estate.sh

Privacy

Accounts when useful. No ad tracking.

You can search public listings without signing in. Accounts sync saved data or restore paid access; neither is used for advertising profiles.

Accounts
Optional
Analytics choice
Opt out anytime
Saved data
Synced when signed in

Data boundaries

Only the account data you choose to create.

Anonymous use creates ordinary request logs and first-party product analytics. Signing in adds only the identity, session, saved-data, and billing records needed for cross-device access.

What we touch

  • Server logs and request metadata, to keep the site running
  • Public API traffic, logged for rate limiting and abuse
  • Error logs limited to what we need to find and fix a problem
  • Emails you send us, to answer and act on your request
  • Account, session, saved-property, and saved-search records when you sign in
  • Stripe customer, subscription, and entitlement status for paid access
  • First-party property and product analytics used to measure listing engagement and improve reliability

What we never collect

  • Full payment-card details, which stay with Stripe
  • Advertising pixels or cross-site behavioural trackers
  • Data sold or shared with brokers, marketers, or ad networks
  • Client-supplied billing claims as proof of paid access
  • URLs, search queries, contact fields, or free-form values in the property event ledger
  • Raw IP addresses in the property event ledger

Saved data

Anonymous stays local; signed-in data can sync.

Favourites and saved searches begin on your device. Signing in merges them into your account so another browser or a reinstalled app can restore them.

  1. FavouritesThey stay local while you are anonymous. After sign-in, local and account favourites are merged and synced through the authenticated API.Device + account
  2. Search & filtersOrdinary filters remain in shareable links. Searches you explicitly save can follow your signed-in account across devices.URL or account
  3. Account cookiesSigned, secure session cookies keep you signed in and can be revoked. They are not advertising or cross-site tracking cookies.Essential only
  4. Product analyticsA random browser identifier stays on this device until you opt out. The server derives a pseudonymous key that rotates every 30 days. Property views count only after two visible seconds and result impressions only on viewport entry.Browser choice + opaque ID

Reliability

Logs and analytics, not advertising profiles.

Requests and fixed property events help prevent abuse, debug failures, enforce limits, and improve reliability. Public routes stay public; account routes require a valid session.

Your choice

Analytics, monitoring, and replay are optional.

PostHog records sanitized product events, errors, console logs, and masked session replay. Property analytics send an opaque ID, property ID, event time, surface, and fixed event details. The property ledger receives no page URL, query string, search term, contact field, free-form value, or raw IP address.

  • Abuse prevention
  • Debugging
  • Rate limiting
  • Reliability

Your choice is stored only in this browser.

Turning measurement off keeps the current browser identifier only while retrying the raw-event deletion request, then discards it after confirmation. Anonymous daily aggregates that can no longer identify that browser may remain.

Global Privacy Control and Do Not Track disable browser measurement automatically. The server rotates the pseudonymous key every 30 days.

Providers

A few assets load from others.

Maps, images, live prices, analytics, billing, and account email depend on specialist providers. They receive ordinary request or service data, never data for advertising.

  • MapsTiles & geocodingMap tiles and address lookups receive request metadata when the map loads in your browser.
  • Hosting & CDNDeliveryOur host and CDN process the requests that serve every page and asset on the site.
  • Exchange ratesCurrencyConversion figures are fetched from a rates provider so prices can show in your currency.
  • Source imagesMediaListing photos may load straight from the original source's servers rather than ours.
  • PostHogAnalytics & replayPostHog processes sanitized first-party usage, error events, console logs, and session replay so we can understand reliability and improve product flows. Form inputs are masked, cross-origin frames are excluded, and we do not use it for advertising.
  • StripeCheckout & billingStripe processes web checkout, payment methods, refunds, and the customer portal. estate.sh stores customer and subscription identifiers, not card details.
  • LoopsAccount emailLoops receives your email address and a time-limited link when estate.sh sends verification or password-reset messages.

Retention

We keep only what we need.

Operational logs age out. Raw property analytics are kept for 90 days and anonymous daily aggregates for 24 months by default. Account and saved data last until account deletion; Stripe keeps transaction records under its own obligations.

Your data

Want a correction or a deletion?

Delete your profile, sessions, saved data, and linked Stripe customer from the account page, or email us about corrections, takedowns, support, and personal-data requests.

abuse@estate.shAll contact channels