Privacy Policy

HomeBadger (homebadger.co) is a research tool for Florida foreclosure and tax deed auctions, operated by HomeBadger LLC (“HomeBadger”, “we”, “us”). This policy explains what personal information we collect when you use our website, our MCP server (the connector that lets AI apps such as Claude and ChatGPT use HomeBadger on your behalf) and our emails, why we collect it, who we share it with, how long we keep it and the choices you have.

It does not cover the AI apps you connect to HomeBadger; those are governed by their providers' own privacy policies (see Connected AI apps).

• Account details. Your name, email address and password when you register. We store only a salted hash of your password (bcrypt), never the password itself. You can change your name, email and password in Settings.
• Organization and team details. Organization names, who belongs to them and their roles, and the email addresses of people you invite.
• What you save. Watchlists and the properties on them, notes you add, saved searches, properties you mark as liked or “not interested”, your email alert settings and display preferences (such as which filters you show).
• Billing details. If you subscribe to a paid plan, you enter your card and billing address on a checkout page hosted by Stripe. Stripe processes the payment; we never receive or store your full card number. We keep your Stripe customer id, plan, billing interval, subscription status and renewal dates.
• Messages to us. When you use the contact or support form, or email us, we receive your name, email address, phone number if you give it, and your message.

• Sign-in sessions. When you sign in we record a session with your IP address, browser user agent and the session's start and expiry, so you can stay signed in and so we can spot suspicious logins.
• Property views. When you are signed in and open a property page, we record that you viewed that property on that day. We use this only to recommend similar auctions to you. Visits while signed out are never recorded, and view records are deleted after 180 days.
• Rate-limit records. To protect the service from abuse we count requests per IP address or account for short windows (for example, sign-in attempts per 5 minutes). These counters are deleted about a day after their window ends.
• Server logs. Our hosting provider records standard request logs (IP address, URL, time, status code, user agent) for security and troubleshooting. When a connected AI app calls our MCP server we also log the tool name, a shortened app identifier, your plan tier, whether the call succeeded and how long it took, and we keep a per-app count of calls and the time of the last call (shown to you in Connected apps).
• Usage analytics (unless you opt out). Google Analytics records the pages you visit, how you got here (for example, a search engine or link), searches made on the site, links you click to other sites, files you download, and when you sign up, sign in or start a checkout, along with your approximate location (city level), device and browser type. Google does not give us your IP address, and we do not send it your name or email address.
• Email alerts. We record which alert items we have already emailed you so you never get the same one twice.

We use the cookies needed to run the site: a session cookie that keeps you signed in, and short-lived cookies used during sign-in and when you connect an AI app. We also use Google Analytics, which sets its own cookies (named _ga and _ga_*) to count visits and understand how the site is used. We do not use advertising cookies or advertising trackers, and we have not enabled Google's advertising features.

You can turn Google Analytics off at any time with “Cookie settings” at the bottom of any page, which stops it and deletes its cookies in that browser. We also treat a Global Privacy Control signal from your browser as an opt-out. To opt out of Google Analytics on every site, install Google's opt-out browser add-on, or block cookies for this site in your browser settings.

Your browser's local storage holds a few conveniences that never leave your device: your recent searches, your filter layout, and whether you dismissed the sign-up prompt. You can clear them in your browser settings at any time.

Some page elements load directly from other providers, which therefore see your IP address and browser details: fonts from Google Fonts, and map tiles from OpenFreeMap (tiles.openfreemap.org). Property photos and static map images are served from our own storage.

The property and auction information on HomeBadger comes from public sources and licensed data, not from you: county clerk auction and court websites, county property appraiser tax rolls, Florida statewide parcel data (FloridaGIO), the US Census Bureau geocoder, and RentCast property valuations. We add our own machine-learning estimates (property values, auction outcome predictions) computed from that data.

These records can include the names and mailing addresses of property owners and the parties to foreclosure cases. We show them because they are part of the public record of the court case or tax roll. Property photos come from Google Street View and the Google Maps Static API; we request them using the property's address or coordinates, from our servers, and cache them on our storage. No information about you is sent to Google for this.

We use Anthropic's Claude API to read public court documents (such as final judgments) and summarize details like lien type and risk flags. Only the public documents are sent; none of your personal information is included.

If your name appears in a record we display and you believe it is wrong, or you have a question about it, contact us at [email protected]. We correct errors we can verify, and we will tell you which public source the record came from so you can also seek a correction there.

• To create and secure your account, keep you signed in and let you manage your organization and team.
• To provide the features you use: watchlists, saved searches, notes, recommendations and exports.
• To send emails you need or asked for: email verification, password resets, email-change confirmations, team invitations, and auction alert emails about properties you saved.
• To send a short series of emails after you sign up with product tips, examples from the counties you follow and plan offers. You can turn these off at any time.
• To process subscriptions and payments and to apply your plan's features and limits.
• To answer your support requests.
• To prevent abuse, enforce rate limits and our Terms, and keep the service secure.
• To understand and fix problems and improve the service.
• To comply with law and respond to lawful requests.

