Privacy Policy

1. Who we are and what this policy covers #

This Privacy Policy explains how DeedToGo ("we", "us" or "our") collects, uses, shares and protects personal information through DeedToGo, our research platform for US tax deed auctions at https://app.deedtogo.com (the "Service").

It applies to:

• the DeedToGo web application, including the version you install on a phone or computer and our Android app on Google Play;
• the e-mails we send you;
• the optional DeedToGo Telegram bot, if you link it to your account;
• the early-access form on our marketing website, for the information that form sends us.

It does not apply to the rest of our marketing website, or to websites run by others that you reach from the Service, such as county clerk, property appraiser, tax collector and auction websites. Those have their own privacy policies.

Read this policy together with our Terms of Service. Our Cookie Policy covers cookies and similar technologies in more detail.

2. Information we collect #

We get information directly from you, automatically as you use the Service, from third parties, and from public property records.

Information you give us

• Account. Your first and last name, e-mail address and password, which we store only as a one-way hash. You can also add a phone number in Settings; it is optional, and today we only store it with your profile.
• Preferences and acceptances. Your language, theme, notification settings and the product tours you have seen, and the date and version of the terms and notices you accept, such as the Terms of Service and the AI assistant notice.
• Investor profile. If you answer our survey: your strategy, budget range, preferred counties and property types, and how you rank what matters to you.
• Research and Pipeline content. Notes and tags on properties; your Pipeline and its stages; bid planning figures such as maximum bid, liens, deposits, costs to clear and registration deadlines; due-diligence checklists; auction outcomes and winning bids; followed counties; auction and custom reminders; and properties you add yourself.
• Field photos. Photos you take or upload for a property, with their caption, category and time. If you tick "Attach my location" and allow location access, we also store your device's precise location (latitude and longitude) at that moment. The box starts unticked on a property's page and ticked on the quick-capture screen; you can untick it before saving.
• AI assistant. Your messages, the replies, and the actions the assistant takes or proposes (see "The AI assistant").
• Bug reports. Your text, the address of the page you were on, and your browser's user-agent string, which identifies your browser and operating system.
• Telegram link. Your chat ID, a display handle (your @username, or your first name if you have none), and when you linked and last wrote to our bot. We never receive your phone number.
• Orders. For a title report: the property, amount, payment status and the report we deliver. Once online billing is available: the plan or credit pack you buy and its payment status.
• Early-access sign-ups. From the form on our marketing website: your e-mail address, name, language, investor type, how you research today, counties of interest, message, the time you gave consent, and the IP address the form came from.
• Messages to us. Your e-mail address and what you write.

Information collected automatically

• Server and security logs. Technical details of each request, such as IP address, page, time and browser user agent. For a failed sign-in we record the e-mail address entered, the IP address and the user agent, to detect and block attacks.
• Rate-limit counters. Short-lived counts of requests by IP address and by account or e-mail address, to stop abuse.
• Plan usage. The properties you unlock and when; the credits you use; your exports; the number of assistant messages you send and the resources each one uses; and whether you opened a weekly Hot Deals recommendation, with any feedback you give on it.
• Cookies and device storage. The cookies that keep you signed in (and, in our Android app, the one that identifies the app), plus preferences and offline data kept in your browser. See "Cookies and information stored on your device" and our Cookie Policy.

The Service uses no advertising tools, analytics tools, tracking pixels or session recording.

Information from third parties

• Google sign-in. Your name, e-mail address, Google account ID and whether Google has verified your e-mail address. We do not receive your Google password, contacts or other Google data, and we do not store your profile photo or Google tokens.
• Payment processor. Once online billing is available: whether a payment succeeded, your customer and subscription identifiers, and your plan and billing period. We never store your card number.
• Telegram. The messages you send our bot, with your chat ID, name and username. We keep the chat ID and display handle described above; messages addressed to the assistant are stored with your conversations, as described in "The AI assistant".

Public-record information about property owners

The Service shows information about properties offered at tax deed auctions, which can include the names and mailing addresses of owners of record, whether an owner appears to be absent or to claim a homestead exemption, sale history and the names of lienholders. We collect and organize it from public records of Florida county offices (such as property appraisers, tax collectors and clerks of court) and the Florida Department of Revenue.

