Back to OakTend

Privacy Policy

Last updated October 1, 2026.

What changed on October 1, 2026: We added optional Google Analytics on our public pages. It runs only if you tap "Allow analytics," never while you are signed in or in the OakTend app, and never if your browser sends Global Privacy Control or Do Not Track. We added Google to our list of service providers and explained what it receives, how long it is kept, and how to turn it off (Sections 2, 3, 6, 7, 9, 14, and 15).

Plain-language summary: OakTend is a home maintenance and contractor marketplace app for homeowners in Orange County, California. We collect the account and home information you give us, plus a few things we need to run the app, such as an address-based location lookup, weather alerts, and appliance recall checks. We do not sell your personal information. We may license de-identified, aggregated statistics about groups of homes, for example typical system ages by ZIP code, to outside companies; those statistics never include your name, address, or contact details, and are described in Section 6. We do not share personal information for advertising. We run no ad trackers. We do use a cookieless analytics service from our hosting provider, Vercel, that counts page views and clicks without cookies or personal identifiers, so we can see which parts of the app get used and fix what does not. On our public pages, and only if you allow it, we also use Google Analytics, with its advertising features turned off; it never runs while you are signed in or in the OakTend app, and it stays off if your browser sends Global Privacy Control or Do Not Track. When you use Ask OakTend, we send relevant details about your home to Anthropic's Claude API so it can answer your question; under Anthropic's commercial terms, that data is not used to train its models, and your actual chat transcript stays in your own browser, not on our servers. You can download everything we hold about you, or delete your account, any time from Account > Privacy. This summary is not the whole policy. Read the sections below for the details, including exactly who we share information with and how long we keep it.

1. Who We Are and How to Reach Us

OakTend LLC, a California limited liability company operates OakTend, a web app and iOS app that helps homeowners in Orange County, California track home maintenance, understand their home systems, and connect with local contractors ("pros"). This policy explains what personal information OakTend collects, why, who it goes to, and what rights you have over it.

OakTend is for adults 18 and older (see Section 11).

This policy covers OakTend's website, web app, and iOS app, for both the homeowner side and the pro side, including for people who use both. It does not cover other companies' websites or apps, even ones we link to or mention, such as cslb.ca.gov or a pro's own business website.

Questions about this policy, or requests about your personal information, can be sent to:

2. Notice at Collection

California law (Civil Code section 1798.100) requires that, at or before the point we collect personal information, we tell you what categories we collect, where they come from, why, how long we keep them, and whether we sell or share them. This table is that notice. Full detail on each row is in Sections 3 and 4.

  • CCPA Category

    Identifiers (name, email, phone, account ID, IP address, device identifiers)

    What We Actually Collect
    • Name, email, phone (optional), account ID, IP address recorded when you accept our Terms and in ordinary server logs, and a device ID cookie and a browser fingerprint cookie (see "Free-trial and fraud checks" in Section 3);
    • on public pages only, and only if you allow it, the random Google Analytics cookie ID and your IP address, received by Google Analytics (see Analytics in Section 3)
    Source
    You, directly; your device, automatically
    Purpose
    • Creating and securing your account, contacting you, connecting you with pros, free-trial and fraud checks;
    • for Google Analytics, measuring which public pages are used
    Retention
    • While your account is active, plus up to 30 days after a deletion request;
    • server/security logs 12 months;
    • consent records, which include IP address and browser type, are kept as described in Section 9;
    • Google Analytics data 2 months, see Section 9
    Sold or Shared?
    No
  • CCPA Category

    Customer records (Cal. Civ. Code 1798.80(e))

    What We Actually Collect
    • Billing name and email held by Stripe;
    • Stripe customer and subscription IDs;
    • invoice totals
    Source
    You; Stripe
    Purpose
    Billing, subscriptions, refunds
    Retention
    7 years, for tax and accounting law
    Sold or Shared?
    No
  • CCPA Category

    Commercial information

    What We Actually Collect
    Jobs you post, quotes, hires and success fees, subscription plan, reviews you write
    Source
    You; your use of the marketplace
    Purpose
    Running the marketplace and your subscription
    Retention
    While account active, plus up to 30 days after deletion
    Sold or Shared?
    No
  • CCPA Category

