Privacy Policy

Last updated: February 20, 2026

This Privacy Policy describes how Condition Report ("Company", "we", "us", "our") collects, uses, and protects your information when you use the Condition Report service at condition-report.com ("Service").

1. Information We Collect

Information You Provide

Data	Purpose	Retention
Email address	Account creation, report delivery, password reset	Until account deletion
Name	Account profile, report generation	Until account deletion
Property address	Included in generated reports	Report metadata kept with account; PDF deleted after 24 hours
Room photographs	AI analysis for condition report	Deleted after 24 hours
Password	Account authentication	Stored as bcrypt hash; never stored in plaintext

Information Collected Automatically

Data	Purpose	Retention
Device fingerprint	Session management, free trial tracking	Stored in localStorage on your device and linked to your account
IP address	Rate limiting, security	Not stored persistently; used in real-time only
UTM parameters	Marketing attribution	Stored in sessionStorage; cleared when you close the tab

Payment Information

Payment processing is handled entirely by Stripe. We do not collect, store, or have access to your credit card numbers, bank account details, or other financial information. Stripe may collect information necessary to process your payment in accordance with their privacy policy.

2. How We Use Your Information

• Provide the Service: Generate condition reports from your uploaded photographs
• Deliver reports: Send reports via email, generate download links, enable sharing
• Account management: Authenticate you, manage subscriptions, track report history
• Transactional emails: Send email verification, password reset links, and report deliveries
• Improve the Service: Understand usage patterns to improve performance and features
• Security: Detect and prevent fraud, abuse, and unauthorized access

3. AI Processing

When you upload photographs, they are sent to Anthropic's Claude API for AI-powered analysis. This is the core of how our Service works.

• Photographs are transmitted securely (HTTPS) to Anthropic's servers for processing
• Anthropic processes the images to generate condition assessments and returns the results to us
• We do not use your photographs to train AI models
• Anthropic's data handling is governed by their privacy policy and API terms of service

4. Data Retention

• Uploaded photographs: Automatically deleted from our servers after 24 hours
• Generated PDF reports: Automatically deleted from our servers after 24 hours
• Share links: Active for 7 days after creation
• Account data (email, name, report metadata): Retained until you request deletion
• Email/password reset tokens: Expire after 24 hours (verification) or 1 hour (reset) and are deleted

5. Third-Party Services

We use the following third-party services to operate:

Service	Purpose	Privacy Policy
Anthropic (Claude API)	AI photo analysis	anthropic.com/privacy
Stripe	Payment processing	stripe.com/privacy
Resend	Transactional email delivery	resend.com/legal/privacy-policy
Railway	Application hosting	railway.app/legal/privacy
Cloudflare	DNS, CDN, SSL	cloudflare.com/privacypolicy
Google Ads	Advertising and conversion tracking	policies.google.com/privacy

6. Cookies and Local Storage

We do not use traditional cookies. Instead, the Service uses:

• localStorage: Stores your device fingerprint (for session management) and account data (for login persistence). This data stays on your device and is not transmitted to third parties.
• sessionStorage: Temporarily stores UTM marketing parameters. Cleared when you close the browser tab.

Third-party services (Google Ads, Cloudflare, Stripe) may set their own cookies in accordance with their respective privacy policies.

7. Data Security

We implement the following security measures to protect your data:

• All data transmitted over HTTPS (TLS encryption)
• Passwords stored using bcrypt hashing (never plaintext)
• Rate limiting on all sensitive endpoints
• Security headers (HSTS, CSP, X-Frame-Options)
• Automatic file deletion after 24 hours
• Database connection pooling with secure credentials

While we take reasonable measures to protect your information, no method of electronic transmission or storage is 100% secure.

8. Your Rights

You have the right to:

• Access: Request a copy of the personal data we hold about you
• Correction: Update or correct your account information via your profile
• Deletion: Request deletion of your account and associated data
• Data portability: Download your generated reports (available for 24 hours after generation)
• Opt out: You may stop using the Service at any time

To exercise these rights, contact us at [email protected].

9. Children's Privacy

The Service is not intended for individuals under 13 years of age. We do not knowingly collect personal information from children under 13. If we become aware that a child under 13 has provided us with personal information, we will take steps to delete it.

10. International Users

The Service is hosted in the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States. By using the Service, you consent to this transfer.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will update the "Last updated" date at the top of this page. Continued use of the Service after changes constitutes acceptance of the updated policy.

12. Contact Us

For questions about this Privacy Policy or to exercise your data rights, contact us at:

Condition Report
Email: [email protected]
Website: condition-report.com