Privacy Policy

What we collect

• Account: your email and password. Passwords are handled by Supabase Auth; we never see them in plain text.
• Searches and projects: the addresses you search, the property data we look up for them, the project details you enter, the files you upload (such as surveys and plans), and the reports, site plans and documents we generate for you.
• Application details: the applicant and owner names, email and phone you type into an application form.
• Payments: Stripe handles payment, and we never see or store your card number. We keep a record of what you bought, the amount and the date.
• Usage analytics: product events such as "ran an analysis" or "opened checkout". Each event records the page it happened on and the page you came from (never the part of the web address after a "?"), the campaign tags of the link you arrived from, your device type, and details such as the county or city, zoning district, verdict, project type, or the product and price at checkout. Events are tied to a random ID stored in your browser, and to your account when you are signed in. Events never include the address you searched, your email, name or phone.
• Usage limits: to apply limits to visitors who are not signed in, we store a salted one-way hash of the IP address, never the IP address itself.
• Messages: what you send us through the contact form or feedback, the email address you give when you join a waitlist (such as the construction-documents waitlist on our homepage), and the email address you give when you ask us to email you a report.
• Lead forms on our ad pages: if you fill in the form on one of our ad landing pages (addresses beginning /lp/), we store the name, email, phone and property address you enter, with the campaign tags and ad click IDs of the link you came from and the full web address of the page that sent you there, in our database as a lead, and email them to our own inbox so we can follow up.
• Ad lead forms: if you submit an instant form in one of our Facebook or Instagram ads, Meta passes us the details you entered in it, and we store them in our database as a lead.

How we use it

To provide the Service (running your analyses, drawing site plans, generating documents, processing payments), to improve it, and to write to you about your account. To look up a property we send its address or coordinates, never your name or email, to public data services such as county and city GIS servers, FEMA, the U.S. Fish & Wildlife Service, the U.S. Census Bureau and OpenStreetMap.

Service providers

These companies process information for us, only as needed to run the Service:

• Stripe: payments, subscriptions and billing. Your card details go to Stripe, never to us.
• Supabase: our database, storage for the files you upload, and sign-in.
• Anthropic: AI. The AI lot check sends the lot's map coordinates and the name of its local government, never the address. Researching a zoning district and writing your verdict summary send the zoning district, the local government and your project details, never the address. Two features send the property address: writing your application text (with your project details and the applicant details you typed on the form) and suggesting zoning districts that allow your project when the lot's zoning is uncertain (with the local government and your project type). Reading a survey, plan, document or ordinance text you give us sends that file or text, which may show the address.
• Mapbox: address search (the address you type is sent to look it up) and map and aerial images.
• Resend: email: password resets, reports you ask us to email you, reminders you set, and passing the messages and lead-form details you send us to our inbox.
• Vercel: hosting the website and app, and page-view analytics.
• Meta: ad measurement on our ad landing pages only (described under Cookies below), and passing us the details you enter in a Facebook or Instagram ad lead form.

What we don't do

We don't sell your personal information. We don't share your project data with anyone except the service providers listed in this policy, as needed to run the product, or when the law requires it. Your projects, saved addresses and reports are never sent to advertising networks; the ad measurement described below happens only on our advertising landing pages, never inside the app.

Cookies & local storage

We use browser storage for sign-in sessions, saved drafts, and the random analytics ID. The app itself (every page you use to search, analyze, or manage a project) carries no third-party advertising cookies.

Our advertising landing pages (addresses beginning /lp/, which you reach only by clicking one of our ads) load the Meta advertising pixel, which sets a Meta cookie and tells Meta that the page was viewed and whether a form was submitted. That measures ad performance; we never send Meta your name, email, phone, or the addresses you look up. If you don't want it, don't click our ads, or block third-party cookies. Email hello@zonar.pro to opt out of ad measurement or to ask us not to share your information.

How long we keep it

We keep your account, projects and uploaded files until you ask us to delete them. To delete your account and its data, email hello@zonar.pro from the email address on your account and we'll complete it within 30 days. We keep purchase records for as long as tax and accounting rules require, and Stripe keeps its own payment records. Analytics events, which never contain your address or email, are kept to understand how Zonar is used. Leads from our ad forms are not analytics events: they are kept as lead records, with what you entered, until you ask us to delete them.

Changes & contact

Material changes will be posted here with a new effective date. Questions for Zonar LLC: hello@zonar.pro