You can connect HomeBadger to AI apps such as Claude, ChatGPT or Cursor through our MCP server. Nothing is shared until you sign in to HomeBadger from the app and approve the connection on our consent screen. The app then acts on your behalf with your plan's access, limited to the permissions you approved:

• Search auctions and read property details: Auction listings, property facts, values, county market stats and, where your plan includes them, AI document insights and predictions.
• Read your watchlists, saved searches and recommendations: Lets the app see the lists and searches you've saved on HomeBadger.
• Add and remove properties on your watchlists (optional): The app can change your watchlists when you ask it to.
• Stay connected: Keeps the connection working without signing in again every hour.

The app never receives your password. It receives an access token that expires after one hour and, if you allow “Stay connected”, a refresh token valid for up to 60 days that renews access while you use the connection. You can see every connected app and disconnect it in Connected apps; disconnecting revokes its tokens immediately.

We only receive the specific requests the app makes to our tools (for example, “search Hillsborough foreclosures” translated into search filters) and we return HomeBadger data. We do not receive your conversation, chat history, files or memory, and we do not ask the app for them. Your conversation, and any HomeBadger data the app shows you in it, is handled by the AI app's provider (for example Anthropic or OpenAI) under that provider's own privacy policy and settings.

We do not sell your personal information, and we do not share it for cross-context behavioral advertising.

We share it only with service providers that process it for us, under contracts that limit their use of it:

Within an organization, members can see the organization's name, its members and their roles, and anything shared with the organization.

We may also disclose information if required by law or legal process, to protect the rights, safety or property of our users, the public or HomeBadger, or as part of a merger, acquisition or sale of assets (in which case this policy continues to apply to your information, or you will be notified of changes).

• Account information and what you save: for as long as your account exists. When you delete your account, we delete it within 30 days, except as noted below.
• Property views: 180 days.
• Sign-in sessions: until they expire or you sign out, then removed.
• Connected-app tokens: access tokens 1 hour, refresh tokens up to 60 days, and both are revoked when you disconnect the app.
• Rate-limit counters: about one day after their window ends.
• Server logs: kept by our hosting provider for a limited period for security and troubleshooting.
• Billing records (invoices, payment history): as long as tax and accounting law requires, typically up to 7 years.
• Support messages: as long as needed to resolve your request and keep a record of it.

• Update your details: change your name, email address and password in Settings.
• Alert, tips and offer emails: turn each off in Settings or with the unsubscribe link in every one of these emails. Account and security emails (such as password resets) are still sent.
• Connected apps: disconnect any app in Connected apps.
• Billing: manage or cancel your subscription in Billing.
• Access, export, correction and deletion: email [email protected] from the address on your account and tell us what you would like. We will send you a copy of your information in a portable format, correct it, or delete your account and the information tied to it.

We respond within 30 days (45 days where state law allows, and we will tell you if we need the extra time). We may need to verify your identity first, usually by confirming the request from the email address on your account. We will not treat you differently for exercising any of these rights.

California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon and other states give residents specific privacy rights. This section summarizes how they apply to HomeBadger.

Categories we collect (in the last 12 months)

• Identifiers: name, email address, IP address, account and customer ids.
• Commercial information: your plan, subscription and payment history (card details are held by Stripe).
• Internet or network activity: sign-in sessions, property views while signed in, requests made through connected apps, server logs.
• Inferences: auction recommendations based on what you save and view.
• Account login credentials: your email and password (stored as a hash).

Sources: you, your browser or device, your organization (for invitations), the AI apps you connect, and Stripe. Purposes: those listed in How we use your information. Recipients: the service providers listed in Who we share information with, for business purposes.

No sale or sharing. We do not sell personal information or share it for cross-context behavioral advertising, and have not done so in the last 12 months. We do not knowingly sell or share the information of anyone under 16. We do not use sensitive personal information (such as your login credentials) to infer characteristics about you, or for any purpose other than providing the service.

Your rights: to know what we collect and how we use it, to access and get a portable copy, to correct, to delete, to opt out of sale, sharing, targeted advertising and profiling (we do none of these), and to appeal a decision we make on your request by replying to our response. To make a request, email [email protected]. You may use an authorized agent; we will ask for proof of the agent's authority and may ask you to verify your identity directly.

We protect your information with encryption in transit (HTTPS), hashed passwords, signed and short-lived access tokens, access controls that limit each account and organization to its own data, rate limiting, and providers that maintain their own security programs. No system is perfectly secure, so we cannot guarantee absolute security. If we learn of a breach affecting your personal information, we will notify you as the law requires. Please use a unique password and tell us at [email protected] if you suspect unauthorized access to your account.

HomeBadger is for adults. You must be at least 18 to create an account, and we do not knowingly collect personal information from anyone under 18. If you believe a minor has given us personal information, contact [email protected] and we will delete it.

HomeBadger is a US service about Florida properties, intended for users in the United States. Your information is stored and processed in the United States. If you use HomeBadger from elsewhere, you understand that your information will be transferred to and processed in the United States.

We will update this policy when our practices change and show the new date at the top. If a change materially affects how we use information we already have, we will tell you by email or in the app before it takes effect.

Privacy questions and requests: [email protected]. Everything else: [email protected] or our support page.

HomeBadger LLC
401 West End Ave, New York, NY 10024