PRIVACY POLICY
Curb Compass — curbcompass.com
Last updated: July 14, 2026

Curb Compass is a product of Stackhouz Holdings LLC (“Curb Compass,” “we,” “us”), 2101 S. El Camino Real, STE 102, Oceanside, CA 92054. This policy describes what we collect when you use curbcompass.com and app.curbcompass.com (together, the “Service”), how we use it, and the choices you have.

Plain-English summary: we collect what the app needs to work — your account info, the leads and photos you add, and your payment details (handled by Stripe). We don’t sell your data, we don’t run ads, and the API keys you bring stay encrypted and are used only to make the lookups you request.

  1. INFORMATION WE COLLECT

Account information. Your email address, a password (stored only as a secure hash), and an optional display name and business profile (business name, phone, tagline, photo) if you set one up.

Content you add. Property leads (addresses, notes, stages, statuses), deal-analysis inputs, property photos, voice notes, and the postcard pitches and return address you save for direct mail.

Owner-contact data you retrieve. When you run a skip-trace or property lookup through your own provider keys, the results (owner names, phone numbers, emails, valuation data) are stored in your account so you can work your pipeline. You are responsible for using this data lawfully (see our Terms of Service).

API keys you bring. Curb Compass is bring-your-own-key. Provider keys you save (RentCast, Tracerfy, Trestle, Lob) are encrypted at rest and used only to perform the actions you request. We never display a full key back to you and we never use your keys for anything other than your own requests.

Payment information. Subscriptions are processed by Stripe. Your card number never touches our servers; we store only your Stripe customer reference, subscription status, and billing period.

Usage and technical data. We count the billable API calls you make through the Service (per provider, per billing period) so we can show you estimated costs. We keep standard server logs (IP address, request time, endpoint) for security and debugging, and we apply rate limits by IP address to protect the Service.

Public page and QR scans. If you use direct mail, each postcard carries a QR code linking to your public contact page. When someone visits that page or scans your code, we record the scan event so the lead can surface in your pipeline. Your public page shows only the business profile content you chose to publish.

  1. WHAT WE DON’T DO

We do not sell your personal information. We do not share it with advertisers. We do not use your leads, contacts, or photos for any purpose other than operating the Service for you.

  1. HOW WE USE INFORMATION

To provide the Service: storing your pipeline, running the lookups you request, printing and mailing the postcards you send, and showing your usage.

To secure the Service: verifying email addresses, blocking bots at signup (Cloudflare Turnstile), rate limiting, and fraud prevention.

To communicate with you: transactional email (verification links, password resets) and, only if you opted in at signup, occasional product updates. Every marketing email includes an unsubscribe link.

To bill you: managing subscriptions through Stripe.

  1. SERVICE PROVIDERS

We use a small set of processors to run the Service. Each receives only what its function requires:

  • Stripe — payments and subscription billing
  • Cloudflare — website hosting (app frontend), bot protection (Turnstile), and photo storage (R2)
  • Hetzner — backend server hosting
  • Resend — transactional email delivery
  • Stadia Maps — map tiles displayed in the app
  • Lob — postcard printing and mailing, using your own Lob account
  • RentCast, Tracerfy, Trestle — property, skip-trace, and verification lookups, using your own accounts and keys

When you use your own provider keys, your use of those providers is also governed by their terms and privacy policies.

  1. COOKIES AND LOCAL STORAGE

The app stores a session token and small preference values (for example, a dismissed checklist) in your browser’s local storage so you stay signed in and the app remembers your settings. The marketing site uses only essential cookies. We do not use third-party advertising or cross-site tracking cookies.

  1. DATA RETENTION

Your data stays in your account as long as the account exists. If you delete a lead, it is removed from your pipeline. If you want your account and its data deleted, email feedback@curbcompass.com from your account email and we will delete it within 30 days, except records we must keep for legal, billing, or security purposes.

  1. SECURITY

All traffic is encrypted in transit (HTTPS). Passwords are hashed, provider API keys are encrypted at rest, and access to production systems is restricted. No system is perfectly secure; if we learn of a breach affecting your data we will notify you as required by law.

  1. YOUR RIGHTS

You can access and update your profile, email preferences, keys, and content in the app at any time. Depending on where you live (including under the California Consumer Privacy Act), you may have rights to access, correct, delete, or port your personal information, and to opt out of sale or sharing — noting that we do not sell or share personal information as those terms are defined in the CCPA. To exercise any right, email feedback@curbcompass.com. We will not discriminate against you for exercising them.

  1. CHILDREN

The Service is for users 18 and older. We do not knowingly collect information from anyone under 18.

  1. CHANGES

We may update this policy as the Service evolves. We will post the new version here with an updated date, and for material changes we will notify you by email or in the app.

  1. CONTACT

Stackhouz Holdings LLC (Curb Compass)
2101 S. El Camino Real, STE 102, Oceanside, CA 92054
feedback@curbcompass.com · +1 (805) 435-0104