Legal, privacy
Privacy Policy
The short version. Five things touch your data. The account you create to drop a workbook: an email, a name, a firm and a role, a password kept only as a hash, and one cookie that keeps you signed in. Analytics on this site, our own and Google Analytics 4, and only after you accept the consent prompt. Stripe, which takes the payment. The workbook you drop on the page, or email us, which travels over an encrypted connection, is stored on our host under the retention periods below, and is read once by one person to build your page. And the map inside the page you receive, which loads its tiles from a third party when it opens. Nothing is sold, and nothing is used to train any model. Ask and your files are deleted sooner: hello@withfresco.com, answered within five business days.
What this site collects
By default, nothing. The site sends no data until you answer the consent prompt, and it sets exactly two cookies, both named and described under Your account below: __Host-fresco_session, set when you create an account or sign in, and __Host-fresco_oauth, set only while a Continue with Google sign-in is in progress; no analytics cookie is set until you accept. If you accept, two things start. Our own analytics records which parts of this page you use: which sections you scroll to, what you click, where the pointer sits on a coarse 32 by 18 grid, and how long you stay. It goes to our own server and nowhere else, tied to a random session id that lives only until you close the tab. It never records what you type, what you drop, a file name, a sheet name or anything from inside a workbook. Your IP address is stored only as a salted one-way hash, as it is for a drop. Google Analytics 4 loads at the same time, if this site carries a measurement id, and records which pages you viewed and a rough location, under Google's privacy policy. If you decline, or never answer, both stay off and the site works the same. No advertising tag is loaded either way.
Two settings are kept on your device, in this site's localStorage rather than in cookies: your answer to the consent prompt, under the key fresco-consent, and your light or dark choice, under fresco-theme, and, while a tab is open and only after you accept, a random session id under fresco-sid in sessionStorage, which the browser discards when the tab closes. None of them leaves your browser.
Your account
Dropping a workbook needs an account, so your page and your credits have a home. The register asks for four things and keeps them: your email address, which is where the link and every reply go; your name, so the reply is addressed to a person; your firm, so we know whose deal the page is for; and your role, so we know how to write to you. Nothing else is asked, and none of it is sold, shared or added to a marketing list.
There are two ways to make that account: an email address and a password, or Continue with Google. Choosing Google means we never receive a password at all and none is stored; we receive your Google address, your name and Google's confirmation that the address is verified, and we ask you for your firm and your role afterwards. Your password, if you set one, is stored only as a scrypt hash, which cannot be turned back into the password, and is never sent or shown anywhere. The address you sign in from is kept as a salted one-way hash, as it is for a drop, for one purpose: telling a repeat sign-in from a stranger guessing at passwords.
Creating an account sets one cookie, __Host-fresco_session, which keeps you signed in for 30 days. It is strictly necessary for the account to work, so it is set when the account is created, or when you sign in, and not by the consent prompt; declining analytics leaves it in place, and signing out or clearing it ends the session. It holds a signed random session id and nothing about you. Email addresses are not verified yet, and no mail is sent when an account is made.
Choosing Continue with Google sets one more cookie, __Host-fresco_oauth, for up to ten minutes, so we can tell your sign-in apart from anyone else's while Google answers. It holds no account and nothing about you: only a random one-time value for this one sign-in. It is deleted the moment Google comes back, whether the sign-in worked or not. It is strictly necessary for the sign-in to be safe, so it is not gated by the consent prompt either. On a connection that is not encrypted, which is only ever a developer's own machine, both cookies drop the __Host- prefix and are named fresco_session and fresco_oauth; on this site they always carry it.
Ask and the account goes, with everything held under it: email hello@withfresco.com from the address on the account, answered within five business days.
What happens when you buy
Checkout is handled by Stripe, on their own pages. They collect your email address, your payment details and your billing country, because a payment cannot happen without them. Fresco never sees or stores your card number.
From Stripe, Fresco receives your email address, your name if you gave one, the amount, the date and a receipt number. That is the whole purchase record.
Your workbook and anything sent with it
There are two ways in and no others: you drop the workbook on this page, or you email it to hello@withfresco.com. Either way you can send a rent roll, comps and photos with it. A dropped file travels over an encrypted connection (HTTPS) and is stored on one private volume on our host, reachable by this application and by its operator and by nobody else, under a reference id that appears in your receipt. The moment it lands the server reads its sheet names, counts external links and #REF! cells and lifts the property name, address, size and as-of date from a summary sheet to prefill the form; nothing else is opened and no formula is evaluated. The deal basics you type on the form, your email address, the sheet you name if we could not find the rent roll, and any notes are stored beside the file.
Two more things are recorded with each drop, for one purpose: telling a repeat sender from a first one when an upload looks like abuse. The first is your browser's user-agent string, as it arrives. The second is your IP address as a one-way hash, salted with a secret we hold, so what is stored cannot be turned back into an address. Neither is used for advertising, profiling or anything else.