    Internet or network activity

    What We Actually Collect
    • First-party product-usage events (for example, that a job was posted, which screens you visited and for how long, or which buttons you tapped);
    • cookieless page-view counts from our hosting provider's analytics service, with no cookie and no identifier that lasts beyond a day;
    • on public pages only, and only if you allow it, Google Analytics visit data tied to a random cookie ID, not to your account (see Analytics in Section 3);
    • push-notification subscription details
    Source
    Automatically, from your use of OakTend
    Purpose
    • Understanding which features and pages are used;
    • delivering push notifications you opted into
    Retention
    • Disconnected from your account (de-identified) within 30 days of a deletion request;
    • Google Analytics visit-level data 2 months in Google Analytics, see Section 9
    Sold or Shared?
    No
  • CCPA Category

    Geolocation

    What We Actually Collect
    The latitude and longitude of your home, derived from the address you type in, not from your device's GPS
    Source
    Derived from your address, through our property-data provider, RentCast
    Purpose
    Matching you with pros who serve your area; localizing weather and safety alerts
    Retention
    While account active, plus up to 30 days after deletion
    Sold or Shared?
    No
  • CCPA Category

    Professional or employment information (pros only)

    What We Actually Collect
    Business name, owner name, CSLB contractor license number, self-reported insurance carrier and expiration, background-check status
    Source
    You; the California CSLB public registry; Checkr, if background checks are enabled
    Purpose
    Showing the result of a public CSLB license lookup on a pro's profile and, where enabled, that a background check was completed
    Retention
    While account active, plus up to 30 days after deletion
    Sold or Shared?
    No
  • CCPA Category

    Sensitive personal information

    What We Actually Collect
    See Section 4: precise geolocation, license numbers, background-check results, message contents, your password, financial details you enter
    Source
    You, and the sources above
    Purpose
    Running the specific feature that needs it; never advertising or profiling
    Retention
    See Section 9
    Sold or Shared?
    No
  • CCPA Category

    Inferences

    What We Actually Collect
    A free-trial risk score (low, medium, or high), described in "Free-trial and fraud checks" in Section 3, and a daily count of AI questions asked
    Source
    Automatically, from your use of OakTend
    Purpose
    Free-trial and fraud checks; enforcing usage limits
    Retention
    While account is active
    Sold or Shared?
    No
  • CCPA Category

    Audio, electronic, visual, or similar information

    What We Actually Collect
    Photos and documents you choose to upload: system photos, warranties, inspection reports, quotes
    Source
    You
    Purpose
    Building your home record; letting Ask OakTend read a document or photo you attach
    Retention
    While account active, plus up to 30 days after deletion
    Sold or Shared?
    No

We have not sold or shared any category of personal information in the preceding twelve (12) months, and we do not intend to. We may license de-identified and aggregated data, which California law does not treat as personal information; see De-identified and aggregated data in Section 6.

3. Information We Collect

Information you give us

If you sign up as a homeowner, we collect your email; your phone number, if you add one; your name, if you add one; an SMS-consent checkbox and timestamp if you opt into texts; any referral or invite token you used; your property address, which is required, plus city, state, ZIP code, year built, and square footage, which are optional; your home systems and their ages; maintenance tasks and reminders; issues you log; photos and documents you upload; your push-notification subscription; in-app messages you send; reviews you write; blocks or reports you file; and, if you subscribe to OakTend Plus, a Stripe customer and subscription ID.

If you sign up as a pro, we collect everything above that applies to you, plus your business name, your own name as the account owner, your California contractor (CSLB) license number, a snapshot of your license status, your self-reported insurance carrier and expiration date, any license or insurance documents you upload, your background-check status if that feature is enabled for your account, the jobs you apply to and are hired for and any success fees charged, the notes you keep on your own clients in OakTend's CRM tool, and any responses you write to reviews.

