Privacy Policy

We collect the minimum we need to run the product: an email address to identify your account, the job data you create, and a count of the scans you’ve used so we can apply your plan. We never see your card details. We don’t sell your data. We use Google Analytics to see which pages are visited, PostHog to see how people move from signup to a paid plan, and a Meta pixel to measure ads we run ourselves: page views, new accounts, and subscriptions.

Account information

Your email address and an authentication identifier. If you sign in with Google, we receive the email address and basic profile information associated with that Google account. We do not receive or store your Google password.

Job data

The addresses you look up, their coordinates, the surface type you select, the boundaries drawn on the map (by you or by the AI), and the resulting area, perimeter and roof-plane figures. Property addresses can relate to a real person, so we treat this as personal information even when it belongs to your customer rather than to you.

Usage and billing status

Which plan you’re on, how many scans you’ve used in the current period, and subscription identifiers supplied by our payment provider so we can match a subscription to your account.

Support messages

When you contact us or file a bug report in the app, we receive your message along with context that helps us reproduce the problem — your account email, your plan, the page you were on, and your browser and operating system version.

Site measurement

When Google Analytics is enabled, it records the pages you open, an approximate location (country and city), the device and browser you use, and how you arrived — a search, a link, or a direct visit. It does not receive the addresses you measure or the contents of a job.

Product measurement

When PostHog is enabled, it records the same kind of visit as Google Analytics, plus whether you created an account, finished or failed a scan, opened the upgrade prompt, started checkout, or subscribed. A scan event includes the surface type (roof, pavement, and so on) and nothing about the address. PostHog does not record what you type.

Advertising measurement

When the Meta pixel is enabled, it records that you viewed a page, looked at pricing, created an account, started checkout, or subscribed. Once you are signed in it also receives a hashed copy of your email address and your account id, so a subscription can be tied back to the ad that led here. We use this only to measure our own ads.

What we do not collect

Card numbers and payment credentials never reach us — Lemon Squeezy handles payment collection as merchant of record.

• To create and secure your account, and to sign you in.
• To run measurements and store the results so you can come back to them.
• To apply your plan's scan allowance and process your subscription.
• To answer support requests and fix bugs you report.
• To send service messages — billing notices, material changes to these policies, security issues. We don't send marketing email unless you ask for it.
• To protect the service from abuse, fraud and misuse.
• To see which pages are visited and how people move from a first scan to a subscription.
• To measure the performance of ads we run for SquareRate.

We use a small number of trusted providers to operate the service. Each receives only what it needs for its role.

• Authentication & Cloud Storage — providers (such as Google) that secure your login credentials and store your account and job data.
• Mapping & Geodata Providers — services (like Google Maps) that supply the address search, satellite imagery, and underlying roof geometry. Addresses you search are sent to these providers to return results.
• AI & Processing Infrastructure — cloud computing platforms that run our image-segmentation models to detect surface boundaries. They receive image crops and coordinates, not your personal identity.
• Email Delivery — Resend delivers messages you send from the in-app support form to our inbox. It receives your name, email address, message, the page and browser details shown on the form, and any screenshot you attach.
• Automation — internal tools that connect our database to scan processing and billing.
• Lemon Squeezy — payment processing as merchant of record. They collect your billing details directly; we receive only subscription status and identifiers.
• Google Analytics — site measurement. It sets cookies so a return visit can be recognized as the same browser, and receives the page address, approximate location, and device details described above. It does not receive job addresses.
• PostHog — product measurement. It receives the events described above and, once you are signed in, your account id. It does not receive your email address or the addresses you measure.
• Meta — advertising measurement. The pixel sets a cookie on your browser, reads the ad click id when you arrive from a Meta ad, and receives a hashed email address and account id once you are signed in.

Firebase Authentication stores a session token on your device so you don’t have to log in on every visit. Clearing your browser storage signs you out.

Google Analytics, when configured, sets a cookie named _ga and a second cookie whose name starts with _ga_. Those cookies let Google recognize a return visit from the same browser. SquareRate does not use them to show ads.

PostHog, when configured, stores an identifier in a cookie and in local storage, both with names starting with ph_. That identifier lets a later scan or subscription be tied to the same browser. It is not used to show ads.

The Meta pixel, when configured, sets a cookie named _fbp. If you arrived from a Meta ad, it also stores the click id from that link (the fbclid parameter) in a cookie named _fbc. Those cookies let Meta attribute a later signup or subscription to the ad. SquareRate does not use them for anything else.

Account and job data are kept for as long as your account is open, so your job history stays where you left it.

When you delete your account — or ask us to delete it — we remove your account record and your job data within 30 days. Backups age out shortly after that. We may retain a minimal record of transactions where tax or accounting law requires it, and anonymised, non-identifying operational counts.

• Access — ask us for a copy of what we hold about you.
• Correction — your email is editable from your account; email us for anything else.
• Deletion — ask us to delete your account and its data.
• Export — job data can be exported to CSV from the dashboard at any time, without asking us.
• Objection — tell us if you want us to stop a particular use of your data.

Email support@squarerate.app from your account address and we’ll action it. We don’t charge for these requests and we won’t treat you differently for making one.

Traffic is encrypted in transit. Access to production data is limited to people who need it to run the service. Data is stored on Google’s infrastructure with its access controls and encryption at rest.

No service is perfectly secure, and we can’t guarantee absolute security. If a breach affects your personal information we’ll notify you and any regulator that requires it, without undue delay.

SquareRate is a business tool and is not directed at children. We don’t knowingly collect information from anyone under 18. If you believe a child has given us information, contact us and we’ll delete it.

We operate from the United States and our providers store and process data there. If you use SquareRate from outside the US, you understand that your information will be transferred to and processed in the US, where privacy laws may differ from those where you live.

If we change this policy materially we’ll update the date at the top and give notice in the app or by email before the change takes effect. Our Terms of Service cover the rest of the relationship.

Timberwolf Development LLC, doing business as SquareRate. Washington, United States. Privacy questions and data requests go to support@squarerate.app.