Trust & Compliance

Privacy Policy

Last updated July 26, 2026.

RoofShopper (“RoofShopper,” “we,” “us”) builds Home Identity reports from public government permit records. This page describes, as plainly and specifically as we can, what information we actually collect when you use the site, why, and what we do with it. It describes the platform as it exists today — not a generic template, and not aspirational functionality we haven't built.

Information we collect

Account information

If you create a free account to save a property (“Save My Home”), we store your email address and a password — see “Password handling” below for exactly how the password itself is protected. We also store which properties you've saved and when you last viewed each one, so your My Homes page can show them to you.

Roofing Expert requests

If you request a Roofing Expert review, we store your name, email, phone number, your preferred time to be contacted, and any message you include, along with the property address the request is about. This information is used only to connect you with a roofing professional and to let our team review and respond to the request — it is never sold, and never used for anything beyond fulfilling that request.

Property searches

When you search an address, we log that a search happened — the query text, whether a matching property was found, and which property, if any — tied to an anonymous session identifier (see “Cookies” below), not to your name or email unless you're signed in. We do not log your IP address anywhere in this system. The property report itself is built entirely from public government permit records already on file for that address — searching an address doesn't submit it to a third party or notify anyone.

Other forms on this site

A few other forms collect an email address for a specific, stated purpose: requesting private beta access (name, email, role, and optionally your company), and submitting product feedback (an optional email, only if you want a reply). Each is used only for the purpose you submitted it for.

Cookies

RoofShopper sets three of its own cookies, all first-party (never shared with an advertiser, never used to track you across other websites):

rs_sid— an anonymous, randomly generated session identifier, set on your first visit regardless of whether you ever create an account. It contains no personal information by itself.
rs_auth— set only if you sign in, identifying your logged-in session so you don't have to re-enter your password on every page.
rs_internal_key— set only for our own internal admin tools; ordinary visitors never receive this cookie.

Our analytics provider, PostHog (see “Third-party services” below), may also store its own identifier in your browser's local storage or cookies to keep analytics events grouped together across a visit. We don't currently show a cookie-consent banner, because everything above is either strictly necessary to operate the site (session, login) or first-party analytics with no cross-site tracking or advertising use — the kind of use that doesn't require one under current guidance. We'll revisit this if that ever changes.

Internal analytics

We track product usage — which pages are viewed, whether a search finds a property, whether a report is saved or shared — to understand how the product is actually used and to fix what isn't working. Events are tied to the anonymous session identifier described above, plus your account's email if you're signed in. We do not record screen recordings or automatically capture every click and keystroke on the site — only the specific, named product events listed in our own internal analytics taxonomy (for example, “search submitted” or “report saved”), and nothing beyond that.

Third-party services

RoofShopper uses one third-party service that processes usage data: PostHog, for the product analytics described above. We do not use any third-party advertising network, social-media tracking pixel, or data broker. We do not use a third-party identity or sign-in provider — accounts are created and authenticated entirely on our own systems (see “Password handling” below). The application itself is hosted on Railway; property and permit data comes directly from public government sources, named individually on each report and on our Sources page.

Security practices

All traffic to RoofShopper is encrypted in transit (HTTPS).
Security headers (including a Content Security Policy) are set on every response to reduce the risk of common web attacks.
Every public form (sign-up, sign-in, Roofing Expert requests, feedback, beta requests) is rate-limited to reduce automated abuse.
Our internal admin tools require a separate secret key and are unreachable — not just hidden, but actually inaccessible — to anyone who doesn't have it.
Database backups are taken regularly using a method safe to run against a live database.

Password handling

Your password is never stored in plain text, and we can't look it up or read it back to you or to our own team. When you set a password, it's run through scrypt (a standard, deliberately slow password-hashing algorithm) with a random salt unique to your account, and only that resulting hash is stored. When you sign in, we hash what you typed the same way and compare the two hashes using a timing-safe comparison, rather than comparing your actual password to anything on file.

Data retention

Public government permit records that power a Home Identity report are retained indefinitely — they're public record, sourced from government agencies with no retention restriction of their own, and the value of the report depends on keeping a property's documented history intact. Your account, saved properties, and any requests or feedback you've submitted are retained until you ask us to delete them (see “Your rights” below) or, for an account, until it has been inactive long enough that we remove it as routine housekeeping — we don't currently have a fixed inactivity period set for that, and will update this page if we set one.

Your rights

You can ask us to tell you what personal information we hold about you, correct it, or delete your account and the information tied to it. RoofShopper doesn't yet have a self-service “delete my account” button in the product itself — today, the way to exercise any of these rights is to email us and we'll handle it directly. We'll act on a request as promptly as we reasonably can.

Changes to this policy

If we materially change what information we collect or how we use it, we'll update the date at the top of this page. Continuing to use RoofShopper after a change means you've accepted the update.

Contact

Questions about this policy or your information: privacy@roofshopper.net.