Privacy Policy

ReportPoppy is a business tool for licensed real estate agents. This policy describes what ReportPoppy collects, why, and how it is handled. It applies to the ReportPoppy web app at reportpoppy.com and to the ReportPoppy app on iOS and Android, which is a wrapper around that same web app.

Who this is for

ReportPoppy is built for licensed real estate professionals and their brokerages. There is no public or anonymous area of the app. Everything requires a signed-in, account-holding user. ReportPoppy is not directed at children, and we do not knowingly collect information from anyone under 13.

What we collect

Your account information. When you create a ReportPoppy account, or sign in through the OfficePoppy suite, we store your name, email address, and phone number. Your phone number is used to verify your identity if you need to recover a forgotten password. Your password is never stored in plain text; it is salted and hashed before it touches disk.

Your profile and brand information. If you fill in your brokerage name, license number, headshot, logo, or brand colors, we store that so it can appear on your reports and your Prepared-by page. None of this is required to use the app.

The reports you build. When you generate a report, we store the property address, the comparable listings pulled from the MLS feed, the numbers and photos that make up that report, and, for shared reports, a frozen copy of the exact report you shared, so the link you send a client keeps showing the same thing every time it is opened. This data is tied to your account so you can find your own past reports and links again.

Property photos you upload. If a property has no MLS photo gallery (typically an off-market home), you may upload your own photos for that listing. These are stored with the report they belong to.

Session cookies. Signing in sets an HttpOnly session cookie so the app knows you are signed in as you move between pages. This cookie is functional only. It is not used for advertising and it is not read by any other website.

What we do not collect

• Your device's location. ReportPoppy never asks for or reads GPS or network location. Every address in the app is text you type; the comp-area map places pins by looking up that typed address, not by reading where your phone is.
• Your contacts. ReportPoppy never reads your phone's address book. When you share a report by text or email, the app opens your phone's own compose screen, and you type or pick the recipient there.
• Your own financial accounts. The investor-math fields on the Buyer and Investor Report (offer price, rent, down payment, interest rate) describe a property you are analyzing for a client. They are not your personal bank, income, or credit information, and we do not collect any of those about you.
• Payment card details. Subscription billing runs through the App Store, Google Play, or the OfficePoppy suite's billing, none of which routes your card number through ReportPoppy's own servers.

Where the report data comes from

Comparable listings, sold prices, photography, and market data come from CRMLS through the Trestle feed, under license, and stay inside the product; they are never resold or handed to a third party. When a property is off-market, the county assessor's public parcel record fills in the facts the MLS does not carry (beds, baths, living square footage, lot size, year built). That is public record data, already public before we look it up.

How data is shared

We do not sell your data, and we do not share it with advertisers or data brokers. ReportPoppy contains no advertising and no third-party ad or analytics SDK.

The one exchange outside ReportPoppy's own servers is with the OfficePoppy suite (poppyoffice.com), an affiliated service in the same product family, used so that signing in to one Poppy app can sign you in to ReportPoppy without asking you to sign in twice, and so your brand kit (name, brokerage, logo, colors) can carry across the suite if you use more than one Poppy app. This is a first-party affiliated service, not an outside advertiser.

We may disclose information if required by law, such as in response to a valid subpoena or court order.

How long we keep data

Your account and report data are kept for as long as your account is active. A client-facing share link is kept as a permanent, stable address for as long as you keep it (see Share links, below), so that a document you already sent a client never goes dead.

Share links

A shared report is a published document, not a live query. It shows the exact numbers that were on your screen the moment you clicked Share, and it keeps showing those same numbers every time it is opened, until you run the property again and share it again. Anyone with the link can view the report; the link itself is not indexed by search engines and is not discoverable without being given the URL directly.

Your choices

You can update your profile and brand information at any time from inside the app. To request that we delete your account and the data tied to it, or to ask a question about anything in this policy, contact us below. We do not currently offer a fully self-service account-deletion button inside the app; a request by email is handled by a person, typically within a few business days.

Security

Passwords are salted and hashed, never stored in plain text. Sessions are transmitted only over HTTPS and held in HttpOnly cookies, which cannot be read by page scripts. Repeated wrong sign-in attempts on an account are slowed down automatically to make guessing a password impractical.

Changes to this policy

If this policy changes in a way that matters, we will update the effective date above and, for a material change, make a reasonable effort to let account holders know.

Contact

Questions about this policy, or a request to access or delete your data, can be sent to: