Privacy Policy

1. Overview

neighbors.fyi is a registered fictitious name of Loomfield Labs, LLC, a Florida limited liability company (“Loomfield Labs,” “neighbors.fyi,” “we,” “us,” “our”). We run private community portals for HOAs, condos, co-ops, and residential neighborhoods (the “platform” or the “Service”). Each community lives at its own subdomain (for exampleyour-community.neighbors.fyi) with isolated data and resident-only access. This Privacy Policy applies to every resident-facing page on the platform, every community subdomain, and the marketing site at neighbors.fyi.

We treat resident data as the property of the community that produced it. We don’t sell it, we don’t advertise against it, and we don’t use it to train AI models.

2. Information we collect

2.1 Account data

When you create an account we collect your name, email address, and password (stored as a one-way hash, never in plain text). After signing up you can add an optional profile picture and a short bio, and a phone number if you choose to post a marketplace listing. We do not ask for a phone number to open an account.

2.2 Verification data (residential address)

To verify that you live in the community you’re joining, we collect your physical residential address within that community’s boundary. We use the address to confirm residency eligibility, link your account to the property record, and (where the community allows) display your home on a community-private map. Residential addresses are treated as sensitive personal information.

Your address is not linked to your name for other residents unless you turn that on. Your profile shows your street address to other residents only if you enable show_address in your profile settings. One thing is worth being precise about: your community keeps a list of the homes in it, and that list, including addresses, is visible to residents on the community map and in property pickers. What the setting controls is whether you are identified as living at one of them. Looking up a property never reveals who the owner is; the owner’s name and email are shown only to administrators, and to you for your own home.

Community administrators of your own community can see your address as part of the user-management screen so they can verify residency and resolve property linkage. Residents and administrators of other communities never see it. Neighbors.fyi staff access is described in Section 4.

The platform has no feature for uploading documentary proof of residency, and we do not collect any. An administrator who wants to see a utility bill or a deed before approving you will ask for it outside the portal. If we ever add such a feature, uploads would be stored with the same protections as your address and deleted within 60 days of successful verification, and we would say so here first.

2.3 Content data

Posts, comments, channel messages, direct messages, polls, community issues and architectural requests, RSVPs, photos, documents, vendor recommendations, and any other content you create inside the community portal.

Direct messages between residents are visible only to the sender and the recipient, with one exception: if either participant reports a message, that message is shown to your community’s administrators so they can review the report.

Chat channels, including board and committee channels, are readable by every approved resident of your community. That is deliberate: the point of a board or committee channel is that you can see it and raise something with the right people, and posts from board and committee members are badged so you know who you are talking to. Only staff-only channels are restricted, and they are restricted to administrators. Treat anything you post in a channel as visible to your whole community.

2.4 Property & payment data

If your community uses the platform for dues and assessments, we record the property you’re associated with, payment history, late-fee status, and any auto-pay subscription you set up. Card and bank-account details are collected and held solely by Stripe and never touch our infrastructure. We store only Stripe’s transaction and customer references, never a card number, expiry, or bank account number. Payment receipts are issued by Stripe.

2.5 Authentication & session data

We record successful sign-ins in our own logs (see Section 9 for retention). Password resets and email changes are handled and logged by our authentication provider, Supabase, under their retention. We issue session cookies (Secure, and SameSite=Lax) and refresh tokens managed by Supabase. These cookies are readable by the application’s own JavaScript, which is what lets the app talk to the database as you; they are not readable by any other site.

2.6 Operational metadata

IP addresses, used to rate-limit sensitive endpoints, and your browser’s user-agent string, recorded when you file a support request or when our staff take an action, so we can reproduce problems. We do not collect device fingerprints or advertising identifiers. Pages you visit inside the product are recorded as an internal audit trail (page_views) so community administrators can investigate moderation incidents and so we can debug failures. Administrative actions by a community admin (approving a user, removing a post, changing settings, moderation) are recorded with the actor’s identity in the community’s audit log.

3. How we use your data

• To provide the community portal: render your dashboard, deliver messages, process dues payments, send notifications.
• To verify that new accounts are real residents of the community they’re trying to join.
• To send transactional and community-critical emails: invite confirmations, password resets, dues receipts, community issue updates, emergency alerts, and any digests you’ve opted into.
• To keep the platform secure: detect suspicious sign-ins, throttle abusive traffic, investigate reports of harassment or impersonation, respond to security incidents.
• To improve the product: understand which features are used, prioritize what we build next, fix bugs. Aggregated and de-identified data only.
• To comply with law and respond to valid legal process.

We do not use your data for advertising, sell it to data brokers, or train AI models on the content of your community’s messages, documents, or member directories.

4. Who can see your data

Communities are private by default. A given resident sees only the content their role allows.

• Other verified residents in your community can see your display name, your profile picture, your role (resident, board member, admin), the posts and messages you make in channels they also have access to, and any community-profile fields you’ve opted to share (such as showing your home on the map).
• Community administrators of your own community can additionally see your email address, residential address, account status, the pages you have visited inside the portal, and the community’s audit log. Administrative actions, including role changes and moderation, are recorded in that log with the actor’s identity and a timestamp.
• People outside your community never see your name, address, posts, or any other community content. Each community subdomain is access-controlled at the database row level via Postgres Row Level Security policies that deny access by default and require an authenticated session in the correct community before any data is read.
• neighbors.fyi staff with administrative database access can technically read data across communities. This access bypasses Row Level Security by design and is required for incident response, recovery from system failures, debugging, and compliance with legal process. Staff access is restricted to personnel with a need to know, every access is logged, and staff act under written confidentiality and data-handling obligations. This also includes support sessions, where authorized staff sign in to your community with administrative access to provide support or set up integrations on your behalf. Every support session is recorded in your community’s audit log, and we email the primary or billing contact on file for the community when one begins.
• Sub-processors process limited data on our behalf under contract. Section 5 lists them, and separately lists the outside services that receive data for their own purposes rather than ours.

5. Sharing & third parties

We share data with outside services only to operate the product, and only to the extent each one needs. There are two kinds, and the difference matters, so we list them separately.

Sub-processors: they handle data for us

These providers work on our behalf under a contract that limits them to what we ask for. They may not use your data for their own purposes.

• Supabase hosts the per-community Postgres database, authentication system, and object storage (photos, documents, attachments).
• Vercel hosts the application code and performs edge networking for the marketing site and tenant subdomains.
• Stripe processes dues, assessments, architectural review fees, and violation-fine payments. Card details are stored with Stripe, never with us.
• Resend sends transactional emails and admin-initiated community broadcasts.
• Anthropic powers the AI features (meeting-minute generation, PDF budget extraction). See Section 8 for the specifics of what gets sent and our retention instructions.
• Google Meet, where your community has connected it, hosts board-meeting spaces and returns the meeting transcript that the minutes feature reads.
• Sentry receives application error reports, tagged with the account id of the signed-in user so we can trace a fault back to a session. Request bodies, cookies, and headers are stripped before sending.

Independent services: they handle data for themselves

These services receive data from the product and then use it under their own privacy policies, for their own purposes. We chose to rely on them, but we do not direct what they do with what they receive, and we cannot make promises on their behalf.

• Google Maps renders the community map and converts addresses into map coordinates. Your community’s property addresses, and any address typed into an address-autocomplete field including at signup, are sent to Google. For this, Google is an independent controller of the data rather than our contractor, so Google’s own privacy policy governs what it does with those addresses.
• Klipy powers the GIF picker in chat. Your search terms go to Klipy when you use it. And because a posted GIF is delivered from Klipy’s own network rather than ours, Klipy sees the IP address of everyone who later views that message, whether or not they ever opened the picker.
• jsDelivr serves the emoji image set used to render emoji consistently across devices. It sees the IP address and browser of the device loading them, and nothing from your community.
• Apple, Google, and Mozilla push services deliver push notifications to your device if you enable them. The contents are encrypted so the push service cannot read them.

