Privacy notice
Jason Ramirez operates PermitBriefly. This notice describes the information processed by the service and its providers. Contact support@permitbriefly.com for privacy questions or requests.
Public permit information
PermitBriefly uses public building-permit records to provide property addresses, permit numbers, descriptions, issue dates, city/source information, valuations, and reported contractor information when available. Status and final dates are included when available. Subscribers receive records for their authorized trade and territory through the dashboard and exports. Contractor grouping is restricted to the authenticated owner.
Private homeowner phone numbers and email addresses are prohibited in our permit dataset and subscriber outputs. We do not append homeowner contact lists. Collection selects permitted fields and applies contact-pattern filtering before normalized records are written. Additional filtering protects snapshots, dashboard responses, CSVs and brief content. Automated filtering is not a guarantee that every unusual or disguised contact format can be recognized. Please report an unexpected contact detail to support so we can investigate and remove it from the copies we control. Email addresses voluntarily provided for subscriber accounts, waitlists or support are separate from prohibited permit contact details.
The service does not provide household or project-priority recommendations, predictions of buying intent or project readiness, outreach templates, or mail-merge exports. It does not send letters or contact property occupants on your behalf. Trade categories are automated filters of reported descriptions; they are not facts supplied by the city. City identity, permit number and available collection timestamps identify the source context so you can verify details with the issuing city.
Account, waitlist and support information
When you acknowledge the commercial policies at checkout, we record the acknowledgment time, policy version and integrity identifier, selected plan, price identifier, amount, currency and renewal interval. We keep this minimal acknowledgment with the private checkout reservation and copy the policy and price details into Stripe checkout metadata to reconcile the purchase with the terms shown. These records are retained with billing records under the manual-review limits below.
For subscriptions, we store an account identifier, email address received from Stripe, plan/tier, trade selections, territory/group and city selections, subscription and payment status, billing-environment status, creation/update times, Stripe customer and subscription identifiers, and access/seat or conflict status. We also store email opt-out settings and tokens, delivery/export attempt identifiers and outcomes, and processed billing-event identifiers and timestamps. These records support sign-in, access control, billing reconciliation, exclusivity and duplicate-delivery prevention. Refund requests record the account, email, plan, seat, first-charge date, request date and processing status. Card details are entered on Stripe’s hosted pages; our application does not store full card numbers.
The waitlist collects an email address and records the gutter trade, seven-city territory/cities and enrollment time. The owner uses it to review interest and availability. The current application has no automated availability-notification sender. Joining does not authorize unrelated marketing; any future availability-notification process must be disclosed before activation.
Support correspondence includes the sender address, message headers, subject, message text and any attachments you choose to send. It is used to answer support, billing and privacy requests. Please do not send card numbers, passwords or unnecessary sensitive information.
Account and waitlist records are held in the backend database. They are not exposed through a public customer directory. Owner views require a server-validated owner session; public and ordinary authenticated database roles have no access to the application’s private schema or tables. Subscriber access is checked against the signed-in subscription and current entitlement. The owner and authorized service-provider systems can process information needed to operate the service.
Requested subscriber sign-in emails
October 6, 2026 update: You can request a sign-in email for the email address associated with your subscription. Each link is valid for 15 minutes and can be used once. The email may contain separate, labelled links for your subscriptions. Requesting a sign-in email does not resume weekly briefs or change an existing email opt-out. Delivery failures, complaints, request limits or an unresolved earlier delivery attempt may require support assistance. We store protected link verifiers, account associations, request, expiry and use times, limited delivery outcomes, and protected email identifiers and counters for abuse prevention. These application records contain no usable sign-in link. Link expiry prevents sign-in with that link; it does not itself delete these records. They remain subject to the manual review and provider-retention limits below. Sign-in still creates the one-hour session cookie described below; it does not restore expired or refunded access.
The global request counter is replaced when a new hourly window is used. Individual request-limit entries older than 24 hours are removed when the same address next requests sign-in; the protected address identifier remains until manual review. This limited counter maintenance does not remove delivery attempts, sign-in verifiers, suppression records or their account associations.
Saved permits, cookies and tracking
Saved permits are bookmarks containing city and permit-number identifiers in this browser’s local storage, not a browser-only copy of our permit database. Click a selected star to remove an individual bookmark, or clear this site’s browser storage to remove all saved selections. They do not sync between devices. Clearing browser storage does not delete server records, provider records or CSV files you previously downloaded. The service worker caches application files, not authenticated permit snapshots; older downloaded copies remain under your control.
