STRInvest Privacy Policy
Last updated: April 26, 2026
This Privacy Policy applies solely to the STRInvest Chrome extension, published by Extensions Market. It fully discloses what data STRInvest collects, how that data is used, with whom it is shared, and how it is stored and retained. By installing or using STRInvest, you agree to this policy.
1. What data STRInvest collects
Account data
- Email address — collected when you create an STRInvest account. Used for authentication, email verification, and account management. Stored in Google Firebase Authentication.
- User ID (UID) — a unique identifier assigned by Firebase upon account creation. Used internally to link your usage data to your account.
- Password — never stored by Extensions Market. Authentication is handled entirely by Google Firebase Authentication.
Usage and subscription data
- Usage counter — the number of investment analyses you have run in the current billing period. Used solely to enforce free plan limits. Resets monthly. Stored in Google Firestore.
- Subscription plan — whether your account is on the free or paid plan, and your usage reset date. Stored in Google Firestore.
Listing data processed on request
- Property listing data — when you run an analysis, publicly visible listing details (address, price, property type, bedroom count, location) from the Zillow or Redfin page you are viewing are transmitted from your browser to our server over HTTPS to compute STR revenue projections, cap rate, cash-on-cash return, and regulatory risk. This data is not stored on our servers after the response is returned.
Local browser storage
- Firebase authentication tokens — stored in
chrome.storage.local on your device to maintain your session. Cleared when you sign out.
2. Data we do NOT collect
- We do not store property listing data on our servers after the analysis response is returned.
- We do not collect your browsing history on any website.
- We do not use tracking pixels, advertising networks, or third-party analytics SDKs inside the STRInvest extension.
- We do not sell, rent, or share your personal data for advertising purposes.
3. How your data is used
- To authenticate your account and maintain your session
- To enforce monthly usage limits based on your subscription plan
- To compute STR revenue projections, cap rate, cash-on-cash return, occupancy estimates, and regulatory signals for the listing you are viewing
- To process subscription payments and manage billing via Stripe
- To send transactional emails (email verification, password reset) via Firebase
4. Third parties your data is shared with
| Third Party | Data Shared | Purpose | Their Privacy Policy |
|---|
| Google Firebase |
Email address, UID, usage counter, subscription plan |
Authentication (Firebase Auth) and database (Firestore) |
firebase.google.com/support/privacy |
| Stripe |
Email address, Firebase UID |
Payment processing and subscription management. Card details go directly to Stripe and never touch our servers. |
stripe.com/privacy |
| Railway |
Property listing data (in transit only) |
Cloud infrastructure hosting our API servers. Data passes through in memory only and is not stored. |
railway.app/legal/privacy |
5. Data storage and retention
- Email address, UID, usage counter, subscription plan — stored in Google Firebase/Firestore for as long as your account is active. Deleted within 7 days of an account deletion request.
- Property listing data — processed in memory on our servers and discarded after the response is returned. Never written to disk or logs.
- Authentication tokens — stored locally on your device. Cleared on sign-out.
6. Extension permissions
- Access to Zillow and Redfin listing pages — to read publicly visible property details for STR investment analysis. STRInvest only activates on real estate listing pages.
- chrome.storage — to store your Firebase authentication tokens locally on your device.
7. Data security
All communication between STRInvest and our servers uses HTTPS/TLS encryption. Firebase Authentication tokens are short-lived and automatically refreshed. Listing data is never written to server logs.
8. Your rights
- Access — request a copy of the personal data we hold (email, UID, usage data).
- Correction — ask us to correct inaccurate account data.
- Deletion — request deletion of your account and all associated data within 7 days.
- Portability — request your account data in a machine-readable format.
To exercise any of these rights: [email protected]
9. Children's privacy
STRInvest is not directed to children under 13. We do not knowingly collect personal information from children under 13.
10. Changes to this policy
We may update this policy as STRInvest evolves. The "Last updated" date at the top reflects the most recent revision. Continued use constitutes acceptance of the updated policy.
11. Contact
[email protected]