Vercel also provides the page-view and performance analytics described in Section 6. The full list, with what each service receives, is published in Annex III of our Data Processing Addendum.

We may disclose data when required by a valid court order, subpoena, or similar legal process. When the law permits, we will notify the affected community administrators before responding so they can object or narrow the request. We will resist overbroad requests.

We do not sell personal information as that term is defined under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), and we do not share personal information for cross-context behavioral advertising. See Section 11.

If Loomfield Labs, LLC is ever acquired or merged, or the neighbors.fyi business is transferred, any successor entity must honor the commitments in this policy or notify residents at least 30 days in advance of any material change so they can export their data and leave.

6. Cookies & tracking

We use a small number of strictly necessary cookies: Supabase session cookies to keep you signed in, your display preferences (dark mode, text size, and interface appearance), which home screen you last chose, which announcements you have dismissed, and a short-lived random value that protects the Google account linking flow against cross-site request forgery. Administrators previewing the resident view or a different plan tier get one more, which only ever reduces what they can see. We do not use cross-site advertising cookies, third-party analytics that build a profile of you across the web, or ad-targeting pixels.

Our hosting provider, Vercel, collects page-view and page-performance measurements from every visit. These are cookieless and are not used to follow you to other websites.

Server-side counts of which routes are visited and which features are used are kept for product analysis. Those counts are not joined to your account except when a community administrator views the per-user activity log for their own community.

7. Security

Every community runs on its own database with Row Level Security policies that deny access by default and require an authenticated session in the correct community before any data is read. Connections to the platform are HTTPS only. We rate-limit sensitive endpoints (signup, password reset, dues processing) to slow down abuse.

Residential addresses and other personal data are stored securely. Access is gated by strict Row Level Security controls, and the underlying database storage is encrypted at rest by our cloud infrastructure provider. The database credentials we hold for each community are additionally encrypted by us, with AES-256-GCM, before they are stored. Card and bank-account details are stored only by Stripe and never touch our systems.

No system is invulnerable. If we ever discover a security incident affecting your personal data, we will notify you and any affected community administrators without undue delay and, where the law requires it, no later than 72 hours after we confirm the incident affects you. We will describe what happened, what data was involved, and what we are doing in response, in accordance with applicable law.

8. AI features and your content

Two features use a third-party large language model (Anthropic Claude) to generate text: drafting meeting minutes from a recorded transcript, and extracting budget data from an uploaded PDF. Both are optional in the sense that matters: nothing is ever sent to Anthropic unless a community administrator deliberately runs one of those two tools. Residents cannot trigger them, no other part of the product calls an AI model, and both tasks can be done by hand instead. Nothing you post is fed to a model in the background.

When an admin uses an AI feature, the content needed for that specific request (a transcript, a PDF) is sent to Anthropic. Because shared content may include statements made by other residents (for example, attendees speaking at a board meeting that was transcribed), this means a resident’s contribution can be processed by the AI as part of an admin-initiated task even though the resident did not personally invoke it.

We mitigate this by:

• Sending only the content required for that specific task; never your full message history or directory.
• Relying on Anthropic’s commercial terms, under which content submitted through their API is not used to train their models. Anthropic retains content only for the duration required to process the request and for a trust-and-safety review window, per those terms.
• Tagging each request with the invoking user’s account identifier, which is an opaque id and not your name or email, so that abuse signals are attributable and so we can identify a specific person’s submissions if we need to raise a deletion request with Anthropic.
• Logging every AI invocation in the community’s audit log so the source of any generated content is traceable.

We do not use AI to make automated decisions that produce legal or similarly significant effects concerning you (GDPR Art. 22). AI-generated text is always reviewed and published (or discarded) by a community administrator before it appears anywhere.

