This policy explains what personal information SheriffSaleData (“we”, “us”) collects when you use www.sheriffsaledata.com, including when you sign in with Google, how we use it, who we share it with, how long we keep it, and how you can have it deleted. Questions go to support@sheriffsaledata.com.
Summary
- We collect only what is needed to run your account: your email address, your name and profile picture if you sign in with Google, the searches and alerts you save, the state or county you follow, and, if you use the data API, your keys’ names and which sales they fetched.
- An account without a plan gets a short series of emails about sheriff sales, each with a one-click unsubscribe. Otherwise we email you only about what you ask for or start: sign-in links, your alerts, a checkout you leave unfinished, and a free trial before it charges.
- We do not sell personal information, share it for advertising, or use advertising trackers. We use PostHog to understand how the site is used.
- We use Google sign-in only to identify you. We do not read your Gmail, contacts, calendar, Drive or any other Google data.
- You can ask us to delete your account and its data at any time by emailing support@sheriffsaledata.com.
Information we collect
When you sign in with Google
If you choose “Sign in with Google”, we request only the standard openid, email and profile scopes. From your Google account we receive:
- your email address and whether Google has verified it;
- your name and profile picture URL;
- a Google account identifier that links your Google sign-in to your SheriffSaleData account, together with the sign-in tokens Google issues as part of that exchange.
We do not request, and cannot access, your Gmail messages, contacts, calendar, files, or any other data in your Google account.
When you sign in with an email link
If you sign in by email, we collect the email address you enter and send a one-time sign-in link to it. The link expires after 15 minutes. There are no passwords on SheriffSaleData accounts.
When you ask for the free weekly email on a page
A state or county page, and our guides, can take your email address for that place’s free weekly email. We keep the address, the place and the page you asked from, and email you a link that confirms it and signs you in. Nothing else is sent to that address unless the link is clicked; clicking it creates your account if you have none and switches the email on. We also keep when the link was followed, and the record stays with your account.
While you use your account
- Account records: when your account was created, your plan, and a log of account events such as sign-ins.
- Saved searches and alerts: the search filters you save, the names you give them, how often you want alerts, and a record of each alert email we send (when it was sent and how many listings it contained).
- Session cookie: after you sign in, we set a cookie holding a random session identifier so you stay signed in. Sessions last up to 30 days.
- Your market: the state or county you were looking at when you signed up, or, for accounts created before October 2026, the one you viewed most on the site (from the analytics described below). A saved search takes its place once you have one. It is used only to choose the figures in the emails described under Emails we send.
- Browser notifications: only if you turn them on. For each browser where you do, we store the address your browser’s push service gives us and the keys used to encrypt notifications to it. We do not store your device type or IP address with it.
- Data API keys: only if your plan includes the data API and you create a key; what we keep about keys and their use is under The data API.
When you subscribe to a paid plan
Checkout happens on a page run by Creem, our payment provider and merchant of record. You give your card and billing details to Creem, not to us; we never see or store your card number. Creem tells us the identifiers of your customer record and subscription, which plan it is for, its status (trial, active, cancelled, payment failed), and when the current period ends. We store those so your plan opens and closes at the right time and so we can link you to Creem’s billing portal.
When you contact us
Messages sent through the contact form include the name, email address, topic and message you enter. If you happen to be signed in, the message is linked to your account.
Collected automatically
- Performance measurements: anonymous page-speed metrics (such as how long a page took to load) and the page path they were measured on. These are not linked to your account.
- Server logs: the server in front of the site keeps an access log of every request it receives: the IP address it came from, the full web address requested (including any search filters in it), the browser’s or program’s user agent, the referring page, the time and how the server answered. We use it for security, to spot and stop abuse and attacks, and to understand which search engines, crawlers and other automated visitors read the site. It is kept for 14 days and then deleted.
- Rate limiting: the contact form and sign-in links use your IP address and the email address entered to prevent abuse, and the data API uses the IP address of a request whose key does not work. These IP addresses are held in memory for up to a day and never written to our database (the access log above is separate). For the contact form, the address limit counts the messages already stored under that address.
- Theme preference: if you choose light or dark mode, that choice is saved in your browser’s local storage. It never leaves your device.
Product analytics (PostHog)
We use PostHog, hosted in the United States, to understand how people use the site so we can improve it. In your browser, PostHog records:
- the pages you view (including any search filters in the page address), the links and buttons you click, and where you came from (the referring site and any campaign tags in the link);
- browser, device type, screen size, and an approximate location derived from your IP address;
- session recordings and heatmaps: a reconstruction of how pages were scrolled and clicked, with what you type into form fields masked;
- errors that occur in the page;
- a random identifier stored in a cookie and local storage, so visits from the same browser can be grouped.
