Privacy Policy
Last updated October 11, 2026. Applies to findacrib.com and the Find A Crib app for iPhone and iPad. Replaces the versions dated July 16, September 2, September 19, September 27 and October 6, 2026.
Find A Crib shows public records about rent-regulated apartment buildings — the state's rent-stabilization register, HPD housing-code data, HUD rent estimates, housing-voucher listings and affordable-housing lotteries. This page lists everything we collect about the people who use it, why, and who else sees it.
What we collect, and why
| Data | When | Why |
|---|---|---|
| Account: email address, and the name and profile photo your Apple or Google account shares. On the website you can also create an account with just an email address and a password; the password is stored only as a one-way hash by our database provider, Supabase, and we never see it. | Only if you sign up or sign in | To create your account and sync your saves between the app and the website. |
| Saves and settings: buildings and searches you save, folders, the building you mark as your home, light/dark theme | When you save or set them while signed in | To show them back to you and to send the alerts you ask for. Saves made while signed out stay on your device. |
| Usage events: pages and screens you open, buildings you view, buttons you tap, filters you use, and on the website the text you type into the search box. Each event carries a random visitor ID kept in your browser or app, a session ID, your platform and browser or app version. | Every visit, on the website and in the app | To see what works and fix what doesn't, and to count how many people click through to a listing. If you are signed in, events are linked to your account. The app records the shape of a search (how many filters, how many bedrooms), never the words you type. |
| How you found us: the referring site, campaign tags in the link you arrived on (utm_… and ad click IDs such as gclid or fbclid), and the page you landed on, for this visit and your first visit | Website visits; in the app, only which link opened it | To know which ads, posts and partners bring people here. |
| Lottery and re-rental alerts: email address, boroughs, the kinds of listings you want, and — only if you fill them in — the most rent you can pay and your household income | When you sign up at /alerts/ | Only to pick which lotteries and re-rentals to email you, since each one has a rent and an income range. We never show these numbers to landlords, agents or anyone else. Leave them blank and you get every listing in your boroughs. |
| Emails we send you: which alert or update we sent and when, and whether a link in it was clicked | When you receive our emails | To keep to one email a day and to learn which alerts are useful. Unsubscribe links are never tracked. |
| Push notifications: your device's push token and app build | If you allow notifications in the app | To deliver the alerts you turned on. |
| Comments you post on a building, with the name on your account | When you comment | Comments and the name shown with them are public. |
| Purchases: Plus subscription status, a paid building report and the email it goes to, referral codes you share or redeem, developer API keys and their daily usage | If you buy or use them | To unlock what you paid for. Stripe (web) and Apple (app) process payments; we never see your card number. |
| Your location in the app: your device's location, only if you allow it when the app asks | While the map is open | To show the blue dot for where you are on the app's map. It is used on your device by Apple's map and is not sent to us or stored by us. You can turn it off any time in iOS Settings → Find A Crib → Location. |
| Approximate area on the website: your network address is looked up in a local copy of the DB-IP City Lite database (IP geolocation by DB-IP, CC BY 4.0) | When the website first opens with no area chosen | To open the map near you without asking for location permission. Only a point rounded to about a kilometer goes back to your browser; the address is not stored or sent to anyone. The website never reads your device's GPS location. |
| Web-server logs: IP address, page requested, browser type | Every request | To keep the site running and block abuse. Kept briefly and not linked to an account. |
Advertising and Google
- On the website we run Google Analytics 4, Google Ads conversion measurement and Google AdSense ads. These set Google cookies and send Google the pages you visit, your IP address and browser details; AdSense may use them to choose which ads to show.
- Enhanced conversions: when a signed-in visitor creates an account or buys Plus on the website, we give Google's tag the email address on the account so Google can match the sign-up or purchase to the ad that was clicked. Google hashes the address in your browser before sending it and uses it only for that measurement. It is never sent under Global Privacy Control or where you declined cookies.
- In the app we show Google AdMob ads in the results list (not to Plus members). Google's AdMob SDK collects a device identifier that is specific to this app's developer (not Apple's advertising identifier — the app never asks to track you), your approximate location derived from your IP address, which ads you saw and tapped, and crash and performance data about the SDK. Each ad request also carries a few words about the search on screen, such as "Brooklyn apartments" or a ZIP code, so the ads fit apartment hunting. Ads are non-personalized: we ask Google not to use your data from other companies' apps or websites to target them.
- You can turn off personalized Google ads on the web at adssettings.google.com. Google explains its use of this data at policies.google.com/technologies/partner-sites.
- Europe, the UK and Switzerland: Google's tags start with ad and analytics cookies switched off (Google Consent Mode) and a banner asks before any are set. You can change your answer by clearing this site's data.
