Privacy policy

Our scope

Make No Mistakes, Inc. operates whohouse.io. We help individuals and businesses find recorded property owner names, property facts, sale history and mortgage records. Where a source establishes only a recorded buyer, we label that relationship. A name in a record is not a guarantee of current ownership.

We do not provide property owners’ phone numbers, email addresses, personal contact enrichment, credit reports or personal-financial profiles. Account and invitation email addresses are collected to operate the service, not to enrich property records.

Accounts and workspaces

We store your email address, display name, account identifiers and sign-in records. If you choose Google or Discord, we receive the identity information that provider shares, which can include a profile image. We do not receive your provider password.

Workspace records include workspace names and types, membership and roles, invitation email addresses, and administrative activity. We no longer ask new accounts to submit a website or an intended-use application. Existing review information and moderation decisions may remain in administrative records. Your account can belong to more than one workspace. Members share that workspace’s lookup history and results. Workspace administrators can manage invitations and access; the workspace owner controls its subscription.

Workspace information is visible to workspace members and to authorized staff as needed to operate the service, provide support, or investigate abuse. Do not submit identity documents, personal financial records, or other sensitive material as workspace details.

Sign-in, email and API keys

Email sign-in sends a six-digit code through our configured delivery provider, Resend or Amazon Simple Email Service. The provider receives the destination email address and message content. Invitations include the recipient address, workspace and inviter names, and an acceptance link. These are service messages, not property-owner outreach.

Sign-in codes expire after 10 minutes. We store a keyed hash for verification, not the readable code. Rate limits use hashed email and IP-address identifiers. Session cookies keep you signed in, and your browser stores its appearance preference locally.

API key secrets are shown once when created. We store their hashes, names, prefixes, permissions, creation and expiry times, and last-used and revocation times. Workspace members must protect their credentials and report suspected misuse.

Provider notices: Resend privacy policy and AWS privacy notice.

Lookups and property sources

We retain submitted addresses, normalized forms, match status, source details and the results needed to run your workspace. Requests may send an address to Homefront or another configured property or address-data provider. We also match against locally held public datasets. We do not send your sign-in code or payment information with a property lookup.

Public county datasets and internal source responses are stored separately from workspace results. Those source records and older archives can include additional fields, including mailing addresses and lending records. Revealed workspace results, the API and exports include source-reported sale and mortgage records, including buyers, sellers, borrowers, lenders, dates, amounts, loan status and dated balances where available. They exclude mailing addresses, contact enrichment, inferred equity and personal-financial profiles, and do not expose raw provider payloads. We do not use these sources to add personal phone numbers or email addresses.

As you type, address suggestions are requested from our address provider. For signed-in users with property access, we may fetch the suggested properties in the background before you choose one. Those source responses are stored server-side in a size-limited cache with a 24-hour lifetime; they are not sent to your browser or charged as owner reveals. Selecting an address displays only public property facts and imagery. The explicit reveal action requests names and sale and mortgage records and may use a credit.

Property imagery may come from the source provider or Google Maps. Loading an embedded map or image can disclose the property address, your IP address and browser information to that provider. Google imagery is not added to our property archive. Copying a value stays on your device. Selecting a Google search or Maps link opens that provider’s site and sends the selected query there.

We use account, lookup and technical records to deliver results, manage access, account for usage, prevent abuse, investigate errors and support customers. Your submitted lists are not published as a public search directory.

Maps, storm reports, lists and notes

Workspace maps load street maps from OpenFreeMap and aerial imagery from the U.S. Geological Survey directly in your browser. Those providers receive your IP address, browser information and the map area you view. Address points and county parcel outlines are served by whohouse. If you choose to center the map on your location, your browser shares it with the page for that purpose; we do not store it.

What’s around an address (businesses and amenities at it, with their published hours and contact details, the building, the street, the neighborhood and nearby places) comes from a copy of OpenStreetMap that we hold; the address is not sent to OpenStreetMap. To place an address for it, we use our own address data first and may then send the address, without your account details, to the U.S. Census Bureau geocoder or a USDOT National Address Database map service. Business contact details are the business’s own published listing; we do not add personal phone numbers or email addresses.

Storm reports and weather warnings come from NOAA’s Storm Prediction Center and the National Weather Service. Our server requests them by date and area, without your account details. A report or warning near a property does not establish that the property was damaged.

Lists, statuses, assignments and notes you create are visible to members of the workspace. They remain until a member deletes them or the workspace is closed. Owner names shown on lists are read from retained lookup results and follow the same 30-day retention.

Billing and service providers

Stripe handles checkout and payment details. We retain customer and subscription identifiers, plan and billing status, billing-period dates and payment-event references. We do not store full payment-card numbers. See the Stripe privacy policy.

Hosting, email, payment and data providers process the information needed for their part of the service. Technical requests can include your IP address and browser or client information. Following a source or other external link takes you to that provider’s service and its own policies.

Before you sign in

You can search addresses and make one owner lookup without an account. To show you that lookup again and to limit free lookups, we set a random visitor cookie in your browser for 7 days and record the address, its result (owner names, the last sale, the lender and basic property facts), the time, and a keyed hash of your network address. We keep these records for 7 days. A lookup that finds no owner, or fails, is kept only as an attempt and does not use your free lookup. If you sign in in the same browser, the house you looked up joins your account at no cost and is looked up again for your workspace, so it appears in your history.

On your device only, your browser keeps the addresses you searched, so you can return to them, and for 10 minutes the email address you asked to sign in with, so signing in can finish on another page or tab. Clear recent searches with Clear under the search box, or clear this site’s data in your browser.

Retention

Workspace lookup jobs and results expire 30 days after submission. We retain at most the newest 500 completed jobs per workspace, so older results can be removed sooner. Expired jobs and their address inputs and results are removed during cleanup. Recently viewed properties, with their map locations, are kept for 30 days after their last use unless they are on a list. Lists and notes are kept until deleted. Downloaded files are separate copies controlled by the person or business that exported them.

The 30-day period does not apply to the underlying property archive, imported public datasets, older account history, billing and usage ledgers, or administrative and security records. These are retained separately to operate the service, maintain source consistency, prevent abuse and handle disputes. Recovery backups can retain older copies after live records change. We do not promise that an expired batch deletes the corresponding public-source record.

For an account access, correction or deletion request, contact agent@mistakes.io. We may need to verify your identity and your authority over a workspace. We will explain any records that need to be retained; cancelling a subscription alone does not delete an account or workspace.

Property opt-outs

You can request a property opt-out without an account or payment. We privately retain the submitted address or link, contact email, stated relationship and request time for review. Contact details are used for the request, not marketing. Approval requires review of your authority to make it.

Approved properties are suppressed from subsequent property results, including results read or exported from existing workspace jobs. A suppression record remains to prevent reappearance after a refresh. This does not change government records or other websites, retract previously downloaded files, or erase internal source archives and recovery backups.

Contact emails and review notes are cleared from the live request queue 90 days after resolution. The suppression and request record can remain. For help with an opt-out or another privacy question, email agent@mistakes.io.

Changes and questions

We update this notice when our practices change and identify the current version by its effective date. Contact agent@mistakes.io with questions about your information or use of property records.