We use it only to show it to users researching those properties, on property pages and in the reports they download. We never send owner names or mailing addresses to the AI assistant, and we do not use this information to contact owners. Property owners with questions can write to [email protected].

3. How we use information #

We use personal information to:

• Provide the Service. We create and manage your account, sign you in, show property research, save your notes, Pipeline and photos, apply your plan and credits, and deliver the reports you request.
• Send reminders and alerts. We send the ones you set up: in the app, by e-mail if you turn it on, and by Telegram if you link it.
• Run the AI assistant. See "The AI assistant".
• Recommend properties. If your plan includes weekly Hot Deals recommendations, we choose them using your investor-profile answers, the counties you follow, the properties you have already unlocked or added to your Pipeline, and your feedback on earlier picks. They are only suggestions and do not change your access, price or eligibility for anything.
• Provide support. We answer your questions and fix the problems you report.
• Handle billing. We process payments, manage subscriptions and credits, and keep required financial records.
• Keep the Service secure. We authenticate users, block fraud, abuse and attacks, enforce rate limits and investigate incidents.
• Improve the Service. We see which features are used and measure the cost and reliability of features such as the AI assistant.
• Communicate with you. We send password resets, order confirmations and notices that your trial is ending. If you signed up for early access, we also send our welcome e-mail.
• Comply with the law. We meet legal obligations, answer lawful requests, enforce our Terms of Service, and establish, exercise or defend legal claims.

We do not use your content to train artificial intelligence models. We do not make any decision about you that has legal or similarly significant effects based solely on automated processing.

4. The AI assistant #

DeedToGo includes an optional AI assistant. It answers questions about your account, your Pipeline and the properties in the Service, and can carry out some actions for you, such as adding a note or creating a reminder. It may not be available on every account or plan.

Its replies are generated by a large language model on Google Cloud Vertex AI. Before your first use, we show you a notice that names the provider and explains what is sent, and ask you to accept it. If we change provider, we ask again.

What is sent to Google Cloud

• Your messages, exactly as you write them. Leave out anything you do not want to share.
• Context such as today's date, your language, your plan, your remaining credits and assistant messages, the number of reminders you have pending, and the screen of the app you have open.
• Information the assistant looks up in your account, such as Pipeline stages, tags, bid planning figures, due-diligence status, auction outcomes, followed counties, reminder settings, which properties you have unlocked and the text of your reminders. It can also include up to three of your latest notes on a property, with e-mail addresses and U.S.-format phone numbers in those notes masked first. The masking is automatic and may not catch every format, so leave out of your notes anything you do not want sent.
• Public-record property information, such as parcel number, site address, city, county, assessed values and auction details. For properties you have unlocked, this includes our analysis of them.

How the data is used and kept

• Google processes the data on our behalf to generate replies. Under its Google Cloud terms, Google may briefly cache this data and may keep it for a limited time to detect abuse. Our Google Cloud terms do not allow Google to train its models on our customers' prompts and responses without our permission, and we have not given that permission.
• We use Google's global endpoint, so Google may process a request in any region where it runs the model, including outside the United States.
• Conversations are stored in your account so that you can return to them. Each one is erased automatically 90 days after its last activity: its messages, actions, title and the record of which screen you had open.
• For each reply we keep a usage record without content (amount of text processed, cost, time and outcome), because it determines your plan limits and our costs.
• While you have access to the Service, "Delete my chats" on the assistant's page erases all your conversations in the same way. If your trial or plan has ended, write to [email protected] and we will delete them for you.
• Changes the assistant makes in your account, such as notes or reminders, become part of your account data. You can undo them from the assistant for 24 hours.

If you link Telegram and the assistant is available to you, free-text messages you send our bot follow the same path: they go to Google Cloud Vertex AI, are stored with your assistant conversations, and are erased on the same schedule.

AI replies can be wrong. Check important facts against the source records, as our Data Disclaimer explains.

5. Google sign-in and Google user data #

If you sign in with Google, we ask only for the basic profile and e-mail permissions (the "email" and "profile" scopes). Google sends us your name, e-mail address, Google account ID and whether your e-mail address is verified.

