Trust
Security and privacy
Last updated Nov 8, 2026. We store what we need to show you your list, we record how the site and app are used so we can fix them, and we never sell your data.
What we store
| What | Example | Why |
|---|---|---|
| Your email | you@yourshop.com | To sign you in and send what you ask for. |
| Shop location, trade and radius | A ZIP or street address, "generator", 60 mi | To find the cited homes near you. |
| Name, company and phone, if you give them | From the call form or your account | To know who we are talking to. |
| "Wrong record?" reports and feedback, with any screenshot you attach | "Name, address or phone" on a row, or a note with a screenshot | To fix what you report. |
| Teammates, if you invite them | Their email address | To give them access to your list. |
| An alert to Touko Ursin, co-founder | Your email and what you did, like setting a territory | So a person sees every signup, list request, report and call request. |
| Plan status | Trial | To run your trial. Billing is not open yet. When it is, Stripe takes your card and we never see the number. |
| How you use the site and app | Pages, clicks, searches, and a replay of the session | To see where people get stuck and fix it. |
| How you arrived | The campaign tags and referrer of the first and last link you came from | Saved on your account, to learn which pages and emails help. |
| IP address and browser | Your network and browser type | To flag bots and datacenter traffic, estimate your location, and limit abuse. |
What we record about use
We record sessions on this site and in the app (PostHog session replay), plus page views and clicks. Replays include what you type into forms, such as a ZIP code, an email address or a note. Sign-in codes are never recorded, and password fields are hidden.
- When you sign up, your earlier visits to this site are linked to your account.
- We save the first and last campaign link you arrived from on your account.
- We use your IP address to flag bots and datacenter traffic.
- When you sign up, set a territory, ask for a list, report a record or book a call, Touko Ursin, co-founder of Helios One, gets an email with your email address and what you did.
How we keep it safe
- You sign in with a one-time code sent to your email. We keep no passwords.
- Every page is served over HTTPS with strict security headers (content security policy, no framing, no sniffing).
- We never sell your email or territory. We share them only with the services listed under Where it runs.
The data we show you
- We don't buy, scrape or guess names or emails. The only phone number on a row is the home's main line, as CMS lists it.
- We never handle patient data. CMS's files describe buildings and inspections only.
Where it runs
- Fly.io runs the site and the app's web servers in Ashburn, Virginia, USA (Fly region iad).
- Convex runs the app's database, sign-in and background jobs on AWS in US East (N. Virginia). Your account, territory, reports and requests are stored there.
- The weekly job that reads CMS's files runs on Fly.io in the same region.
- Resend sends our email from its US East region.
- PostHog runs analytics and session replay in its EU cloud (Frankfurt, Germany), through our own domain.
- The U.S. Census geocoder places the addresses you type on the map.
- Stripe will handle payments once billing opens.
See or delete your data
Email hello@standbybrief.com from the address on your account and ask for a copy or for deletion. The privacy policy has the details.
Report a security issue
Email hello@standbybrief.com with "security" in the subject. We reply to every report.
See the cited homes near your shop
No account needed to look. 14 days free, no card.