Privacy policy

What we collect

At signup: your email address, whether you're a landlord or letting agent (and your agency name, if given), and one or more properties — each with a postcode, an optional nickname, and a few self-reported details (known clay-soil area, mature trees nearby, property age band, vacancy status, past subsidence or damp/mould claims). We use Vercel Analytics to see aggregate page-view counts — it doesn't use tracking cookies and doesn't identify you individually.

How your email is stored

Your email address is encrypted at rest (AES-256-GCM) using its own encryption key, separate from Turf Alert's — a database-only breach would not on its own expose your email address, and a key leak in one product doesn't expose the other's subscribers. Alongside the encrypted value, we store a one-way cryptographic hash of your email, used only to detect duplicate signups and to look up your account from the links we send you; that hash cannot be reversed back into your email address.

How your properties' locations are stored

We look up each postcode once, at signup, via postcodes.io (a free UK postcode lookup service) purely to validate it and find its outward code's approximate centre point — never your property's precise, near-doorstep location. That's already more precision than the weather and flood data we use needs.

Who else sees your data

A few third-party services are necessarily involved in running this: Resend (sends the emails, and therefore sees your email address and message content), postcodes.io (sees each postcode at signup only), MET Norway and the Environment Agency (weather and flood data, looked up by approximate property location only — neither ever sees anything that identifies you), our database host (stores the encrypted data described above), and Vercel (hosts this site and sees aggregate page-view counts, not who you are). None of these are paid to advertise to you, and we don't sell or share your data with anyone else.

How long we keep it

For as long as your account exists. There's no automatic expiry — you control deletion yourself (see below).

Your rights

Every email about your account — the welcome email and every alert — includes a link to manage it. From there you can pause alerts (keeps your data, stops emails) or permanently delete your account (removes your email, every property, and all monitoring history entirely, immediately — this cannot be undone). No login or password is needed; the link itself is your access. (The very first email, asking you to confirm your address, doesn't include this link — there's nothing to manage yet until that's done.)

The Property Risk Report

The report page is only reachable via the same unique link included in your account emails — it isn't indexed by search engines and isn't discoverable without that link.

Contact

The manage link in your emails is the fastest way to pause alerts, update your account, or delete your data — no request or waiting required.