[LEGAL ENTITY NAME]
[MAILING ADDRESS]
support@getcadastre.com