Information we collect

When you request access, we collect your name, email address, domain, email-verification status, Terms acceptance version and time, and account and key metadata. The active key record contains a hash and short prefix for identification. A temporary encrypted copy is held for email delivery; the full key is shown once and emailed to you.

For authenticated API calls, we store the query and response, request time, endpoint, status, duration, and usage information so you can inspect logs and we can enforce limits. We redact common email addresses and phone numbers before storing request details, but other personal information may remain in a query. Please avoid putting sensitive personal information in property searches.

For signup and the public playground, we keep short-lived, hashed IP-based counters to limit abuse. We also keep account block status, administrator reasons, and email-pattern block rules to prevent automated account creation and misuse. Contact messages include the details you submit. Cloudflare may also process network and security data when delivering the site or checking a Turnstile challenge.

How we use it

We use this information to verify your email, deliver keys and sign-in links, run the API, show account logs and usage, respond to messages, prevent abuse, and keep the service secure. We do not sell account details or use query text for advertising. We do not send marketing emails from this service.

Providers and transfers

Cloudflare hosts and protects the service and provides email delivery, Turnstile, and admin Access. Turnstile checks whether a form submission appears automated; see Cloudflare’s Turnstile Privacy Addendum. Email delivery also involves the recipient’s mail provider. Cloudflare’s network may process information in different countries.

We send property search queries and the selected language to Queryfill for live interpretation. Queryfill returns structured filters, unresolved phrases, and usage data. Do not include sensitive personal information in a search. Queryfill and its infrastructure may process this data in different countries.

Cookies and retention

A necessary nb_session cookie keeps you signed in for up to 30 days. Cloudflare may use necessary security and Access cookies, including an admin Access session of up to eight hours. We do not use advertising cookies.

Account API request details are kept for up to 30 days. Abuse counters are removed after about 24 hours. Verification and sign-in links expire after 20 minutes. Encrypted key-email content is removed after successful delivery or an undelivered 24-hour expiry; delivery-job metadata is removed after about seven days. Account records and contact messages do not currently have automatic expiry. We retain them while needed to operate the service or respond to you, and review deletion requests subject to applicable obligations.

Your choices

You can inspect your request history in the dashboard and revoke or replace a key there. Use the contact form to ask about your data or request access, correction, or deletion. We may need to verify your identity before acting on a request. We may retain limited records where required for security or legal obligations.

Changes

We will update the date on this page when the policy changes. Material changes to data handling will be described here before they take effect.