What we do not yet claim: encryption of the stored file at rest. The connection is encrypted and the volume is private, and that is the whole of it today. Moving the stored files to a provider that encrypts them at rest is planned and named below; the day it lands this sentence changes, and not before.
The files are read once, by one person, to build the page. They are not used to train any model, not shared with anyone, and not opened for any other purpose. The uploaded source workbook and supporting files are kept for up to 30 days after delivery so that a figure which does not match can be corrected, then deleted automatically. Source files for unpaid or unfinished work are deleted 30 days after upload. An unfinished production job that reaches that limit expires and its reserved credit is returned. The delivered presentation and review record are retained separately, as described below. Ask sooner and they go sooner: email hello@withfresco.com with the reference id, and every support and deletion request is answered within five business days.
New client presentations delivered inside Fresco require sign-in to the owner account. Public samples remain public. Older presentations supplied through unlisted links may still be available to anyone with the link; an unlisted link is not account access control. Contact us to check or remove an older link. A delivered presentation can contain your deal figures, rent roll and photographs. Removing a link or account access cannot revoke a copy that someone has already downloaded.
The map inside the page
When the page opens, its map requests the Leaflet library from unpkg.com and its map tiles from Esri (server.arcgisonline.com); a page built on OpenStreetMap tiles requests tile.openstreetmap.org instead. Those servers see the map area requested and the IP address of whoever opened the page, never your figures. The Empire State Building sample on this site behaves the same way, and it is the only page here that reaches any host other than this one and, after consent, Google.
What it is used for
Building and delivering the page you bought, answering your emails, and issuing refunds. Your email address, given once on the form, is passed to Stripe so you do not type it twice, and is used to send the link and, once, to check that it opened. It is not sold, rented or shared, and it is not added to a marketing list unless you ask.
How long it is kept
Purchase records are kept as long as tax rules require, then deleted. Support emails are deleted once the matter is closed. Uploaded source workbooks and supporting files are deleted 30 days after delivery, or 30 days after upload for unpaid or unfinished work. Earlier deletion is available on request. This source-file deletion does not remove the delivered presentation or its review record, including retained deal details, source references, findings and review decisions. Those remain available to the owner account until removal is requested. Email hello@withfresco.com to request removal of the presentation and review record as well.
Railway takes daily recovery backups, retained for six days. Deleted source files may remain in those backups until they expire. A manual recovery snapshot was also created before the September 2026 release; its removal is tracked separately. Backups are used for recovery, not routine access.
Who else touches it
Five companies, and what each one is for:
- Railway, hosting. This site and the volume your workbook sits on run in Railway’s Amsterdam region in the Netherlands.
- Stripe, payment. Your card details go to them and never to us.
- Google, analytics and sign-in. Analytics runs only after you accept the consent prompt, and never on your workbook or your page. Sign-in happens only if you press Continue with Google, and then Google tells us your Google address, your name and that it has verified that address, while Google learns that you signed in to Fresco; if you never press it, Google is told nothing about your account.
- Backblaze, storage, planned and not yet in use. The move that puts your stored file behind encryption at rest. Nothing of yours is with them today; this page will say so plainly when that changes.
- OpenAI, answers. A Portfolio Map carries an Ask drawer. When you type a question there, that question, the last six turns of the same conversation and the page's own figures go to OpenAI's API to write the answer. Your workbook never goes; the drawer only sees the figures already printed on the page. OpenAI's API terms state that API inputs and outputs are not used to train its models. Our calls are sent with storage off, and OpenAI states it retains API inputs for up to 30 days for abuse monitoring unless a zero data retention arrangement is granted; one is not in place today, and this sentence changes the day that changes and not before. On a customer deal the drawer stays off until its owner switches it on; the Fresco server does not answer for a deal that has not.
The site's own analytics stay on the Railway host with everything else.
Nobody else. No advertising network, no data broker, and no model provider beyond the one named above, which sees the page's figures and your questions and never your workbook.
Your choices
Email hello@withfresco.com to see what is held about you, to correct it, to have it deleted, or to take a delivered link down. Every one of those is answered within five business days. Deletion requests are honored except where a record must be kept for tax purposes. California residents have these rights under the CCPA; the same answer applies to everyone, wherever they live.
Stripe
Stripe processes your payment under its own privacy policy, which governs everything that happens on its checkout pages.
Site analytics we run ourselves
Kept as individual events for 180 days, then only as daily totals per page and event, with nothing that can tell one visit from another. Never sold, shared, or joined to a purchase record. Withdraw at any time by clearing this site's data for withfresco.com in your browser, localStorage included, since the choice is stored under fresco-consent; the prompt asks again on your next visit, and nothing is sent in the meantime.
Google Analytics 4
Loaded only after consent, through Google's gtag script. It sets cookies to tell one visit from another. Google's privacy policy governs what Google does with what it collects. Withdraw consent at any time by clearing this site's data for withfresco.com in your browser, its localStorage as well as its cookies, since the choice is stored under fresco-consent in localStorage and clearing cookies alone leaves it in place. The prompt will ask again on your next visit.
Governing law
California, USA.