Privacy policy

• Your account: your name and email address, and your password (stored only as a secure hash). If you sign in with Google, we receive your name and email from Google.
• Your properties: the details you enter, such as addresses, values, loan balances, interest rates, repayments, rent, expenses, insurance, cash and offset balances, your tax bracket and any income goal.
• Loan statements you import: the PDF you upload, and the figures read from it. A statement shows what your lender printed on it, which can include your name, address, loan account details and balances.
• Shared summaries: when you share a portfolio summary, we record when it is opened, with a random device ID and the browser type (for example “Chrome on Mac”) so you can see how many devices viewed it. We don't store viewers' IP addresses.
• Usage counts: how many address lookups, property estimates and statement reads each account makes, so we can apply fair-use limits.
• Payments: if you subscribe, Stripe handles your card details. We never see or store your card number; we keep your subscription status.

We don't use advertising or analytics trackers.

To calculate and show your portfolio's figures and insights, to keep your account secure, to apply usage limits, and to answer you when you contact us. We don't sell personal information or use it for advertising.

Only the service providers that run PropWatch, and only what each one needs:

• Supabase stores your account, properties and uploaded statements, and handles sign-in. Its servers are in South Korea.
• Vercel hosts the app and runs its servers.
• Google, if you sign in with Google. And when you import a loan statement, PropWatch sends the statement's text (not the file) to Google's Gemini service to read the figures. PropWatch uses Google's paid service, under whose terms Google doesn't use that text to improve its products and keeps it only for a limited time to detect misuse.
• HTAG Analytics receives the address of a property you add, to estimate its value and rent.
• Checkify receives the address you type, to suggest matching addresses.
• Mapbox provides the map. Your browser loads map images directly from Mapbox, which sees your IP address and the area shown.
• Stripe processes payments, if you subscribe.

Some of these providers store or process information outside Australia, including in South Korea and the United States.

When you share a portfolio summary, anyone with the link can see the summary you chose to share, until the link expires or you turn it off.

• Sign-in cookies keep you signed in.
• If you arrive through a “Prepared with PropWatch” link, a cookie remembers which link it was for 30 days.
• Opening a shared summary sets a cookie with a random device ID, kept for a year.
• Before you sign up, the property you start with is kept in your browser's local storage.

• Your account and portfolio data, for as long as you have an account.
• An uploaded statement's PDF is deleted as soon as you confirm or discard the import, or 14 days after upload if you do neither. The figures read from it stay with your account.
• To delete your account and everything in it, contact us and we'll do it.

Connections to PropWatch are encrypted. Each account's data can be read only by that account, and uploaded statements are kept in private storage.

You can see and correct your property details in the app at any time. You can ask us for a copy of your information, to correct it, or to delete it. If you have a concern about how we handle your information, contact us first; if we don't resolve it, you can complain to the Office of the Australian Information Commissioner at oaic.gov.au.

Questions, requests or complaints: Contact details are being set up.

When this policy changes, the date at the top changes too. If a change affects how your information is used or shared, we'll tell you in the app before it takes effect.