Last updated: July 20, 2026
This policy explains what Tax Foreclosures NC ("we", "us") collects, how it is used, who sees it, and the choices you have. The short version: we collect the account information you give us, the content you save, and the routine technical data any web service generates, and we use them only to run the service. We do not sell or rent personal data, and we do not use advertising trackers or third-party analytics.
Account data: your name, email address, and password. Authentication is handled by Supabase; your password goes from your browser directly to Supabase, is stored there in hashed form, and never reaches our servers. We also keep basic account records: your subscription status and billing-period dates, identifiers that link your account to Stripe (never card numbers), the Terms of Service version you accepted and when, and account timestamps.
Content you create: watchlists, notes, tags, title-check status, saved searches, and alert and notification preferences, plus the in-app alert entries the service generates for your account.
Technical data: standard server and network logs (IP address, request paths, timestamps) generated by our server and by Cloudflare, used for security and operations. We do not build behavioral profiles and do not keep page-by-page usage histories tied to your account.
Payment data: handled by Stripe. Checkout happens on Stripe-hosted pages; card details go directly to Stripe and never touch our servers. Stripe collects your billing details (including a billing address where tax rules require one) under its own privacy policy; what we store are the non-card records described above.
The property listings themselves are information about properties, not personal data we collect about you.
To operate the service: sign you in, store your watchlists and settings, send the email alerts you configure, process subscription payments, prevent fraud and abuse, send transactional email about your account or subscription, and comply with law.
We set one cookie: an essential session cookie that keeps you signed in for up to 7 days. It is httpOnly (not readable by scripts), sent only over HTTPS, and removed when you log out. We set no advertising, analytics, or cross-site tracking cookies — which is why you see no cookie banner. Our infrastructure providers may set their own strictly necessary cookies on some pages (for example, during an automated bot check at sign-in), and pages that show embedded map imagery load it from Google, which may set its own cookies within that embedded map frame under its own policies. Because we do not track you across sites, there is nothing for "Do Not Track" or Global Privacy Control signals to switch off; we treat all visitors that way by default.
The app keeps some information in your browser's local storage rather than on our servers: display preferences (like list-versus-map view), a copy of your own saved content — watchlist, notes, tags, title-check status, saved searches, alert preferences, and recent alerts — so the app can open offline, and — if you use the upset-bid form helper — the bidder name and contact details you type there. The form helper fills the PDF entirely in your browser: those details stay on your device, are never sent to our servers, and can be erased with the form page's "clear" control. On-device data persists until you clear it, so on a shared computer, log out and clear the browser's site data when you are done.
We share personal data only with the providers needed to run the service, and each receives only what its function requires:
We may disclose information if we believe in good faith it is required by law, subpoena, or other legal process, or necessary to protect the rights, safety, or property of the service, our users, or the public — for example, to investigate fraud or abuse.
If the service or its assets are involved in a merger, acquisition, financing, or sale, account data may be transferred as part of that transaction, subject to this policy's protections.
We may create and use aggregated or de-identified data (for example, feature-usage statistics) that cannot reasonably identify you, for any lawful purpose, including improving the service.
We take reasonable measures designed to protect your data: the service is served over HTTPS; passwords are held only by Supabase in hashed form; the session cookie is httpOnly and HTTPS-only; card details never touch our systems; and we keep no more personal data than the service needs. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security; if we learn of a breach affecting your data, we will notify you as required by law.
Data is stored and processed in the United States, and the service is intended for users in the United States. If you use it from elsewhere, you consent to your data being processed in the United States.
Account data and your content are kept while your account is active; if your subscription ends, we keep them so everything is there if you come back. You can delete watchlist items, notes, tags, title-check status, and saved searches in the app at any time. To delete your account entirely, email [email protected] from your account address; we will delete your account data within 30 days, except limited records we must keep for legal, tax, or accounting purposes (such as payment history). Deleted data can persist in our routine backups for up to about 30 additional days before aging out, and residually in security logs.
You can turn alert emails on or off, per category, in the app's notification settings; transactional email about your account or subscription is sent only as needed to operate the service. You may request access to, correction of, or deletion of the personal data we hold about you via the contact in Section 15. Tax Foreclosures NC is a small business: comprehensive state privacy laws such as the California Consumer Privacy Act and the Virginia Consumer Data Protection Act set revenue and data-volume thresholds that we do not currently meet, so we do not believe those laws currently apply to us — but we honor access, correction, and deletion requests from any user regardless of state. We do not sell personal data, so there is nothing to opt out of selling.
The service is for adults: our Terms require you to be at least 18 to create an account. The service is not directed to children, and we do not knowingly collect personal data from anyone under 18 — or from children under 13, per the Children's Online Privacy Protection Act. If you believe a child has provided us data, contact us and we will delete it.
We may update this policy as the service evolves. The current version is always posted on this page, and material changes are reflected in the "Last updated" date above; for significant changes we may also notify you by email or an in-app notice.
Questions or requests: [email protected].