Privacy policy

The short version

Formstone helps you size up real estate deals. Most of what you type stays on your phone, and our server keeps only what accounts, free deals, alerts, and lookups need. We don't sell your personal information, Formstone has no ads or ad tracking, and you can delete your account and your data at any time in Settings.

What stays on your phone

Your profile (name, email, and phone), your buying power (cash, credit, and LLC), your strategy and market, the deals in your pipeline and their notes, photos you add, your portfolio, saved homes and searches, the prices of the homes you scroll past in the Feed (so it can show price cuts), your Guess the price scores, alerts, settings, and any API keys you add. Your profile, settings, and keys sit in the iPhone's encrypted keychain, kept to this phone. iOS can keep keychain items after an app is removed, so if you install Formstone again, it clears them first, keeping only the phone's random id (see Free deals). None of it syncs between phones or reaches our server, except as this policy says.

Offer letters and lender packages are made on your phone and go only where you send them.

What our server keeps

Your account, if you make one: Your email, your password (stored only as a one-way hash), your authenticator app if you turn codes on, and your plan.

Free deals: An id for this phone (a random one on iPhone; on Android, the id Android gives Formstone on that phone), stored only as a one-way hash, the houses it used free deals on, and the account signed in when it used them, so free deals count once per phone and per account, even after a reinstall. This works with or without an account.

Lookups: Which kind of RentCast lookup your account ran and when, the time of each MLS sales lookup, the time of each Street View photo it loaded, the time of each address suggestion Google gave, and the time of each listing screenshot or photo read for you, but not which house, what you typed, or the picture. They count toward the monthly limits. Our hosting provider's request logs, kept up to 7 days, also hold the address or spot each lookup asked about, the account that asked, and your phone's IP address.

Shared answers: RentCast's answers for a house or a search (a place and a price range), and the MLS sales that closed near a house, kept 12 hours to 30 days so the next person who asks doesn't use up a lookup. They don't say who asked.

Rentals near a house: Baltimore City's rental listings from RentCast, brought up to date each morning, for every report's rent range. How many times a day your account, or this phone's random id (stored only as a one-way hash) when you're signed out, asked for the rentals near a house, but not which house, to limit how many anyone can read. The counts are deleted after 3 days.

Push alerts, if you turn them on: This phone's push token, which kinds of push alerts you switched on, a copy of your alerts that watch for city leads (each place, radius, and buy box) and the leads you've already seen, and, for the Pro alerts you switch on, the listing ids and prices of your saved homes and the place, radius, and highest price of your alerts that watch listings.

Owner lookups, if you use them: The houses you look up for an owner's phone and email, what was found (kept 90 days), and a count of your lookups.

Each account reaches only its own data. Data is encrypted on its way to our server and where it's stored, and Formstone's keys for the services below stay on our server, not your phone.

Push alerts

Push alerts stay off until you turn them on in Settings > Notifications or Deals > Alerts, and they need an account. Each kind has its own switch. While they're on, from 8 a.m. to 9 p.m. Eastern, about every 2 hours, our server checks Baltimore City's public records for new leads in your alert areas and sends new ones to your phone through Expo's push service and Apple's (Google's on Android). The Pro alerts (price drops and sold or off-market saved homes, new listings in your alert areas, and the daily top deals) compare your saved homes and alert areas with the Baltimore City listings our server checks each morning; no lookup is made for you. Turning push alerts off, signing out, or deleting your account deletes the token and everything kept with it.

Services we send data to

Maryland and Baltimore City records: The addresses and map areas you look up, your alert areas from our server while push alerts are on, and, when you tap Where I'm standing or a photo has no address on it, where your phone is, to find the houses around you. For property records, sales, permits, and city leads. Formstone asks for your location only then, and never keeps it.

RentCast: The houses you look up and the places and price ranges you search in the Feed, sent through our server (or straight from your phone if you add your own RentCast key). For listings, rents, and days on market.

Google Street View: The location of each house in the Feed while you're signed in, sent by our server, so Google doesn't see who's asking. We don't keep the photos. If you add your own Google key in Settings, your phone asks Google directly for street and aerial photos.

Google address suggestions: Outside Baltimore City, while you're signed in, the address you're typing in the search box, sent by our server, so Google doesn't see who's asking. Google matches it to a street address. We don't keep what you typed.

Anthropic (Claude), if you analyze a screenshot or photo: A listing screenshot you pick or share to Formstone, or a photo you take of a For Sale sign or a house, in Analyze a deal, sent by our server, so Anthropic doesn't see who's asking. Claude reads the address, price, beds, baths, and size, and a sign's company, phone number, and house number, off it for you to check. Anthropic doesn't train its models on it, and our server doesn't store it. A link you paste or share is read on your phone; Formstone never opens the listing site.

