Privacy policy

Plain version: we collect what we need to run your account and the site, we do not sell it, and your company's private steps are visible only to your company.

What we collect

• Your account: name, work email, company name, trade, where you are based, and the cities you work in. Passwords are stored only as a secure hash, never in plain text.
• What you write: public steps you add or edit (shown with your company's name), and your company's private steps and notes (shown only to your company).
• How the site is used: we record four things: a search, a job lookup, a jurisdiction page view, and a permit page view. Each record holds what was searched for, how many results came back, the city or permit page it happened on, the date and time, and a visitor code. The visitor code is a one-way hash of your network address, your browser string and today's date, so it counts people within one day, is a different value tomorrow, and your address cannot be read back out of it. We do not use advertising trackers.
• For signed-in people, the same four records also carry your user account and your company. That means we can tell that someone at your company searched for a permit in a city, and which account it was. We use it to see whether the site works: whether someone who looks a permit up comes back and writes one, and which cities people ask for that nobody has written yet. We do not record what you type into your private steps, notes or processes as usage data, and we do not build a profile of you or sell any of this.
• Messages you send us through the contact page.

What we never collect

Do not enter logins, passwords or payment card details for city portals or anything else. We do not ask for them and we remove them when we find them.

Who can see what

• Public steps and the company that wrote them: everyone.
• Your company's private steps, notes and saved processes: people in your company only.
• Your email address: us, and people in your company. It is never shown publicly.
• Your usage records, including the ones tied to your account: us. They are never shown to other companies and never published.

Services we use to run the site

Hosting (Vercel), the database (Neon), email delivery (Resend), and, only when you have a document read into steps, a provider (Anthropic) that processes that one document and returns the steps. These services handle data on our behalf and are not allowed to use it for anything else.

Typefaces

The two typefaces this site is set in are served from our own address along with the rest of the page. Your browser fetches nothing from Google, or from any other font host, to read Permitpedia. It used to, and that page load told Google the network address of the device you were reading on; it no longer does.

Cookies

Two, and neither one follows you. One keeps you signed in. The other remembers that you chose “do not ask again” when printing, so the sheet goes straight to your company's default template. There are no advertising or analytics cookies.

Your choices

You can change your company details in Settings. To delete your account or your company's data, or to get a copy of it, contact us and we will do it. Public steps your company wrote may stay on the site without your company's name, because other contractors rely on them.

Changes

If we change this policy in a way that matters, we will say so on the site and by email before it takes effect.