Privacy notice

Information you provide

RateWatch collects your email address, U.S. property address, mortgage balance, note rate, term, payment and closing-cost assumptions, alert thresholds, time zone, and delivery preferences. We do not ask for income, Social Security number, credit score, bank credentials, or a loan application.

Information created by the service

We store source observations, rule evaluations, alert events, bounded delivery status, security and operational records, and account timestamps. Authentication and infrastructure providers may process IP address, device, and request metadata to secure and operate the service.

Property-value estimates

During an authenticated valuation refresh, RateWatch sends your saved address to RentCast only to request an automated property-value estimate. The separate FHFA state-market context receives no saved address and is not treated as this home's value.

From the RentCast result, we store only the returned estimate and low-to-high range, source and timestamps, and a hashed provider identifier. We do not store the raw RentCast response or comparable-property records. The estimate has a 30-day freshness window and is not used to qualify a mortgage-rate alert or refinance decision. It is not an appraisal.

Google sign-in

If you continue with Google, Google and Supabase Auth process the standard identity details needed for sign-in: your Google account identifier, verified email address, name, profile image, and standard profile metadata. RateWatch uses this identity only to create or authenticate your private account. We do not request or receive access to Gmail or Google Drive, and we do not read your messages, files, contacts, or calendar.

Google may issue short-lived provider access or refresh tokens during the sign-in exchange. RateWatch does not use or retain them: the browser removes them before saving the Supabase session, does not put them in cookies, and does not send them to the RateWatch database. The browser keeps Supabase's own access and refresh tokens in local storage so your RateWatch session can continue.

How we use information

We use it to authenticate you, maintain your private dashboard, monitor selected mortgage benchmarks, evaluate your saved thresholds, deliver requested notifications, prevent duplicate alerts, support the service, investigate abuse, and comply with law. We do not sell personal information or use mortgage details to broker or underwrite a loan.

Service providers and disclosure

We disclose only the information needed to vendors that provide hosting, database, authentication, email delivery, monitoring, and security services under their service terms. We may also disclose information when required by law, to protect users or the service, or as part of a business transaction subject to appropriate safeguards.

Email and text messaging

Market-alert email can be paused or unsubscribed independently from authentication email. Text alerts are optional and available only when the authenticated dashboard shows the enrollment form. If enrollment is unavailable, RateWatch does not collect a phone number or SMS consent from that screen. Existing subscribers can reply STOP at any time to revoke consent.

Mobile information will not be sold, rented, or shared with third parties or affiliates for marketing or promotional purposes. Text-message originator opt-in data and consent will not be shared with any third parties except the providers needed to deliver and support the messages you request.

Program disclosures, the frequency limit, consent language, and keyword behavior are published in the SMS terms. When a person enrolls, RateWatch preserves the exact consent record required to document the request, including name, mobile number, the consent copy and method, and consent and opt-out timestamps. The record also identifies the exact reviewed consent-form capture by artifact ID, digest, format, and byte length; it does not store another copy of the image with the account.

Retention and security

Active-account records are kept while needed to provide and secure the service. We use access controls, row-level authorization, encrypted managed secrets, and bounded operational logging. No online service can promise absolute security.

If you use text alerts and then delete your account, operational SMS records and their direct account linkage are deleted with the rest of your account. A minimized, private Sent compliance record containing only your name, mobile number, exact consent request and copy, consent method and purpose, and relevant consent or opt-out timestamps is retained until exactly four years after the last relevant consent or opt-out event, then automatically purged. It has no direct database link to your Auth account, email, property, mortgage, rules, or delivery history. A generic screenshot of the blank, unchecked consent form contains no homeowner information and may be retained separately as program-compliance evidence.

Your choices

You can pause market-alert email, set quiet hours, download a JSON copy of your account data, or delete your account from Account settings. After successful completion, deletion removes your property, mortgage, rules, operational notification records, and Auth account, subject only to the four-year SMS consent-evidence exception described above. A pseudonymous hash of the deletion request remains for seven days solely to make a lost completion response safely replayable, then is purged.

If the identity provider has a transient deletion failure, a private maintenance job may temporarily retain only the internal user UUID needed for bounded retries or manual review. It contains no email, property address, or mortgage values and is not exposed in the dashboard. RateWatch operators resolve manual-review jobs rather than silently treating an incomplete deletion as complete.

Contact

Northglass LLC operates RateWatch from Pennsylvania, United States. Contact hello@northglass.io.