• We use it only to create your account, sign you in, keep your account secure and communicate with you about the Service. For example, Google's confirmation of your e-mail address helps us decide whether a Google sign-in may be linked to an existing account.
• We do not ask for your Gmail, Drive, contacts, calendar or other Google data, and we do not store Google access or refresh tokens.
• We do not sell Google user data, use it for advertising or use it to train AI models.
• We share it only with our service providers as described in this policy, when the law requires, or in a business transfer.
• Our staff look at it only to support you, keep the Service secure or comply with the law.

At https://myaccount.google.com/permissions you can remove DeedToGo's access to your Google account at any time. Doing so does not delete your DeedToGo account. To delete your account, see "Your choices and rights".

6. How we share information #

We share personal information only as described below.

Service providers

Other companies help us run the Service. They handle personal information for us, and each one receives only what it needs to do its job.

Your browser also loads content directly from other companies. They receive your IP address and browser information under their own privacy policies:

• Google Fonts, on every page;
• Google Maps and Street View, on map and property pages, which may set Google cookies;
• Unsplash and Wikimedia, which host the county photos on market pages.

See our Cookie Policy for details.

Services you choose to connect

If you link Telegram, messages between you and our bot pass through Telegram's servers under Telegram's privacy policy, and they are not end-to-end encrypted. If you sign in with Google, Google handles the sign-in under its own privacy policy.

Legal requirements and safety

We may disclose information if we believe in good faith that we need to: comply with the law or legal process; protect the rights, property or safety of DeedToGo, our users or others; address fraud, security or technical problems; or enforce our Terms of Service.

Business transfers

If DeedToGo is involved in a merger, acquisition, financing, reorganization, bankruptcy or sale of assets, personal information may be transferred as part of it. We will require the recipient to honor this policy, or tell you about any change and your choices.

With your consent, and de-identified information

We share information in other ways when you ask us to or agree to it. We may also share information that has been aggregated or de-identified so that it no longer identifies you. We keep de-identified information in that form and do not try to re-identify it.

7. Legal bases for processing #

If you are in the European Economic Area, the United Kingdom, Brazil, or another place whose law requires a legal basis for processing personal information, we rely on:

• Performance of a contract: to create your account, provide the Service, deliver reminders, reports and orders, and handle billing under our Terms of Service.
• Legitimate interests: to keep the Service secure, prevent abuse, improve the Service, provide support, and show public-record property information to users researching auctions. We weigh these interests against your rights, and you can object.
• Consent: for the AI assistant, Telegram, location on field photos and early-access e-mails. You can withdraw consent at any time; this does not affect earlier processing.
• Legal obligation: to keep financial records, respond to lawful requests and comply with other laws.
• Exercise of rights: to establish, exercise or defend legal claims, including in judicial, administrative or arbitration proceedings.

To create an account, you need to give us an e-mail address and a password, or sign in with Google, and accept our Terms of Service. We need this to enter into and perform our contract with you; without it, we cannot provide the Service. Everything else you give us, such as your name, phone number, notes, photos and their location, investor-profile answers and Telegram link, is optional: if you do not give it, you can still use the Service, without the feature that needs it.

8. How long we keep information #

We keep personal information only as long as we need it for the purposes in this policy, unless the law requires or allows us to keep it longer:

When you delete something in the app, such as a note, a photo, a Pipeline item, an auction reminder or your assistant chats, we delete it from our active systems. Cancelling a custom reminder stops it but keeps its text, and removing a property you added yourself from your Pipeline keeps the details you entered; both stay with your account until you ask us to delete them or your account is deleted.

When you delete your account, or we receive a verified request to delete it, we suspend the account right away. After a 30-day grace period we delete your content and remove your name, e-mail address and other personal details from the account record. We keep only what we need to comply with the law (such as purchase, subscription and credit records and paid reports, kept without your name or e-mail address), resolve disputes, enforce our agreements or keep the Service secure. Copies in backups are removed as those backups expire.

9. Your choices and rights #

You have these choices and rights wherever you live. Some laws give you more: see "US state privacy rights" and "International users".

Access, correction and deletion

While your trial or plan is active, you can view and correct your name, e-mail address, phone number and language in Settings, view, edit or delete your notes, tags, Pipeline, auction reminders and photos in the app, and cancel custom reminders. If your trial or plan has ended, or you cannot make a change yourself, write to [email protected]. To get a copy of the personal information we hold about you, write to [email protected]. Where the law gives you a right to portability, we provide the copy in a commonly used, machine-readable format.