Agreeing to our Terms. If you sign up with email, you tick a box that reads: "I am at least 18 years old and I have read and agree to the Terms and Privacy Policy." If you sign up with Google or Apple, the sign-up screen tells you that continuing confirms the same thing. We record that you agreed, along with the date, your IP address, and your browser's user agent string, as our proof.

One person can have both a homeowner account and a pro account (a "dual-side" account) if they use OakTend in both roles.

Information collected automatically

When you use OakTend, we automatically collect: your IP address and browser user agent, recorded at the moment you accept our Terms and, separately, in ordinary server request logs; a device identifier and a browser fingerprint, both described in "Free-trial and fraud checks" below, used only to notice when the same person appears to be creating multiple accounts to claim repeat free trials; your push-notification subscription (a web address and two keys your browser or phone generates, not your email or phone number); and first-party usage events we record ourselves, such as "a job was posted" or "the demo video was played," so we can see what parts of OakTend are and are not working. These events can also include how you arrived at OakTend: the web address that referred you (kept only as a site and page, without the link's query details) and any campaign tags on a link you clicked, so we can understand where new homeowners find us. It stays in our own database, tied to your account until you delete it, and is never sold or used for advertising.

Free-trial and fraud checks

To stop one person opening several accounts to repeat a free trial, we keep scrambled (salted, one-way hashed) versions of your device ID, browser fingerprint, network address, email address, phone number, home parcel, business name, and payment card fingerprint, and we compare them across accounts. The result is a low, medium, or high score kept with your account. It never blocks a purchase on its own. When this check is switched on, a medium or high score can mean a new membership starts billing right away instead of after a free trial. No memberships are sold during our preview, so this has no effect today. If it ever happens to you and you think it is a mistake, write to support@oaktend.com and a person will look at it. The hashes are deleted when your account is deleted. Someone who copied them without our separate secret key could not read the original values.

Analytics

We use Vercel Web Analytics, a cookieless, privacy-focused analytics service provided by our hosting provider. It records the page you viewed, the page that referred you, your country and region, your device type and browser family, and the outcome of certain in-app actions we define (for example "job posted" or "checkout started"). It does not set cookies, does not store your IP address or any identifier that persists beyond a single day, and cannot follow you across other websites. Vercel processes this data only on our behalf as a service provider and is not permitted to use it for its own purposes. We also keep a first-party record of product events in our own database, as described above, which is never shared with anyone. We do not use any advertising SDK, ad pixel, retargeting tag, session-recording tool, or heatmap tool.

Google Analytics (optional, public pages only). If you tap "Allow analytics" in our cookie notice, we use Google Analytics, a service of Google LLC, on our public pages, such as the home page, guides, city pages, pricing, and our legal pages. It never runs while you are signed in (any browser holding an OakTend sign-in session), inside the OakTend iPhone or Android app, or on account pages, sign-in or password-reset screens, or invite links. Until you allow it, nothing from Google Analytics loads and no Google Analytics cookie is set. If you allow analytics, Google, a third party, collects information about your visits to our public pages; with Google Signals off, we do not let Google connect it to your activity on other sites. When it runs, it receives the public page you viewed (with every part of the address that could identify you removed: all link parameters except standard campaign tags, and a pro's page is sent as "/p/[id]" with the title "Pro page"), the site you came from (reduced to its domain), how long you spend on the page, your device type, browser, screen size, and language, and your IP address, which Google uses to estimate an approximate location, such as your country or region. It uses two cookies, _ga and _ga_<id>, holding a random ID; we set them to last up to 13 months after your last visit. We do not send Google your name, email, phone number, home address, account ID, or anything you type into a form. We have turned off Google Signals and ad personalization, and we do not use Google Analytics for advertising, remarketing, or building ad audiences. We use it only to see which public pages people find useful. We keep visit-level Google Analytics data for 2 months; Google's summary reports, which do not identify anyone, can cover longer periods. You can turn it off at any time on our Cookie and Tracking Notice or Your Privacy Choices page, which also deletes its cookies from your browser. If your browser sends Global Privacy Control or Do Not Track, we do not load Google Analytics at all, even if you allowed it before. For how Google itself handles data from sites that use its services, see policies.google.com/technologies/partner-sites.

