Privacy Policy

Eaveon LLC, Florida, United States. For anything on this page, write to EavonAdmin@gmail.com.

Finding a roof and producing a measured report are two different things here, and only the second one is kept.

When you enter an address and we show you the building with its outline, that address is used to locate the parcel and is then gone. It is not written to our database, not logged, and not cached. Screen a list of addresses that way and no second copy of that list exists on our side. This is true whether or not you have an account.

The address does have to leave us in order to find the roof. It is sent to Google to turn the address into a point on the building, and to the US Census Bureau geocoder when Google does not resolve it. The resulting coordinates, not the address, are then used to fetch public lidar and aerial imagery.

One thing is recorded for each request that can cost us money, and it exists to stop one caller from exhausting the service: a rate-limit counter.

rate_counters.bucket_key

A keyed HMAC-SHA256 over the route name, the caller IP address, and the start of the ten-minute window. The raw IP address is never written, and the address you measured is never part of it.

rate_counters.count

How many requests that bucket has made in the window.

rate_counters.window_start / expires_at

The window the count belongs to. Rows are deleted once they expire.

The hash is one-way, and there is nothing in the row to join it against. It says that some connection made some requests. It does not say whose, or of what.

Producing a measured report changes this, and the reason is plain: a report cannot be delivered, reopened, or re-sent without keeping the thing it measured.

This applies to every finished report, not only to the ones bought with a card. A report measured with a credit is kept the same way, including one of the free credits a new account starts with. The line is the report, not the payment.

address

The street address measured. It is the subject of the report and prints on the sheet.

lat / lng

The rooftop point, when you tapped a specific building on the confirmation map.

map_snapshot

The aerial view of the roof with the outline drawn over it, exactly as it appeared when the measurement ran. It is part of the report.

customer_email

The email address Stripe returns with a payment, or the one on your account. It is how we reach you about that report.

owner_type / owner_id

Which account the report belongs to, when it was measured while signed in. It is what makes the report appear in your account rather than being reachable only by link.

stripe_session_id / stripe_payment_intent / amount

The payment reference, when a card was used, so a completed payment can always be matched to a report. A report measured with a credit has no session and records a zero amount.

report

The finished measurement, stored so reopening it does not re-run the solver.

access_token_hash

A SHA-256 of the retrieval link. The link itself is never stored, so a copy of the database yields no working report links.

Retention is two years. Every report is written with a purge date two years out, and we do not keep it past that. What survives the purge is the financial stub - the amount, the currency, the date - with the address, the image, the email and the account link removed.

Closing your account does the same thing immediately, to everything it holds, and any retrieval link already sent stops working at that moment.

Where a balance of prepaid reports exists, we store the balance and an append-only ledger of every movement against it: the amount, the reason, the payment or report it relates to, who granted it, and the balance afterwards. A balance belongs to a user or organisation identifier.

The single US$8.00 report does not use credits and does not need an account.

• This site sets no cookies.
• There is no analytics, no advertising, and no third-party tracking script on any page.
• Fonts are served from this site, not from a font provider.
• The satellite tiles on the confirmation map are fetched by your browser directly from the imagery provider, which is the USGS National Map by default. That provider sees your IP address, the way any site you load an image from does.

Google

Receives the address for autocomplete and for geocoding it to a rooftop point, and the coordinates for Solar imagery and the elevation model. This is how the roof is found and measured.

US Census Bureau

Receives the address only as a fallback, when Google does not resolve it or is not configured. Its geocoder is public and keyless.

USGS, via Amazon Web Services

Receives coordinates only. The lidar is the public USGS 3DEP dataset, hosted in a public Amazon S3 bucket, and the default map imagery is the USGS National Map.

Stripe

Processes the payment as merchant of record and holds the payment details you enter with it, the email you give at checkout, and the address, which is attached to the checkout session so the order can be identified.

Vercel

Hosts the site. Every request passes through it.

Neon

Hosts the Postgres database holding the records described above.

We do not sell data, and we do not share it for advertising. There is no fourth party beyond this list.

• A report link is 32 random bytes and is never stored. Only its SHA-256 hash is, and it is compared in constant time.
• Rate-limit rows hold a keyed hash of an IP address, never the address itself.
• The database connection verifies TLS, with the decision made in code rather than left to a connection string.
• The Google keys stay on the server. Your browser never receives one.

We claim no certification and no audit. The four sentences above are what the code does.

• A free lookup: there is nothing to delete, because nothing was kept.
• A purchased report: email us the address and the Stripe receipt and we will delete the order record. Deleting it deletes the report with it, and the link stops working.
• A rate-limit row: it holds no identifier we can search on, so it cannot be found and deleted for you. It expires on its own.

Stripe keeps its own record of a payment as its merchant of record, which we cannot delete on your behalf. That record is covered by the Stripe privacy policy.

When the product changes what it stores, this page changes in the same deploy. The date at the top says when that last happened.

Eaveon LLC
Florida, United States
EavonAdmin@gmail.com