You can delete your account at any time: sign in and open Settings › Profile › Delete account; if you cannot sign in or open Settings (for example, after your trial ends), follow the steps at https://app.deedtogo.com/account-deletion or write to [email protected] from the e-mail address on your account. Your account is suspended as soon as you ask, and after a 30-day grace period your information is deleted or de-identified as described in "How long we keep information". If you change your mind during those 30 days, write to [email protected] and we will restore it. Cancelling a subscription does not delete your account or your data.

Communications

• E-mail reminders and alerts. Turn e-mail off for all properties in the notifications section of Settings, or for one property in its reminder settings. A property's reminder e-mails go out only if you turn them on. The same switch also stops the e-mail telling you your free trial is ending; the in-app notice still appears.
• Early-access e-mails. Use the unsubscribe link in any of them.
• Service messages. Password resets, order confirmations, billing notices and the in-app notice that your trial is ending are needed to use your account, so you cannot opt out of them while you have one.
• Telegram. Send /stop to our bot at any time, or disconnect Telegram in Settings while you have access to the Service.

AI assistant and location

• You do not have to use the AI assistant, and you can stop at any time. While you have access to the Service, you can delete your conversations from the assistant's page; otherwise, write to [email protected]. Conversations are also erased automatically 90 days after their last activity.
• Location on field photos is optional. Leave "Attach my location" unticked, or block location access for DeedToGo in your browser or device settings. Photos you have already saved keep their location; delete a photo to remove it.

Objection, restriction and withdrawal of consent

To object to processing based on our legitimate interests, ask us to restrict processing, or withdraw your consent, write to [email protected].

How we handle requests

• Verification. We check every written request before acting on it. A deletion you start while signed in is confirmed by typing DELETE and, for e-mail accounts, your password. For other requests, we send a confirmation message to the e-mail address on your account and act only after you confirm from that inbox; we may also ask you to confirm while signed in. We use any extra information we ask for only to check the request.
• Authorized agents. Someone else can make a request for you. Unless they hold a valid power of attorney, we will ask for your signed permission and may ask you to confirm your identity with us.
• Timing. We confirm receipt within 10 business days and respond within 30 days, or sooner if your law requires. If we need more time and the law allows it, we will tell you why.
• No discrimination. Exercising your privacy rights will not change your access, price or quality of service.
• Appeals. If we decline a request, we will explain why. To appeal, reply to our decision with "Appeal" in the subject line, and we will answer within 45 days. If you are still not satisfied, you can contact the attorney general or data protection authority where you live.

10. US state privacy rights #

Residents of California and several other US states have rights under state privacy laws. We give all our users the rights described in this policy, whether or not a particular law applies to us.

Notice at collection for California residents

We collect the categories of personal information below, as the California Consumer Privacy Act (CCPA) defines them. The sources are described in "Information we collect" and the purposes in "How we use information".

Disclosures to a payment processor begin only once online billing is available.

• Sale and sharing. We do not sell personal information or share it for cross-context behavioral advertising, and we have not done so in the past 12 months. We do not knowingly sell or share the personal information of consumers under 16.
• Sensitive personal information. We use it only to provide the Service and keep it secure, and as the CCPA regulations otherwise allow. We never use it to infer characteristics about you, so the right to limit its use does not apply.
• Retention. We keep each category for the periods in "How long we keep information".
• Your rights. You can ask what personal information we collect, use and disclose, and for a copy of it. You can also ask us to delete or correct it. Write to [email protected].
• Direct marketing. We do not disclose personal information to third parties for their own direct marketing.

Other states

If you live in a state with a comprehensive consumer privacy law, such as Colorado, Connecticut, Oregon, Texas, Utah or Virginia, you may have the right to confirm whether we process your personal information, to access, correct or delete it, to receive a portable copy, and to opt out of targeted advertising, sale and significant profiling, none of which we do. To use your rights or appeal a decision, see "Your choices and rights".

Global Privacy Control and Do Not Track

We treat a Global Privacy Control (GPC) signal from your browser as a valid request to opt out of the sale and sharing of your personal information. Since we do neither, it changes nothing further. The Service itself does not track you across other websites, so it does not respond differently to Do Not Track signals. Companies whose content loads on our pages, such as Google (Google Fonts, Google Maps and Street View) and Cloudflare, may collect information about your online activity over time and across different websites under their own policies, and they decide how to respond to these signals.