When you sign in, we link that identifier to your account’s internal ID (not your email address or name), and we record that an account was created and whether it used Google or email, when you open a checkout, which plan and price it was for, and, for the data API, when a key is created or revoked and when a key is first used (never the key, its requests or what they asked for). We do not send PostHog your Google profile, your email address, or the contents of messages you send us. PostHog does not use this data for advertising. You can block it with any common tracker blocker, and the site keeps working.
We do not use advertising cookies or cross-site tracking.
How we use information
- to create your account, sign you in, and keep you signed in;
- to save your searches and send the alert emails you subscribe to;
- to send service emails, such as sign-in links and a welcome message;
- to send accounts without a plan a short series of emails about sheriff sales, as described under Emails we send;
- to follow up on a checkout you started and did not finish, and to remind you before a free trial’s first charge, as described under Emails we send;
- to answer messages you send us;
- to run the data API for plans that include it: to check each key, apply your plan’s limits and count your monthly allowance, as described under The data API;
- to protect the service, prevent abuse, and stop mail to addresses that bounce or report spam;
- to measure and improve site performance.
We do not use your information for advertising, and we do not build profiles of you for any purpose other than running your account.
Emails we send
- Sign-in links, only when you ask for one.
- Account notices, such as a change to plans or to this policy that affects you.
- Alerts you switch on, including the free weekly email for one place, each with its own one-click unsubscribe. The free one comes on Mondays when new sales were published in that place or a sale there is coming up that week, and not otherwise.
- A short series for new accounts. If your account has no plan, we send up to eight emails over about four weeks: lessons on reading sale lists and bidding at sheriff sales, with figures for your market and, in two of them, an invitation to start a free trial. Accounts created before October 2026 get a notice first, with a one-click way out. The series stops after its last email, as soon as you start a plan, or when you use the one-click unsubscribe in any of its emails, which stops the series and nothing else.
- About a checkout or a trial. If you open a checkout and do not finish it, we send up to two short notes asking whether something got in the way: about an hour later and a day later, and then nothing more. Each has a one-click unsubscribe, which also switches off your alerts and the series for new accounts; sign-in links still arrive. While a free trial runs, the reminder before its first charge comes from Creem, our merchant of record, not from us; we send no trial reminder of our own. Cancelling the trial stops it.
- API key notices, when a data API key is created on your account, and when we revoke one because it was sent in a web address. They are security notices about your account, so they have no unsubscribe, and they never contain the key.
Google user data
This section describes how SheriffSaleData accesses, uses, stores, shares and deletes data received through Google sign-in.
- Data accessed: your Google account email address, whether it is verified, your name, your profile picture URL, and your Google account ID, through the
openid, email and profile scopes. Nothing else. - How it is used: to create your SheriffSaleData account, sign you in, send the emails described under Emails we send (greeting you by first name), and show your email address on your account page.
- How it is stored: in our account database on servers run by our hosting provider, reachable only over encrypted connections and accessible only to the application and its operator.
- How it is shared: it is not sold, rented or shared for advertising. Your email address is passed to Amazon SES only to deliver emails to you.
- Retention and deletion: kept while your account exists. Email support@sheriffsaledata.com to delete your account, and your Google data is removed within 30 days.
Information received from Google is used only to create and sign in to your SheriffSaleData account, to send you the emails described above, and to show your name and email address on your account. We do not transfer it to others except as necessary to provide the service (for example, storing it with our hosting provider), to comply with law, or as part of a merger or acquisition with notice to you. We do not sell it, use it for advertising, or allow humans to read it except with your consent, for security purposes, or to comply with law.
SheriffSaleData’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. You can revoke SheriffSaleData’s access at any time from your Google Account settings.
The data API
Pro and Business plans can read sales through our data API, with keys created on the account page. If you create a key, this is what we keep, and for how long:
- About each key: the name you give it, its last four characters, a one-way hash of the whole key (never the key itself, which is shown to you once, when you create it), when it was created, when it was last used (to within ten minutes) and, once it is revoked, when and why: by you, by us, or automatically because it was sent in a web address.
- About its use: which sales your keys returned in each calendar month, one entry per sale with the key that first fetched it and when, so that each sale counts once against your plan’s monthly allowance. We keep this month’s and last month’s, and delete older months every day. The requests themselves, and the searches in them, are used to answer and are not stored in our database.
- In memory only: a count of each account’s requests, to apply the per-minute and per-day limits, and the IP addresses of requests whose key does not work, to slow down guessing. Neither is written to our database, and neither is kept for more than a day.
- Server logs: an API request’s web address is written to the server’s access log, like any other (see Server logs above). That is why a key must never be put in a web address: one that arrives in an address is revoked automatically, and we email you to say so.
- What the API returns: the records your plan includes, as CSV export does, including the owner of record and the parties named in a case. It finds sales by place and property, never by a person’s name. Whoever holds your key receives what it returns: if you put a key into another service, such as a spreadsheet add-on or an automation tool, that service receives the data under its own policies.