9. Retention, deletion & your rights

You have the right to access, correct, export, and delete the personal data we hold about you.

What we can act on directly, and what your community controls. We delete and anonymize the account-level data described below on our own authority, because that data is ours to control. Some records belong to your community rather than to us: the owner or member roster your association may be legally required to keep, dues and assessment records, and records of violations, architectural requests, and board decisions. Where your request touches those, we pass it to your community’s administrators, help them respond, and tell you the outcome. We will not quietly rewrite your community’s official records, and equally, a community cannot use them as a reason to keep data that is ours to delete.

9.1 Exporting your data

You can download your account data and most of the content you’ve authored at any time from your profile page, as a ZIP of JSON files. Community administrators can export their member roster and a compliance summary as CSV from the admin area. If you need a fuller export of your community’s records than those cover, contact us at the address in Section 15 and we will put one together.

9.2 What happens when you delete your account

You can request permanent deletion at any time from your profile settings, or by emailing us at the address in Section 15. The in-product option submits a request that an administrator then executes; it is not instant. If you are the Account Owner of a community (the person responsible for its subscription and payment method), we will first ask you to transfer ownership to another administrator or close the community, so it isn’t left without an owner or with an unresolved subscription. This sequences your request; it does not deny it, and your personal data is still deleted. After we confirm the request and complete it (within 30 days, or 45 days if you’re a California resident, with the possibility of an extension where the law permits):

• Purged: your auth.users row, your profiles row (name, email, bio), your user_addresses row, and your uploaded profile picture, including the image file itself.
• Cancelled: any dues auto-pay running against your home is cancelled at Stripe before your account is removed, so nothing can keep charging you. If we cannot cancel it, we stop and do not delete the account, rather than leave a live charge behind.
• Anonymized: content you authored that other residents have already interacted with (chat messages, direct messages, comments, vendor reviews, marketplace listings, project updates). The text remains so the community’s record stays coherent, but the author field is replaced with a "Deleted resident" placeholder.
• Deleted outright: your poll votes, event RSVPs, amenity reservations, pet records, community issues you reported, notification preferences, and any announcements you posted. These are removed rather than anonymized.
• Retained in anonymized form: audit-log entries, dues-payment receipts, special-assessment records, refund records, and other financial transactions that we are required to retain for tax and accounting compliance. These records are tied to a property rather than to you, and your name is removed from them; the transaction itself stays.

9.3 Backups

Our database provider takes a backup of each community’s database daily and keeps them for 7 days. After a deletion, your data may persist in those backups for up to 7 days before it is overwritten in the normal rotation. We do not restore from backup except in the case of a disaster, and we will not restore a deleted user from backup at the request of any community without your explicit consent.

9.4 Authentication and security logs

Sign-in events and rate-limit logs are retained for 90 days for security investigations and then deleted automatically by a scheduled job. Password-reset and email-change events are recorded by our authentication provider, Supabase, and are retained under their policy rather than ours. Logs of suspected abuse or fraud may be retained longer for the duration of an active investigation.

9.5 Community cancellation

When a community cancels, there is a 14-day reactivation window during which the community stays live and fully restorable. After that window closes, we take a single archival backup and then delete the live database entirely. The archival backup exists only so a community that comes back can be restored rather than rebuilt from nothing; it is held in encrypted storage, accessible only to us, and is permanently deleted 12 months after archival. A community can ask us in writing to purge the archive immediately instead, which ends any possibility of reactivation.

9.6 Retention summary

10. Your privacy rights by region

10.1 California (CCPA / CPRA)

If you’re a California resident, you have the right to:

• Know what personal information we have collected about you in the past 12 months, the sources, the purposes, and the categories of third parties we’ve shared it with.
• Delete personal information we have collected, subject to the exceptions in CCPA § 1798.105(d) (legal compliance, security incidents, contractual obligations, etc.).
• Correct inaccurate personal information.
• Opt out of the sale or sharing of your personal information. We do not sell or share personal information; see Section 11.
• Limit the use of sensitive personal information. We treat residential addresses as sensitive personal information and use them only for the purposes described in this policy.
• Non-discrimination for exercising any of these rights.

