Privacy Policy

1. Who we are

EquitySight is operated by Jacoby Yarrow, a sole trader based in Queensland, Australia ("EquitySight", "we", "us", or "our"). We operate the website equitysight.app and related services.

This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you use our property finance calculator and related services ("Service").

By using the Service you agree to the collection and use of information in accordance with this policy.

2. Information we collect

Information you provide directly

• Account information: Your name and email address when you create an account. If you sign in with Google, Google shares your name and email address with us to create or access your account, and Google processes that sign-in under its own privacy policy.
• Authentication credentials: Your password. Passwords are stored as salted scrypt hashes — we never store your plain-text password.
• Property scenarios: The financial figures, addresses, and notes you enter into the calculator.
• First Home Journey data: the answers you give in the journey — income, savings, household details, your budget and maximum price, and the places you save. If you're signed in, we store this on our servers so it follows you across devices.
• Reviews you submitted: suburb reviews written while submissions were open are published on the relevant suburb page with your display name; email us to have one removed.
• Profile information: Display name, optional profile photo, and colour preferences.
• Communications: Any messages you send us via the contact form or email.

Information collected automatically

• Usage data: Pages visited, features used, and time spent on the Service.
• Device information: Browser type, operating system, and screen resolution.
• Log data: IP address, access times, and referring URLs.

Information we do NOT collect

• We do not collect payment card details (processed by our payment provider).
• We do not purchase or import third-party marketing lists.

3. How we use your information

We use the information we collect to:

• Provide, operate, and maintain the Service.
• Authenticate you and keep your account secure.
• Sync your saved property scenarios across devices.
• Send you essential account communications (password resets, billing notices).
• Respond to your support requests.
• Improve and develop new features based on usage patterns.
• Comply with our legal obligations.

We will not use your information for purposes materially different from those described above without first obtaining your consent.

4. Sharing your information

We do not sell, rent, or trade your personal information. We may share it only in these limited circumstances:

• Service providers: Hosting, database, payment processing, and analytics providers who process data on our behalf under their own privacy terms.
• Legal requirements: Where required by law, court order, or to protect the rights and safety of our users.
• Business transfers: If we merge or are acquired, your data may transfer to the new owner subject to the same privacy commitments.

Sharing you initiate

If you create a journey share link, anyone who has that link can view your journey (including your first name and your financial answers) until you revoke it. An edit link lets the person you give it to change your journey. The same applies to scenario share invitations. We create these links only when you ask, and you can revoke them from the journey page.

Bot-protection processors

To distinguish humans from bots on our sign-in and sign-up pages we use Cloudflare Turnstile. The Turnstile widget runs invisibly in your browser and gathers signals about your browser environment (e.g. user-agent characteristics, simple proof-of-work challenges) to issue a short-lived verification token. Cloudflare may receive your IP address and limited browser metadata as part of this check. Cloudflare's processing is governed by Cloudflare's Turnstile Privacy Addendum. The token is single-use, expires within five minutes, and is never used to track you across sessions.

5. Data storage and security

Your data is stored on servers operated by our hosting and database providers (such as Netlify and Upstash), which may be located in Australia or overseas. We use measures including:

• TLS/HTTPS encryption for all data in transit.
• Passwords are stored as salted scrypt hashes — we never store your plain-text password.
• Access to stored data limited to the operator of the Service and the service providers we rely on.

No method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security.

6. Cookies and tracking

We use one essential HttpOnly Secure cookie (es_session) to authenticate your login session. This cookie contains a random session identifier — not your email, name, or any personal information — and cannot be read by JavaScript in your browser.

We also use browser localStorage to store application data on your device, including your in-progress journey and calculator drafts. This data stays on your device unless you sign in, in which case your journey and scenarios sync to our servers so they follow you across devices. We also keep a short list of the pages you visited before signing up, which is attached to your account if you create one. Your authentication token is not stored in localStorage.

We use Google Analytics to understand how the Service is used (for example, which calculators and features are most used). Google Analytics sets its own cookies and may receive your IP address, device and usage data, and — when you are signed in — an account identifier and email address, so that we can analyse usage across your sessions. Google processes this data under Google's Privacy Policy. See our Cookie Policy for full details.

7. Your rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate data.
• Deletion: Request deletion of your account and associated data.
• Portability: Request your data in a portable format.
• Objection: Object to certain processing activities.

To exercise any of these rights, please contact us at privacy@equitysight.app. We aim to respond within the timeframes required by applicable law.

8. Data retention

We retain your account data for as long as your account is active or as needed to provide the Service. If you delete your account, we will delete or anonymise your personal data within 30 days, except where retention is required by law.

9. Children's privacy

The Service is not directed to children under 16. We do not knowingly collect personal information from children. If you believe a child has provided us with personal information, please contact us and we will promptly delete it.

10. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting a notice on the Service or by email. Your continued use of the Service after changes take effect constitutes acceptance of the revised policy.

11. Contact us