Privacy
What happens to what you give us
This says what happens to what you give us. It describes what the software actually does today, not what we might do later. If any of it stops being true, this page changes before the behaviour does.
Last updated 2026-08-13.
What we collect
The documents you upload — Loan Estimates, Closing Disclosures, or the informal worksheets lenders send before one. These contain your name, the property address, your loan amount and your rate.
The email address you give us when you run a check or create an account.
A count of how many times the free check has been run, tied to a rotating anonymous identifier rather than to you. It exists so a free service that calls a paid one cannot be run in a loop, and it is described in full below.
We do not ask for a Social Security number and we do not want one. If one appears on a document you upload, it is stripped out of everything we extract from that document before any of it is stored, and out of the text the extraction model is sent. The document itself is kept as you sent it, encrypted at rest, and erased when you delete it.
What we do with your documents
They are encrypted before they are written to disk and only decrypted to read them. We send the contents to Anthropic’s API to extract the fields, because that is how the reading is done; Anthropic does not train on API data.
We never send your documents to a lender. We never contact a lender at all — there is deliberately no send button on our servers.
We do not sell them, rent them, or share them with anyone else.
The anonymous count, in detail
Every free check records one row: the calendar day, a digest, and how many tokens the extraction used. The digest is built from your IP address and browser string, hashed with a secret salt that is replaced every day.
That means it can answer "how many separate people ran a check today" and cannot answer "who". It cannot be reversed, and yesterday’s rows cannot be matched to today’s. We never store the IP address or the browser string themselves.
The benchmark rows
When we have read enough documents, we keep an anonymized row describing what a lender charged: a state, a week, a loan type, an amount band, and a hashed lender name. No borrower name, no address, no loan number, nothing that points back to you.
Those rows are what let us tell the next person whether a fee is normal. The lender name is a salted hash, so those rows cannot be turned back into a list of names — not by us and not by anyone who obtained the table. That is why they are the one thing that survives deleting your account: by then there is nothing in them to delete.
Deleting everything
Ask and we erase your documents, everything we extracted from them, your reports and your saved outcomes. Erased, not hidden — the encrypted objects are removed from storage.
The anonymized benchmark rows described above survive, because there is nothing in them to delete.
Cookies and tracking
We use no third-party analytics, no advertising pixels, and no tracking cookies. Our page-view counting is first-party and uses the same rotating anonymous digest described above.
Once accounts exist, signing in sets one cookie that keeps you signed in. It holds a signed session identifier and nothing else.
Who we share with
Anthropic, to read your documents. Stripe, to take a payment. Resend, to send you a link or a receipt. Our hosting and storage provider, to run the site and hold the encrypted files.
Anthropic receives the text of the document you uploaded, with any Social Security number stripped out first
Stripe receives your card details, which reach Stripe directly and never pass through us
Resend receives your email address and the text of the message
Our hosting and storage provider receives the encrypted document. They do not hold the key, so they cannot read it.
That is the complete list. Nobody is paid for access to you, and nobody pays us for it.
Reaching a person
Mason Kiffmeyer runs Fully Negotiable. Questions about anything on this page, including a deletion request, go to him directly.
The rules we hold ourselves to, and why, are on the promise page. Several of them are enforced by automated checks that fail our build if they are broken.