Information from third parties

We receive a limited amount of information about you from outside sources, each described further in Section 6: property, parcel, and automated valuation data from RentCast, when you add a home by address, including the owner name shown in public property records for that address, which we use only to compare with the name on your account and keep while the home is on your account; a snapshot of your California contractor license status from the CSLB's public license-lookup registry, if you are a pro; a pass or no-pass background-check result from Checkr, if that feature is enabled for your account; and your name and email address, if you choose to sign in with Google or Sign in with Apple instead of creating a password.

4. Sensitive Personal Information

California law treats some categories of personal information as "sensitive," giving you an extra right to ask that we limit our use of it (see Section 7). For OakTend, that includes:

OakTend does not collect your Social Security number, driver's license number, full financial account or card numbers (Stripe holds those on its own systems), health information, racial or ethnic origin, or biometric data.

We use sensitive personal information only for the specific feature that needs it: matching you with pros near you, verifying a pro's license and insurance, answering the question you asked, and running billing. We do not use it to infer anything else about you, to build an advertising profile, or for any purpose beyond what the feature obviously does. Because of that, there is effectively nothing further to restrict beyond our current practice, but California law still gives you the right to limit the use of your sensitive personal information to what is reasonably necessary to provide OakTend. You can exercise that right the same way as the other rights described in Section 7.

5. How We Use Your Information

We use the categories described above to:

Ask OakTend and Anthropic

Ask OakTend is built on Anthropic's Claude API. When you ask it a question, we send Anthropic your question along with context about your home that helps it answer specifically: your first name; your property's street address, city, and state; your home's basic facts (year built, size, beds, baths, lot size, and property type); the county assessed value and our own estimated market value, if we have them; your home systems with their ages and condition, and our rough replacement cost ranges for them; up to 30 of your open maintenance tasks; up to 6 of your recently logged issues; a short summary of up to 20 documents you have saved; and the trade, date, and status of your 10 most recent job posts. If you attach a photo or a document, that is sent too, so the model can read it. On the pro side, Ask OakTend for Pros sends comparable account context: your trades and service area, license and verification status, background-check status, and the jobs you have open or applied to.

Two things worth stating plainly, because they surprise people:

  1. Your street address is included, not just your city. We send it because location-specific answers (local weather, typical local pricing, permit rules) need it.
  2. Your transcript is not stored on our servers. Ask OakTend conversations live only in your own browser's local storage. OakTend's server records a daily usage count, so we can enforce plan limits, but it does not record what you asked or what the model answered.

Apart from the assessed value and estimated value listed above, we send other financial details to Anthropic only when you actively use specific tools: your purchase price, along with the assessed value and OakTend's own home-value estimate, when you generate a Property Tax Appeal Kit; your insurance premium and renewal date when you generate an Insurance Requote Packet; and the full contents of an uploaded contractor's quote, which can include that contractor's name, license number, and contact details, when you use the quote analyzer. Your purchase price, insurance details, and uploaded quotes are not sent unless you use that specific tool.

Anthropic is the only AI provider OakTend uses. Under Anthropic's commercial API terms, the data you send and the answers you get back are not used to train Anthropic's models. Anthropic may keep what we send for a limited time under its own terms, to check for misuse. Voice input, when you use it, uses your browser's built-in speech recognition. Depending on your browser, your audio may be sent to the browser maker (for example Google or Apple) to be turned into text. We and Anthropic receive only the text. See our AI Disclosure page for a fuller explanation of how AI works in OakTend.

6. How We Share Your Information

With a pro you choose

When you post a job, pros who serve your area can see the job itself: the type of work, your description, its severity, your timing, a budget range if you gave one, your photos, your city, and your first name and last initial. They do not see your full name, street address, email, or phone number. When you choose a pro for the job, or when a pro accepts a request you sent straight to them, we give that one pro your name, email address, phone number, and property address so they can do the work. Pros never see your broader home profile: your other systems, your financial details, your documents, or your Ask OakTend history. This is not a "sale" or a "share" of your information under California law. It happens because you chose that pro and asked to be connected, to get a job done, not so anyone can advertise to you or build a profile of you.