To exercise these rights, contact us at privacy@neighbors.fyi or use the contact form. We will respond within 45 days, with an extension of up to 45 additional days where the law permits and we notify you of the extension.

You may designate an authorized agent to exercise these rights on your behalf. We will require reasonable verification of the agent’s authority and of your identity before acting on the request.

10.2 Other U.S. states

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), Oregon (OCPA), and Montana (CDPA) have rights similar to those described in Section 10.1: the right to access, correct, delete, port, and opt out of certain processing. Use the same contact path to exercise these rights. We will respond within the time frame the applicable statute requires.

10.3 EU / UK (GDPR / UK GDPR)

If you are in the European Union, the United Kingdom, or another jurisdiction with GDPR-style protections, Loomfield Labs, LLC (operating as neighbors.fyi) is the controller of your account data, billing data, and service telemetry, and our lawful bases for that processing are set out below. For the content and records inside your community (your posts and messages, your community’s requests, violation and architectural records, documents, and dues records), your community association is the controller and we act as its processor under our Data Processing Addendum. Where you want a community record corrected or removed, your community’s administrators can act on it directly; we will pass your request to them and help them respond. Our lawful bases for the data we control are:

• Contract (Art. 6(1)(b)): providing the community portal you signed up for.
• Legitimate interests (Art. 6(1)(f)): keeping the platform secure, preventing abuse, and improving the product. We balance these against your rights.
• Consent (Art. 6(1)(a)): optional features you choose to enable (showing your home on the community map, opting into a community email digest).
• Legal obligation (Art. 6(1)(c)): tax, accounting, and law-enforcement-response retention.

You have the right to access, rectify, erase, restrict processing, port your data, and object to processing based on legitimate interests. You also have the right to lodge a complaint with your local supervisory authority. Contact us at privacy@neighbors.fyi; we will respond within 30 days, extendable by up to 60 additional days for complex requests where we notify you of the extension.

We transfer EU/UK personal data to the United States. Where the law requires it, we rely on the Standard Contractual Clauses approved by the European Commission and the UK International Data Transfer Addendum.

11. Do not sell or share my information

neighbors.fyi does not sell or share personal information as those terms are defined under the California Privacy Rights Act (CPRA), the Virginia Consumer Data Protection Act (VCDPA), or similar state laws. We do not engage in cross-context behavioral advertising. There is no advertising product on the platform.

If that ever changes, we will notify you in advance and provide a working opt-out at this same anchor.

12. Children’s privacy

neighbors.fyi is not intended for children under 13. We do not knowingly collect personal information from anyone under 13, in compliance with the U.S. Children’s Online Privacy Protection Act (COPPA). If you believe a child under 13 has created an account, email us at privacy@neighbors.fyi and we will remove the account and any associated data promptly.

A community may impose a higher minimum age through its own rules and enforce it when approving accounts. The platform itself enforces only the 13-year minimum.

13. International users

neighbors.fyi is operated from the United States, and the data we collect is processed and stored on servers located in the United States. By using the platform from outside the United States, you consent to the transfer of your information into the United States. See Section 10.3 for EU/UK transfer mechanisms.

14. Changes to this policy

We will update this policy when our practices change. The “Last updated” date at the top of this page reflects the most recent revision. For material changes (anything that broadens how we use or share your data), we will notify community administrators by email at least 30 days before the change takes effect so residents have time to review.

15. Contact us

Routine privacy questions: open a request via the contact form.

Formal requests under the laws referenced in Section 10 (CCPA, CPRA, GDPR, etc.) and other legal notices: privacy@neighbors.fyi, or by mail to neighbors.fyi, 7901 4th St N, STE 300, St. Petersburg, FL 33702, USA.