Who else sees data (our service providers)
- Supabase (on Amazon Web Services, United States) — hosts our accounts and database.
- Google — Google Analytics, Google Ads, Google AdSense (website), Google AdMob (app), Google Sign-In, and Google's Maps link-outs. See "Advertising and Google" above.
- Apple — Sign in with Apple, in-app purchases, push notifications, and the app's maps. On the website, the street-level photos of buildings are Apple Look Around previews shown with Apple MapKit JS, which loads from Apple's servers and receives your IP address and the building's location.
- CARTO and OpenStreetMap — the website's map tiles come from CARTO's basemap servers (map data © OpenStreetMap contributors). Your browser requests the tiles for the area you're looking at, which gives CARTO your IP address and that area.
- Namecheap Private Email — the email service we send alerts, receipts and updates through; it receives your email address and the message.
- Stripe — website payments.
- Anthropic (Claude, United States) — writes the AI answers in Find A Crib Plus. When you use Help me apply, it receives the listing and the agent’s page. When you use Lease review, it receives the text of the lease you upload or paste. We send it only what that feature needs, never your account details, and Anthropic’s commercial terms don’t let it train its models on what we send. We don’t save your lease: it is read once to write your review, then discarded, and we keep only a record that a review ran and what it cost.
- NYC Open Data — when you open a building's violations or complaints, your browser asks the City's public data portal for that building's records directly. No personal information is sent beyond what any web request carries.
What we do not do
- We do not sell personal data for money, and we do not give your email, income, rent limit or voucher status to landlords, agents, data brokers or advertisers.
- The app does not track you across other companies' apps or websites and does not use Apple's advertising identifier.
- Only public records appear on building pages. Nothing about you appears on them except comments you choose to post.
Published statistics
If we publish figures built from our usage data, they are added up across everyone — for example, "the most-viewed neighborhoods this month." We only publish a count if it covers at least 10 different visitors, and a published figure never includes an email address, an account, a single person's search, or any income or rent a person entered for alerts.
Your choices
- Delete your account: in the app, Profile → Delete account; on the website, sign in, open your account (the 👤 button) and choose Delete account. This immediately and permanently deletes your account, saves, folders, saved searches, home building, alert settings, subscription record, push tokens, comments and likes. Usage events are kept for statistics but disconnected from you: the link to your account is erased. Cancel a web Plus subscription first so it stops billing; App Store subscriptions are cancelled in your Apple account settings.
- Lottery alerts, paid reports and API keys are tied to an email address rather than an account. Every alert email has a one-click unsubscribe; to have an alert signup — including any income or rent you entered — a report record or an API key deleted entirely, email us.
- Usage events in the app: Profile → turn off Share anonymous usage, and the app stops sending them.
- Location in the app: iOS Settings → Find A Crib → Location.
- On the website: clearing this site's data resets your visitor ID. Browser tracking protection and ad blockers stop the Google tags.
Your rights
California residents (CCPA/CPRA) have the right to know what personal information we collect and how we use and disclose it (this page), to get a copy of it, to have it corrected, and to have it deleted; and the right to opt out of the "sale" or "sharing" of personal information. We do not sell personal information for money. Letting Google's advertising tags on the website see your browsing may count as "sharing" for cross-context behavioral advertising under California law, so we honor the Global Privacy Control signal: when your browser sends it, we tell Google's tags not to store ad cookies or use your data for ads, ask AdSense for non-personalized ads, and do not send your email for enhanced conversions. You can also opt out by emailing us. We will not treat you differently for using these rights. We do not use or disclose sensitive personal information to infer characteristics about you, and do not knowingly sell or share data of anyone under 16.
People in the European Economic Area, the UK and Switzerland (GDPR / UK GDPR) have the right to access, correct, delete or export their personal data, to restrict or object to how we use it, and to withdraw consent at any time. We rely on your consent for Google's analytics and advertising cookies, on our contract with you to run your account, alerts and purchases, and on our legitimate interests to keep the service secure and to understand how it is used. Our service providers are in the United States. You can complain to your local data protection authority.
To use any of these rights, email api@findacrib.com from the address on your account, or delete your account yourself as described above. We will confirm the request comes from you and reply within 30 days (45 days where California law allows). An authorized agent may act for you with your signed permission.
How long we keep it
Leases you upload or paste for Lease review are not kept at all. The broker fee check’s answers are not saved. Account data is kept until you delete your account. Lottery alert signups are kept until you unsubscribe or ask us to delete them. Usage events are kept for statistics and, after an account is deleted, are no longer linked to it.
Children
Find A Crib is not directed at children under 13 and we do not knowingly collect their data.
Changes
If this policy changes we will update the date above. Material changes will be noted in the app and on the site.
Contact
Questions or requests: api@findacrib.com.