Gmail: Your email address and your 6-digit code when you sign up or reset your password, because Formstone's emails go out through Google's Gmail.

Apple Maps: The map area on your screen, for maps and the view from above.

Photon (OpenStreetMap): Addresses you type outside Baltimore, and neighborhood or town names you type in the Feed. For suggestions and finding the place.

Federal Reserve (FRED): Nothing about you. For today's interest rates in Learn.

Supabase: What our server keeps, above. Supabase hosts Formstone's database, sign-in, and server.

Expo: This phone's push token and the words of each alert, and a random id for this install when the app checks for updates. Expo is the platform Formstone is built on.

Apple, on iPhone: The push token and the words of each alert, to show push alerts on your phone. Your purchases go through the App Store.

Google, on Android phones: The push token and the words of each alert, to show push alerts on your phone (Firebase Cloud Messaging). Your purchases go through Google Play.

RevenueCat: Your account's id and your purchases, to keep your plan in step with the App Store or Google Play.

Repliers (Bright MLS), once MLS sales are on: The location of each house you analyze while you're signed in and how far back its comps go, sent by our server, so Repliers doesn't see who's asking. For sales that closed on Bright MLS.

BatchData, if you use owner lookup: The address you ask about, sent through our server. For owners' names, phone numbers with Do Not Call flags, and emails.

We send each of these services only what's listed here, and we use services that protect it at least as well as this policy does.

Links to Zillow, Redfin, Realtor.com, Google Maps, Apple Maps, and city and state sites open outside Formstone, where their own privacy policies apply.

What we don't do

• We don't sell or rent your personal information.
• We don't share it for advertising. Formstone has no ads, no ad tracking, and no analytics or crash-reporting services.
• We don't share your deals or offers with other users or lenders. They go only where you send them, like a lender package you share.
• A deal you share as a link carries its numbers in the link itself, after the #, which a browser never sends to a server. Our deal sheet page reads them in the browser of whoever opens it; our server never sees them.
• We never ask for your Social Security number, bank logins, or a credit report pull.

Public records we show

Formstone shows public property records: Maryland's parcel and sales records (Department of Assessments and Taxation) and Baltimore City's open data, such as owner of record, mailing address, permits, vacant notices, and code violations. Government agencies publish these records. We show them as published and may combine them with other sources. If a record about you is wrong, contact the agency that publishes it, and tell us so we can flag it.

Owner lookup

Owner lookup (Find phone and email, on Leads) returns owners' names, phone numbers, and emails from BatchData, a licensed data provider. Those owners aren't Formstone users, so we limit it: lookups are only for contacting owners about buying their property, never for tenant screening, credit, employment, or anything else the Fair Credit Reporting Act covers. Each account gets a set number of lookups a month, each lookup is logged to the account that ran it, and answers are kept 90 days for that account only. They aren't shared with other users or resold. Formstone shows which numbers are on the Do Not Call list and offers a Call button only for numbers that aren't.

Owners can ask us at formstoneapp@gmail.com to leave their information out, and we'll do it within 30 days. We keep a list of the addresses, phone numbers, and emails we were asked to leave out, so they stay out, even in earlier lookups.

How long we keep data

Data on your phone stays until you delete it or remove the app. Our server keeps your account data while your account is open. Settings > Delete account deletes it right away, along with your owner lookups and push alerts; if you ask by email instead, we delete it within 30 days. The times of your lookups stay, no longer linked to you, so they still count toward the app's shared monthly limits. Shared answers expire on their own within 30 days, the daily counts of rentals asked for after 3 days, and owner lookups after 90 days. Purchase records that Apple or we must keep for tax and accounting stay. A phone's free-deal count, and the houses it used them on, stay with its hash, no longer linked to you, so a new account on the same phone doesn't reset free deals.

Your choices and rights

You can see, change, or delete your data in the app, or ask for a copy at formstoneapp@gmail.com. Settings > Delete account deletes your account and, unless you switch it off, erases your deals, alerts, notes, keys, and profile from this phone. Push alerts turn off in Settings > Notifications or Deals > Alerts at any time. Maryland residents, and residents of other states with privacy laws such as California, may have more rights, including to know, correct, and delete their data and to opt out of sale or targeted advertising. We honor these requests for everyone, wherever they live, and we won't treat you differently for using them.

Security

We use encryption on the way to our server and where data is stored, the iPhone's keychain for your profile and keys, rules so each account reaches only its own data, and optional authenticator codes for a second lock. No system is perfectly secure. If a breach affects your data, we'll tell you as the law requires.

Children

Formstone is for adults 18 and older. We don't knowingly collect data from children under 13.

Changes and contact

We'll post changes here and tell you in the app before a material change takes effect. Questions or requests: formstoneapp@gmail.com.