During our homeowner preview. The Pro side of OakTend is not open yet, so no pros are applying to jobs. The OakTend team can read the jobs you post, and may look by hand for a local pro who could do the work. We ask you before we pass your name, email, phone number, or address to anyone, and we pass them only to a pro you have agreed to. A pro we find by hand during the preview is an independent business that has not signed up to OakTend, so it has not agreed to our Homeowner Data Use Addendum. That is one reason we ask you first.

With people you invite to your home

If you invite someone to share your home in OakTend (a household member), they see what you see for that home: your systems, tasks, issues, photos, documents, job posts, your messages with pros, and the money pages (home value, purchase price, mortgage balance, property tax, and insurance). Only invite people you would show all of that to. You can remove a member at any time from Account > Household.

With a homeowner

If you are a pro, homeowners browsing OakTend can see your public profile: business name, service area, your license and insurance labels, reviews, and, if you chose to add it, your own name. A public profile only exists for pros who serve at least one (1) Orange County city, so nobody outside our current launch area is listed.

Service providers

We share information with the companies that help us run OakTend. The companies that process personal information for us (the first ten rows) work under data processing terms that limit them to providing their service to us. The rest are public or sign-in services that receive only what the table says, under their own terms:

  • Provider

    Supabase

    What They Do
    Database, authentication, file storage
    What They Receive
    Your account and home data; this is where OakTend's data actually lives
  • Provider

    Vercel

    What They Do
    Hosting, serverless functions, and cookieless web analytics
    What They Receive
    Request logs and IP address; cookieless page-view counts with no persistent identifier
  • Provider

    Google (Google Analytics)

    What They Do
    Website analytics on our public pages, only if you allow it and only while you are signed out
    What They Receive
    The public page viewed, the referring site's domain, time on page, device and browser details, your IP address (used by Google to estimate approximate location), and a random cookie ID; never your name, email, address, or account ID
  • Provider

    Cloudflare

    What They Do
    DNS, email routing, and CAPTCHA (Turnstile)
    What They Receive
    Domain routing information, and, for anyone who completes a CAPTCHA challenge, that fact
  • Provider

    Stripe

    What They Do
    Payments and subscriptions
    What They Receive
    Your email and billing details; your card number goes directly to Stripe and never touches our servers
  • Provider

    Twilio

    What They Do
    Text-message delivery
    What They Receive
    Your phone number and message content, only if you opted into texts
  • Provider

    Resend

    What They Do
    Email delivery
    What They Receive
    Your email address and the content of the email
  • Provider

    Anthropic

    What They Do
    AI assistant, document and photo analysis
    What They Receive
    See Section 5 above for the full detail
  • Provider

    RentCast

    What They Do
    Property records and home valuation
    What They Receive
    Your street address, including any unit number, and ZIP code
  • Provider

    Checkr

    What They Do
    Background checks for pros, when enabled
    What They Receive
    A pro's name and email address
  • Provider

    Photon (Komoot, built on OpenStreetMap)

    What They Do
    Address suggestions while you type
    What They Receive
    The partial address you're typing
  • Provider

    California CSLB

    What They Do
    Public contractor license lookup
    What They Receive
    A pro's license number
  • Provider

    Google

    What They Do
    Sign in with Google
    What They Receive
    Your name and email address, only if you use this sign-in method
  • Provider

    Apple

    What They Do
    Sign in with Apple; App Store distribution; iOS push notifications
    What They Receive
    Your name and email, only if you use Apple sign-in; a push token, only if you enable notifications on the iOS app
  • Provider

    Web push services (run by Apple, Google, and Mozilla)

    What They Do
    Delivering browser and app push notifications
    What They Receive
    Your push subscription address and keys, not your email or phone number

Our Subprocessor and Vendor List page has the current, complete list, with a link to each provider's own privacy policy.

We may disclose information if we reasonably believe it's necessary to comply with a subpoena, court order, or other legal process, to enforce our Terms, to detect or prevent fraud or a security incident, or to protect the rights, property, or safety of OakTend, our users, or the public.

