Privacy Policy

BuyerPath is designed to collect as little as it needs to work well. Here's the complete picture.

Information you provide directly

• Account information — first name, last name, email address, and a password when you create an account with email and password. Your password is never stored in plain text: we store only a one-way bcrypt hash of it, which cannot be reversed back into your actual password, even by us.
• Google Sign-In — if you create or sign in to your account with “Continue with Google,” Google shares your name, email address, and a unique Google account identifier with us so we can create or sign you into the matching BuyerPath account. We don't receive or store your Google password, and accounts created this way have no BuyerPath password on file unless you separately set one. If the email address on your Google account matches an existing BuyerPath account, we link your Google sign-in to that existing account rather than creating a second one, so your saved roadmap, to-dos, guides, and calculations stay attached to the same account either way.
• Roadmap answers — the answers you give in the Getting Started assessment (e.g. your stage of the home-buying process, timeline, and priorities), plus the personalized roadmap phase generated from them, if you save your roadmap.
• Saved to-do items — the recommended action items you choose to save to your dashboard, including their title, description, and category.
• Saved guides — which guides you've bookmarked.
• Saved calculations — the inputs you enter and the results generated by the mortgage calculator, buy-vs-rent comparison, homeownership goal planner, or location research tool, if you choose to save them (e.g. a label like “Starter home scenario” plus the numbers behind it).

Information collected automatically

• Session cookie — when you sign in, we set a single, secure, first-party cookie (buyerpath_session) that keeps you signed in. It contains your user ID, email, and first name in a signed token that only BuyerPath's server can verify — it isn't used for tracking or shared with anyone else. This cookie expires after 1 day by default, or 30 days if you choose “remember me.”
• Basic request information — like most web services, our infrastructure provider (Vercel) processes standard request metadata (such as IP address) to serve pages and keep the Service secure. We also use your IP address on a short-term, automated basis to rate-limit sign up, sign-in, and password-reset attempts and prevent abuse; those records are automatically cleared on a rolling basis (typically within 24 hours) and aren't used for any other purpose.

What we don't collect

BuyerPath does not currently use analytics or tracking scripts, advertising pixels, third-party cookies, or cross-site tracking of any kind. We don't sell your information, and we don't share it with data brokers or advertisers.

We use the information above to:

• Create and maintain your account, and keep you signed in.
• Save and display your roadmap, to-do list, saved guides, and saved calculations across visits and devices.
• Send account-related emails — a welcome email when you sign up, and password-reset emails when you request one.
• Protect the Service from abuse, such as automated sign-up or login attempts.
• Diagnose and fix bugs, and improve the product.

We do not use your information for advertising or marketing profiling, and we do not sell it.

Passwords are hashed with bcrypt before they're stored — we never store or have access to your actual password. When you request a password reset, we generate a single-use reset token, store only a cryptographic hash of that token (not the token itself), and email you a link containing the raw token. The link expires after a limited time, can only be used once, and resetting your password automatically signs you out of any other active sessions.

Your account and saved content are stored in a PostgreSQL database hosted by Neon. Our application is hosted on Vercel. Both providers are established infrastructure companies that maintain their own security and compliance programs for the infrastructure they operate.

We apply security practices appropriate for an application handling personal account data, including:

• Password hashing with bcrypt (never storing plain-text passwords).
• Signed, httpOnly session cookies that JavaScript cannot read, transmitted only over HTTPS in production.
• Password-reset tokens that are single-use, time-limited, and stored only as a hash.
• Rate limiting on authentication endpoints to slow down automated abuse.

No method of storage or transmission is 100% secure, and we can't guarantee absolute security. If you believe your account has been compromised, contact us immediately at support@buyerpath.com.

BuyerPath relies on a small number of infrastructure providers to operate. We don't use any advertising, analytics, or tracking services today.

• Google Sign-In — if you choose “Continue with Google,” Google authenticates you and shares your name, email address, and Google account identifier with us, as described above. We only request the minimum information needed to identify you (Google's “openid,” “email,” and “profile” scopes) — never access to your Gmail, Drive, Calendar, Contacts, or any other Google service.
• Vercel — hosts the BuyerPath application and processes standard web request data to serve it.
• Neon — hosts our PostgreSQL database, where account information and saved content (roadmap, to-dos, guides, calculations) are stored.
• Resend — delivers the transactional emails BuyerPath sends (account welcome emails and password-reset emails). Resend processes your email address and the content of those messages solely to deliver them.

We don't use these providers to build advertising profiles or share your information with unrelated third parties. None of them are permitted to use your information for their own marketing purposes.

We keep your account information and saved content for as long as your account is active, so the Service can work the way it's meant to — a place you can return to without starting over. Password-reset tokens and abuse-prevention records are short-lived and cleared automatically. If you delete your account, we delete your account record and associated saved content (roadmap, to-dos, guides, and calculations) as described below.

You can request deletion of your account and associated data at any time by emailing support@buyerpath.com from the email address on your account. We'll verify the request and delete your account information and saved content (roadmap, to-do items, saved guides, and saved calculations). Some records, such as those we're required to retain for security or legal reasons, may be kept for a limited additional period as necessary.

• Access and update. You can view and manage your saved roadmap, to-do list, guides, and calculations directly from your dashboard.
• Delete individual items. Saved to-dos, guides, and calculations can each be removed individually from the relevant page.
• Delete your account. See “Account Deletion” above.
• Use BuyerPath without an account. The roadmap, calculators, location research, and guides are all usable without signing up — creating an account is only required to save your results across visits.

BuyerPath is intended for adults researching home buying and homeownership and is not directed at children. We do not knowingly collect personal information from anyone under 18. If you believe a child has provided us with personal information, contact us at support@buyerpath.com and we'll delete it.

BuyerPath may eventually introduce new features or monetize in new ways, such as advertising or partnerships. If we do, and it involves collecting new categories of information or using new third-party tracking or advertising technology, we will update this Privacy Policy before that functionality goes live and, where appropriate, notify you.

We may update this Privacy Policy as BuyerPath evolves. If we make material changes, we'll update the “Effective” date at the top of this page and, where appropriate, notify you (for example, by email or an in-product notice). We encourage you to review this page periodically.

Questions about this Privacy Policy or your information? Reach us at support@buyerpath.com. See also our Terms of Service.