Sign-in uses a one-hour session cookie marked HttpOnly and SameSite=Strict, and Secure on the hosted site. The application uses local storage for bookmarks and browser cache storage for its application files. The reviewed application includes no advertising pixels or analytics client script. Vercel still processes hosting requests and operational logs; browser-local bookmarks do not mean there are no server-side records. Stripe’s hosted billing pages and other provider websites have their own privacy practices.
The application does not change its behavior in response to browser Do Not Track signals. It does not embed third-party cross-site advertising trackers. Global Privacy Control is a separate signal, not the same as Do Not Track. The application has no GPC-specific handler; the absence of a handler must not be taken as a statement that a particular legal right does not apply. Contact support for questions about information associated with you or your property.
Service providers and recipients
- Vercel hosts the website and backend. It processes requests, network/request metadata, backend request data and operational logs to deliver and secure the service. The deployed application includes the permit snapshot. No external log drain was configured at review.
- Supabase hosts the PostgreSQL database containing subscription, seat, waitlist, refund, billing-event and delivery state, plus stored CSV exports and delivery logs.
- Stripe provides hosted checkout and the Customer Portal and processes billing/contact details entered there. It receives plan/selection metadata from the application and returns payment, customer and subscription identifiers and status. Sandbox transactions are separate from live billing records.
- Resend processes service emails, including the recipient, sender, subject, brief content, attached permit CSV when included, and delivery metadata. Opting out stops weekly brief delivery. A sign-in email is sent only when requested and does not resume briefs. Opting out does not cancel billing or remove dashboard access during a paid period. The current application does not route incoming support mail through Resend. Provider retention and backup periods apply separately from our application records. Deleting an application record does not delete provider email logs or backups. Earlier removal of an individual message may require a separate provider request; terminating an account is a different operation. See Resend’s retention terms.
- Migadu receives support emails and attachments at support@permitbriefly.com and retains a mailbox copy. It forwards those messages to the owner’s Google/Gmail inbox, where a separate copy is retained. Supabase and Stripe do not receive those support attachments through this forwarding route.
Retention and deletion limits
The comparison state removes historical run entries older than twelve weeks when a city refresh is processed. This is not a twelve-week deletion guarantee for all copies: archived refresh folders, deployment packages, exports and provider copies are separate. The current per-city comparison records retain the latest known permitted fields listed above, including older permits omitted from a rolling source, so they are not incorrectly counted as new. They have no automatic age-based expiry.
Current subscriber accounts, waitlist entries, refund/billing-event records, delivery logs and retained exports have no configured automatic deletion schedule. Migadu and Gmail support-message copies and attachments likewise have no application-managed expiry. They remain until separately reviewed and removed. Retention is handled through manual review of continuing support, billing, security and operational needs. You can request a review using the support address below; a written procedure is not evidence that every stored copy has already been reviewed or removed. A written retention schedule alone does not establish deletion of existing records, archived copies, exports, logs or provider copies. Cancellation or clearing browser storage does not automatically remove these records.
Provider-managed logs and backups have separate retention and recovery behavior. At our September 29, 2026 configuration review, Supabase’s Free plan did not include project backups; local operational copies and other providers’ retained copies are separate. We have not verified an end-to-end deletion deadline across Vercel, Supabase, Stripe, Resend, Migadu and Google. Removing a database record or one email copy does not delete all provider records, backups, billing records or downloaded files. We do not promise immediate deletion from every backup or provider.
Privacy requests
Email support@permitbriefly.com to request an account correction, waitlist removal, deletion, or investigation of an exposed contact detail. State the request and use the account/waitlist email when possible. The owner reviews requests manually and may ask for proportionate confirmation of account control before changing or disclosing private account data. Do not send a password or full card number. There is no automated deletion button.
The owner reviews the affected application and provider copies separately and explains what was corrected or removed, what could not be removed, and the specific reason for any continued retention, such as an unresolved billing dispute or applicable recordkeeping requirement. A privacy request does not itself cancel a subscription; use Manage billing for cancellation. Provider backups and independently downloaded copies may remain beyond removal from the active application.
Policy changes
Material policy changes will be identified in a dated notice on this page. We will provide additional notice or seek consent where required. The effective date of the published version identifies when that version applies.