Business transfer

If OakTend is acquired by, merges with, or sells substantially all of its assets to another company, your information may be transferred as part of that transaction. If that happens in a way that meaningfully changes how your information is handled, we will notify you before the change takes effect.

We may share information for other purposes if you give us your clear, specific consent to do so.

What we do not do

We do not sell your personal information; we may license de-identified and aggregated data as described in De-identified and aggregated data below. We do not share personal information for cross-context behavioral advertising. We do not use data brokers or any ad network or advertising service, and we do not let anyone use your data for ads. Our hosting provider's cookieless analytics service acts as our service provider and may not use your data for its own purposes. Google Analytics, which runs only on our public pages and only if you allow it, is configured with Google Signals, ad personalization, and Google's data sharing settings turned off, and we use it only to measure our own pages, never for advertising. In the preceding twelve (12) months, we have not sold or shared any personal information, and we have no plans to start.

Why giving a pro your job details is not a "sale." Once the Pro side is open, pros apply to jobs at no charge (a success fee is charged to the pro only if you hire them), and your contact details go only to the pro you choose. California's privacy law treats a disclosure you direct yourself, to a recipient you chose, as outside the definition of a sale (Civil Code section 1798.140(ad)(2)(A)). That is how it works: you post a job, pros apply, you choose one, and choosing that pro is what releases your contact details to them. Every pro who joins OakTend agrees to our Homeowner Data Use Addendum, which limits them to using your details for that job, forbids resale or marketing use, and requires deletion on request. The one exception is a pro our team finds by hand during the preview, described above. That pro has not joined OakTend or agreed to the Addendum, which is why we pass your details only after you tell us to. We do not give your personal information to anyone else for their own use.

De-identified and aggregated data

OakTend may create de-identified, aggregated statistics from information in the app, for example the share of homes in a ZIP code with a roof over twenty (20) years old, or the typical age of water heaters by neighborhood, and license those statistics to outside companies. We produce these statistics by removing your name, address, contact details, document contents, photos, and chat contents, and by grouping the results so that no individual home is identifiable. We never publish or license a statistic that describes fewer than twenty-five (25) homes, and we round and bucket values so that no single home can be picked out.

We publicly commit, as required by California Civil Code section 1798.140(m), that we will not attempt to re-identify de-identified data, and we maintain technical and business safeguards designed to keep it de-identified. We have not licensed this data to anyone yet. Before anyone receives it, we will require them to sign a contract that bars them from attempting to re-identify it, from combining it with other data to re-identify it, and from reselling it or passing it to anyone else except under the same restrictions.

We license this kind of data for uses such as maintenance benchmarks, service-life statistics for home systems, market research, and product development by companies that make or service home products.

This is not a sale of personal information under California law. De-identified, aggregated data is not personal information, and licensing it does not change the promise below.

Do we sell your personal information? We do not sell your personal information; we may license de-identified and aggregated data as described in that section.

7. Your California Privacy Rights

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, "CCPA"), gives you these rights over your personal information:

How to exercise these rights

The fastest way is inside the app: go to Account > Privacy to download your data, as a JSON file or a PDF, or to permanently delete your account, without waiting on us. The download is ready right away. Deletion starts immediately and finishes within 30 days. For anything else, including a correction request or a general question, email privacy@oaktend.com, call (714) 468-5480, or write to 2108 N Street, Suite N, Sacramento, CA 95816.

Verification. Because you must already be signed in to use Account > Privacy, being logged into your own account is how we verify a request made that way. For a request made by email, we verify your identity by confirming that the email you're writing from matches the one on your account, and we may ask you to confirm additional information only the account holder would know before we act on the request.

Authorized agents. You may name someone else to submit a request on your behalf. We will ask that agent for proof of your written authorization, and we may still separately verify your own identity before completing the request.

Response time. We aim to respond within 45 days of receiving a request we can verify. If we need more time, we will tell you why, and we may take up to another 45 days.

Appeals. If we deny a request, you can appeal by replying to our denial or writing to privacy@oaktend.com. We will respond to an appeal within 45 days. If we deny the appeal, we will explain how to file a complaint with the California Privacy Protection Agency.

