Privacy

Who uses it

Anyone may sign in with an email address, and that address is the whole of the account: there is no password and nothing else to give. A signed-in person sees nothing until an administrator of an organization adds them to it. What they then see is that organization’s records and nobody else’s.

What Fireveyor holds

Signing in. The email address you sign in with, when you first signed in, and which of our addresses you signed in at. The six-digit code and the sign-in link are kept only as hashes and expire after ten minutes; whichever is used first retires the other. A signed-in browser carries one cookie, good for thirty days. Sign-in attempts are counted against a hash of the address and a hash of the network they came from — neither is stored as itself — and those counters are thrown away about an hour later.

Organizations. The organization’s name, region and contact details, who its members are, what roles each holds, which modules it has switched on and how it has customized them, and the contractors it works with and the terms it has agreed with them.

Properties and their owners. What an organization enters or imports about a property lot: the parcel number, the address, the acreage and land use, what public records and maps say about its fire hazard, and the owner’s name and mailing address as the county assessor lists them, with a phone number or email address where the organization has one. Then what the organization finds when it assesses the lot, what it recommends, and the report it produces.

Photos and documents. The files an organization attaches — photographs of a property, an inspection document, a contractor’s agreement. Each is hashed when it is attached and kept with what the file says about itself. Nothing is ever deleted: a file that is replaced or removed is kept, with a record of when and by whom.

Introductions. When an owner asks to be introduced to a contractor, that request, who it went to, what came of it, and the fee the contractor owes the organization for it.

Logs. The operational record of requests, kept for thirty days and then deleted. It never holds a sign-in code, a property record or a file.

Reports for property owners

A report an organization publishes for a property owner is reachable only by its link, which carries a long random token. It is listed nowhere, it asks not to be indexed, and the organization decides who is given the link. The report’s response form — asking to be introduced, asking to be called, or asking not to be contacted — records the answer on the property’s record. An owner who asks not to be contacted is not contacted.

Cookies

Two, both necessary: one that says a sign-in is under way, and one that says you are signed in. Both are signed, sent only over HTTPS, and unreadable by script. There is no analytics, no advertising and no third-party script of any kind — the Content-Security-Policy every page is served under admits nothing but this site.

Where it lives

On Amazon Web Services in the United States, in an account Outright Mental Inc. owns: the records in a database table, the files in a private bucket with no public address of its own. A file is shown through a link that expires in an hour. Email is sent by Amazon SES from an address of ours.

Who else sees it

Nothing is sold, rented or handed to an advertiser, and nothing here trains anybody’s model. The companies above host it and see what hosting it requires. An organization’s members see that organization’s records. A contractor is given a property owner’s name and contact details only after the owner has asked to be introduced, and only the contractor the owner asked for. Beyond that, Fireveyor discloses what it holds to nobody, or where the law leaves no choice.

How long

Sign-in codes and links last ten minutes; a session lasts thirty days; the counters behind the rate limits last about an hour; logs are deleted after thirty days. Organization, property, assessment and introduction records are the organization’s books and are kept until the organization asks for them to be removed.

Asking

To see what Fireveyor holds about you, to correct it, or to have it deleted, write to hi@outrightmental.com. If you are a property owner, the organization named on your report is the one holding the record, and it will answer too. Say enough to find it — an address, a parcel number — and it will be answered by a person.