Privacy Policy

Last updated October 6, 2026. Draft, pending review.

NYC Portfolios Tracker ("we") offers compliance monitoring tools and services for owners and managers of New York City buildings, built on public City records. This policy explains what happens to information when you use the site.

What we collect

You can use the lookup and the Section 8 tracker without an account. If you create an account, we collect only what's needed to run it:

• Email address, used as your login and, if you turn on email alerts and they're active on the site, to send you alerts about your buildings and tracked jobs. We don't send marketing email. Email alerts aren't active yet.
• Password, stored only as a salted scrypt hash. We never store or see the password itself.
• Saved buildings and tracked jobs: the address, borough, ZIP code, BBL and BIN of each building you save, any DOB job numbers you choose to track, and when you added them. For alerts we also keep a list of the public record IDs we've already told you about, so we only email what's new.
• Alert preference: whether you want email alerts.
• Account activity: when the account was created, your last login time and recent failed login attempts (used to slow down password guessing).

Accounts don't ask for your name, phone number or payment information, and there are no analytics or advertising trackers on this site.

Service requests

If you send a request from the Services page, we store what you enter (name, email, optional phone, property address, the services you picked, optional DOB job and ticket numbers, and your message), the time you sent it and, if you were logged in, a link to your account. Only the site administrator can see requests, and we use them only to reply and provide the service you asked about. When email notifications are active, a copy of the request is emailed to the administrator through our email provider. Requests are kept until the administrator deletes them; ask us to delete yours at any time.

Ticket defense cases (tenant information and signatures)

For Sanitation (DSNY) ticket defense, we keep a case for each summons with details from the public OATH record, the company information needed for the hearing forms, the tenant's name, unit, phone and trash-collection days, the statement text, and any files uploaded to the case (for example the tenant's signed statement, a signed authorization form, and OATH's submission confirmation). These are stored in the same private store as account data and are visible only to the site administrators and to the client whose case it is (when the case is linked to their account). We never add a signature to any document; signatures appear only on files that the signer or the client uploads. Case files are downloaded only through logged-in, access-checked links and are never public. Deleting a client account also deletes the ticket defense cases and files linked to it; an administrator can also delete a single case.

Section 8 failure cases and client acknowledgments

If you use the Section 8 24-hour failure tracker, we store what you enter and upload for each case: the building and unit, the inspection date, failure items, repair dates, contractor names, notes, an optional tenant name, before and after photos, and invoices or work orders. To show when a photo was taken, we keep the date and time stored in the photo by your camera or phone, the file date, and the time our server received it. Photos you upload unchanged keep their original metadata, which can include the phone’s location, so remove it first if you prefer. Case files are kept in a private store and are visible only to you and our admins. Deleting your account also deletes your Section 8 failure cases and their files.

When you sign our client acknowledgment, we keep the name you typed, your email or account, the date and time, your IP address, your browser type and the version of the acknowledgment, so we have a record of what was agreed.

Rental listings and inquiries

If you list an apartment on Rentals, we store the listing details and photos you upload and publish them after an admin review; you can unpublish or delete them at any time. Photos are re-saved as JPEG in your browser before upload, which removes embedded location (EXIF/GPS) data. If you send an inquiry about a listing, we store your name, email, optional phone, message and the time you sent it. The site administrator and, for owner-listed apartments, the owner who posted the listing can see the inquiry so they can reply. When email notifications are active, the administrator gets a copy by email. Inquiries are kept until deleted; ask us to delete yours at any time.

Cookies

When you log in we set a session cookie that is HttpOnly, Secure and SameSite, signed so it can't be forged, and expires after 14 days. We also set a small non-secret cookie that tells the site you're logged in. Logging out removes both. We don't use cookies for tracking.

Where account data is stored and who can see it

Account data is stored in a private Vercel Blob store (Vercel, United States, iad1 region) that is reachable only by the site's server code. The site administrator can see account emails, account dates, status, saved buildings, tracked job numbers, service requests, ticket defense cases, Section 8 failure cases, signed client acknowledgments, rental listings and rental inquiries to run and support the service, and can disable or delete accounts. The administrator can't see your password. We don't sell or share account data.

Keeping and deleting your data

We keep account data until the account is deleted. You can remove saved buildings at any time from your dashboard. To delete your whole account, ask the site administrator; a contact email is coming soon. Deleted accounts are removed from our store right away, though hosting backups and logs may keep traces for a limited time.

Addresses you search

When you search an address, your browser sends it directly to NYC Planning Labs GeoSearch (geosearch.planninglabs.nyc) to find the building, and then sends the building's identifiers to NYC Open Data (data.cityofnewyork.us) to fetch public records. Those services have their own privacy policies. We don't store your searches on our servers.

Your Section 8 building list

If you aren't logged in, the Section 8 tracker saves your building list only in your browser's local storage on your device, and it isn't sent to us. If you're logged in, your list is saved to your account as described above. Building records (violations, complaints and other City data) are always fetched by your browser directly from NYC Open Data and aren't stored by us.

Passwords

We never ask for, collect or store passwords for NYCHA, HPD or any other government portal. Your NYC Portfolios Tracker password should be unique to this site.

Hosting

The site is hosted on Vercel, which may keep standard server logs (such as IP address, browser type and the pages requested) to operate and secure the service.

Children

The site is meant for property owners and managers and isn't directed to children under 13.

Changes and contact

If we add alerts, email or contact forms, we'll update this policy before collecting any new information. A contact email is coming soon.