Global Privacy Control. Where your browser sends the Global Privacy Control (GPC) signal, OakTend treats it as a valid request to opt out of the sale and sharing of your personal information. Because we do not sell or share personal information in the first place, honoring GPC does not change how your account data is handled. It does turn off Google Analytics: if your browser sends GPC, we do not load Google Analytics, even if you allowed it before.

Do Not Track. OakTend runs no cross-site tracking. We treat a browser's "Do Not Track" signal the same way as Global Privacy Control for Google Analytics: with it on, we do not load Google Analytics.

Shine the Light (Cal. Civ. Code 1798.83). Once a year, free of charge, California residents may ask what personal information we disclosed to third parties for those third parties' own direct marketing purposes during the prior calendar year. We do not disclose personal information for that purpose, so there's nothing to report, but you can still send this request to privacy@oaktend.com and we will confirm that in writing.

Notice of financial incentive. OakTend Plus and OakTend Pro are planned paid subscriptions with paid features, such as a monthly home digest and higher AI usage limits. Neither can be bought during our preview. When they open, they will be products you pay for with money, not a financial incentive tied to your personal information under the CCPA. We do not offer any discount, benefit, or different price in exchange for the collection, sale, or retention of your personal information.

8. If You Live Outside California

OakTend currently serves homeowners in Orange County, California, but people travel, move, and read this policy from other places. If you live in Colorado, Connecticut, Virginia, or another state with a comprehensive consumer privacy law, you generally have rights similar to the ones in Section 7: to know, access, correct, delete, and receive a portable copy of your personal information, and to opt out of the sale of personal information, targeted advertising, and certain kinds of automated profiling. OakTend does not sell personal information or use it for targeted advertising for anyone, no matter what state you live in. You can exercise any of these rights the same way described in Section 7: through Account > Privacy, or by emailing privacy@oaktend.com.

9. How Long We Keep Your Information

  • What

    Account and profile data

    How Long
    While your account is active, then deleted or de-identified within 30 days of a deletion request
  • What

    Home records, photos, and documents

    How Long
    Same as above
  • What

    Messages you sent and reviews you wrote

    How Long
    Same as above; content already visible to another user, such as a pro you messaged, may remain in their own view, de-identified where possible, because it's also their record of that job
  • What

    Invoices, subscription, and payment records

    How Long
    7 years, for tax and accounting purposes
  • What

    Security and server logs

    How Long
    12 months
  • What

    SMS-consent records and Terms-acceptance records

    How Long
    3 years after your account closes, as proof of consent
  • What

    Our record that you made a privacy request

    How Long
    Kept as our own compliance record even after the rest of your account is deleted
  • What

    First-party product-usage events

    How Long
    Disconnected from your account, and de-identified, within 30 days of a deletion request; once disconnected, the bare event carries no name, contact detail, or free text
  • What

    Google Analytics visit data (public pages, only if you allowed it)

    How Long
    2 months at the visit level in Google Analytics; the _ga cookies in your browser last up to 13 months after your last visit, or until you turn analytics off or clear them
  • What

    Fraud-prevention hashes (Section 3)

    How Long
    Deleted when your account is deleted
  • What

    Backups

    How Long
    Rotated out automatically within about 30 days
  • What

    A pro's own copy of your contact information, if you chose one

    How Long
    Not controlled by OakTend; see Section 12

10. Security and Breach Notification

We use administrative, technical, and physical safeguards designed to protect your information, including: row-level security on our database tables, designed so that an account can only read its own data and the data shared with it; server-only service credentials, never exposed to your browser; verified webhook signatures on our Stripe and Twilio integrations, so those channels can't be spoofed; an upload guard that checks the actual bytes of anything you upload, not just its label, enforces a 15MB size cap, and automatically strips hidden metadata, including GPS location, from photos before they're stored; one-way, salted hashing for the fraud-prevention identifiers described in Section 3, so that someone who copied them without our separate secret key could not read the original values; HTTPS everywhere; and encryption of stored data, provided as a default by our infrastructure providers. A password-reset link expires in 15 minutes and works only once. If a device goes 30 days without signing in, it is automatically signed out and has to sign back in.