11. International users #

The Service is built for research on US tax deed auctions and is available in English, Spanish and Portuguese. If you use it from outside the United States, your personal information is transferred to and processed in the United States, and in other countries where we or our service providers operate, whose data protection laws may differ from yours.

Where the law requires a transfer mechanism, we rely on safeguards such as the standard contractual clauses our providers offer, or on another basis the law allows, such as the transfer being necessary to perform our contract with you. To receive a copy of the safeguards we rely on, write to [email protected].

European Economic Area and United Kingdom

DeedToGo is the controller of your personal information. Under the GDPR and the UK GDPR you have the right to:

• access, correct and delete your personal information;
• restrict or object to its processing;
• receive it in a portable format;
• withdraw your consent at any time;
• complain to your local data protection authority.

Brazil

Under Brazil's general data protection law, the Lei Geral de Proteção de Dados (LGPD), DeedToGo is the controller of your personal data. You have the right to:

• confirm that we process your data, and access it;
• correct it;
• have unnecessary, excessive or unlawfully processed data anonymized, blocked or deleted;
• receive your data in a portable format, and have data processed with your consent deleted;
• be told whom we share data with, and what happens if you refuse consent;
• revoke consent;
• ask for review of decisions made solely by automated processing;
• petition the national data protection authority, the Autoridade Nacional de Proteção de Dados (ANPD).

To use any of these rights, or to reach the person responsible for data protection at DeedToGo, write to [email protected].

12. How we protect information #

We use administrative, technical and physical measures designed to protect personal information, including:

• encryption in transit: the Service is available only over HTTPS;
• passwords stored only as salted one-way hashes (bcrypt), with a 12-character minimum length;
• automatic sign-out after 12 hours of inactivity, unless you chose to stay signed in;
• limits on sign-in attempts and other sensitive actions, against password guessing and abuse;
• a separate, private storage bucket for field photos;
• photos and reports delivered only to signed-in users allowed to see them, through links that expire within minutes;
• administrative tools limited to authorized personnel, with a record of administrative actions;
• passwords, location data, assistant messages and other sensitive fields filtered out of server logs; e-mail addresses are filtered too, except that the record of a failed sign-in keeps the e-mail address entered, as described in "Information collected automatically".

No transmission over the internet or electronic storage is completely secure, and we cannot guarantee the security of your information. Keep your password confidential and sign out of shared devices. If a breach affects your personal information, we will notify you and the authorities as the law requires.

13. Cookies and information stored on your device #

The Service sets only these cookies of its own:

• a session cookie that keeps you signed in and protects the forms you submit;
• if you choose to stay signed in, a cookie that keeps you signed in for up to two weeks;
• in our Android app only, a cookie that tells the Service it is running inside the app, so that it hides purchase options the app does not offer.

We use no advertising or analytics cookies. Google Maps and Street View, on some pages, and our network provider, Cloudflare, may set their own cookies. Our Cookie Policy has the details.

The Service also stores information in your browser so that it works well and offline:

• display preferences, such as your theme, map and list views, and collapsed Pipeline stages;
• an offline copy of your Pipeline and its property pages;
• field photos taken without a connection, including any location you attached, until they upload;
• the app's own files, such as scripts, styles, fonts and icons, so that it loads quickly.

This information stays on your device, except queued photos, which are sent to us when they upload. We delete the offline Pipeline copy when you sign out, but not if you just close the app. Queued photos stay until they upload, so you do not lose them.

14. Children #

The Service is intended for adults and is not directed to anyone under 18. We do not knowingly collect personal information from anyone under 18. If you believe a minor has given us personal information, write to [email protected] and we will delete it.

15. Changes to this policy #

We may update this policy, for example when we add features or providers or when the law changes. When we do, we will change the effective date below. If a change is material, we will tell you by e-mail or with a notice in the Service no later than when it takes effect, and we will ask for your consent where the law requires it.

This policy is effective as of October 17, 2026.

16. Contact us #

For questions about this policy or to exercise your rights, write to [email protected]. For other questions about the Service, write to [email protected].

The controller of your personal information is DeedToGo, which operates DeedToGo at https://app.deedtogo.com and can be reached at the addresses above.