- Emails and analytics: we email you when a key is created and when we revoke one that was sent in a web address, and PostHog is told when a key is created or revoked and first used. Neither ever carries the key.
- Your control: revoke a key at any time under Data API on your account page; it stops working on its next request. A key unused for 180 days stops working on its own. Revoked keys are deleted 90 days after they were revoked, and every key, with the record of what it fetched, is deleted with your account.
Who we share information with
We do not sell or rent personal information. We share it only with service providers that process it on our behalf to run the site:
- Amazon Web Services (Amazon SES) delivers our emails, including sign-in links, alerts, the series of emails for new accounts, and replies to contact messages, and tells us when an email bounces or is marked as spam.
- PostHog provides product analytics, session recordings and heatmaps, as described above.
- Our hosting provider runs the servers and database where the site and your account data are stored.
- Google processes your sign-in if you choose Google sign-in, under Google’s own privacy policy.
- Your browser’s push service (Google for Chrome, Mozilla for Firefox, Apple for Safari) relays notifications you turned on. Each notification is encrypted to your browser, so the push service carries it without being able to read it.
- Creem processes payments for paid plans as merchant of record, under Creem’s privacy policy. When you start a checkout we send it your email address and your account identifier, so the subscription can be matched to your account.
We may also disclose information if required by law, to protect our rights or the safety of others, or to a successor in a merger or sale of the service.
Public records on the site
The listings on SheriffSaleData are read from the sale lists sheriffs, clerks of court and master commissioners publish as public records. They can include the names of defendants and plaintiffs, court case numbers, parcel numbers and property addresses. Defendants’ and plaintiffs’ names, case numbers, opening bids and judgments are shown only to subscribers whose plan covers the sale, on the site, in CSV export and through the data API, and a private person is never given a page of their own. Without a plan, the site shows how many sales each page and search covers, and the soonest five sales on each page’s list with their address and sale date. This policy covers information about people who use the site; if you believe a listing about you is inaccurate, email support@sheriffsaledata.com and we will check it against the sheriff’s list.
How long we keep information
- Account data, saved searches and alerts are kept while your account exists and deleted when you ask us to delete the account.
- Alert delivery records and account event logs are kept for the life of the account.
- A browser notification subscription is deleted when you turn notifications off, when your browser tells us it no longer exists, or after a week of failed deliveries.
- Subscription records (the plan, its status and dates, and Creem’s identifiers) are kept for the life of the account. Creem keeps payment and tax records for as long as the law requires it to.
- Contact messages are kept as long as needed to handle the request and keep a record of it.
- A request for the free weekly email made on a page is kept with the account it created or reached once its link is followed. One whose link was never followed is kept for 90 days at most, and its address is never mailed again.
- Data API keys are kept until you revoke them, then deleted 90 days later, or until the account is deleted. The record of which sales your keys fetched is kept for the current month and the one before, then deleted.
- If an email address bounces or reports our mail as spam, we keep that address on a do-not-send list even after account deletion, so that we never mail it again.
- The server’s access log is kept for 14 days and then deleted.
- Analytics data held by PostHog is kept under PostHog’s retention settings for our project, and session recordings expire automatically. We delete your analytics data along with your account when you ask.
Your choices and rights
- Unsubscribe: every alert email, every email in the series for new accounts, and each note after an unfinished checkout has a one-click unsubscribe link, and you can turn any alert off from the Alerts page.
- Notifications: turn browser notifications off on the Alerts page, or block them in your browser’s site settings.
- API keys: revoke any key under Data API on your account page; it stops working on its next request.
- Access, correction and deletion: email support@sheriffsaledata.com from the address on your account and we will send you a copy of your data, correct it, or delete your account and its data. We respond within 30 days.
- Analytics: blocking PostHog in your browser, or clearing its cookie, stops analytics collection without affecting the site.
- Revoke Google access: remove SheriffSaleData from your Google Account connections. This stops Google sign-in; it does not by itself delete the data we already hold, so email us for that.
Depending on where you live, including California and the European Economic Area, you may have additional rights under local law. We honor those requests through the same email address, and we will not treat you differently for making one.
Security
All traffic to the site is encrypted with HTTPS. Accounts have no passwords to steal; sign-in links expire after 15 minutes, and sessions can be revoked on our side. Data API keys are stored only as one-way hashes, are shown once, when they are created, and stop working on the next request after they are revoked; a key sent in a web address is revoked automatically. Account data is stored separately from the public listings data, with access restricted. No system is perfectly secure, but we will notify affected users of a breach as required by law.
Children
SheriffSaleData is a professional real-estate data service and is not directed to children under 16. We do not knowingly collect information from them.
Changes to this policy
If we change this policy, we will update the effective date above. If a change materially affects how we use information we already hold, we will tell account holders by email before it takes effect.
Contact
SheriffSaleData · support@sheriffsaledata.com · contact form