No system is perfectly secure, and we cannot promise your information will never be exposed. If a breach occurs that compromises your personal information, we will notify you without unreasonable delay, consistent with California Civil Code section 1798.82 and other applicable law.

11. Children's Privacy

OakTend is for adults 18 and older. When you create an account we ask you to confirm you are at least 18; we do not ask for or collect a birthdate, and we do not knowingly collect personal information from anyone under 18. Because OakTend does not sell or share personal information for anyone, the additional CCPA protections that apply specifically to the personal information of consumers under 16 do not change anything in how we actually operate. If you believe a minor has given us personal information, contact privacy@oaktend.com and we will remove it.

12. Account Deletion

You can permanently delete your account and its data any time, from Account > Privacy. Doing this:

We retain a narrow set of records even after deletion, either because the law requires it or because deleting them would delete someone else's own information:

13. Your Communication Choices

Push notifications. Turning push on, in your browser or the iOS app, stores a subscription record so we can ask your device's own push service to show you a notification. Only certain kinds of notifications are ever pushed, such as a message from a pro or homeowner, a new lead, or a weather or safety alert; routine reminders and digests only appear inside the app. You can turn push off any time in Account > Notifications, or in your device's own settings, either of which removes the subscription record.

Text messages. Texting is opt-in and off by default. You turn it on with a checkbox in your account settings; pros use the same checkbox to opt into lead-alert texts. Every text we send includes instructions to reply STOP to opt out right away, or HELP for help; we also support START if you want to opt back in later. We only text 10-digit U.S. phone numbers, we only send account and job-related messages, never third-party marketing, and we never send texts between 9 p.m. and 8 a.m. Pacific time, no matter when the underlying event happened.

Email. We send transactional emails about your account and jobs (Stripe sends its own separate receipts), a monthly home digest (during our preview, for every homeowner), and occasional product updates. Every marketing or digest email includes an unsubscribe link and our mailing address; we honor unsubscribe requests within 10 business days. Transactional emails about your account or an active job keep going even if you unsubscribe from other emails, because those aren't optional marketing, they're how we tell you something happened on your account.

You can review and change all of these choices under Account > Notifications.

14. Cookies and Similar Technologies

OakTend uses a short list of first-party cookies needed to keep you signed in and support features like password reset, plus a handful of values in your browser's own local storage, such as your theme preference and your Ask OakTend chat history, which never leaves your browser. We also set a first-party cookie called oaktend_campaign for up to thirty (30) days when you arrive through a referral or partner link; it stores only a partner code, not anything else about you, so that if you sign up we can credit the right referral. Our hosting provider's analytics service does not set cookies at all, and we do not use advertising cookies. On our public pages, if you tap "Allow analytics," Google Analytics sets two cookies, _ga and _ga_<id>; until you choose, while you are signed in, inside the OakTend app, and if your browser sends Global Privacy Control or Do Not Track, it sets none. You can change your choice at any time on the Cookie and Tracking Notice or Your Privacy Choices page. See our full Cookie and Tracking Notice for the exact list of what we set, what each one does, and how to control it.

15. International Users and Where Your Data Is Stored

OakTend currently operates only in the United States, for homeowners in Orange County, California. Our servers and databases are located in the United States, and your information is stored and processed there. If you access OakTend from outside the United States, your information will still be transferred to, and processed in, the United States. One exception: if you allow Google Analytics on our public pages, Google may process that analytics data in the United States and other countries where it operates.

16. Changes to This Policy

We may update this policy as OakTend changes. We will always update the "Last updated" date at the top of this page. For a change that meaningfully affects what we collect, why, or who we share it with, we will also give you notice, such as an email to the address on your account or a notice inside the app, before it takes effect. Continuing to use OakTend after that means you accept the change.

Contact Us

OakTend LLC, a California limited liability company

2108 N Street, Suite N, Sacramento, CA 95816

Privacy: privacy@oaktend.com

Phone: (714) 468-5480

If you have an account, you can also reach us from the in-app Help page.

Back