Privacy Policy
Last updated October 1, 2026.
What changed on October 1, 2026: We added optional Google Analytics on our public pages. It runs only if you tap "Allow analytics," never while you are signed in or in the OakTend app, and never if your browser sends Global Privacy Control or Do Not Track. We added Google to our list of service providers and explained what it receives, how long it is kept, and how to turn it off (Sections 2, 3, 6, 7, 9, 14, and 15).
1. Who We Are and How to Reach Us
OakTend LLC, a California limited liability company operates OakTend, a web app and iOS app that helps homeowners in Orange County, California track home maintenance, understand their home systems, and connect with local contractors ("pros"). This policy explains what personal information OakTend collects, why, who it goes to, and what rights you have over it.
OakTend is for adults 18 and older (see Section 11).
This policy covers OakTend's website, web app, and iOS app, for both the homeowner side and the pro side, including for people who use both. It does not cover other companies' websites or apps, even ones we link to or mention, such as cslb.ca.gov or a pro's own business website.
Questions about this policy, or requests about your personal information, can be sent to:
- Email: privacy@oaktend.com
- Mail: 2108 N Street, Suite N, Sacramento, CA 95816
- Phone: (714) 468-5480
2. Notice at Collection
California law (Civil Code section 1798.100) requires that, at or before the point we collect personal information, we tell you what categories we collect, where they come from, why, how long we keep them, and whether we sell or share them. This table is that notice. Full detail on each row is in Sections 3 and 4.
CCPA Category
Identifiers (name, email, phone, account ID, IP address, device identifiers)
- What We Actually Collect
- Name, email, phone (optional), account ID, IP address recorded when you accept our Terms and in ordinary server logs, and a device ID cookie and a browser fingerprint cookie (see "Free-trial and fraud checks" in Section 3);
- on public pages only, and only if you allow it, the random Google Analytics cookie ID and your IP address, received by Google Analytics (see Analytics in Section 3)
- Source
- You, directly; your device, automatically
- Purpose
- Creating and securing your account, contacting you, connecting you with pros, free-trial and fraud checks;
- for Google Analytics, measuring which public pages are used
- Retention
- While your account is active, plus up to 30 days after a deletion request;
- server/security logs 12 months;
- consent records, which include IP address and browser type, are kept as described in Section 9;
- Google Analytics data 2 months, see Section 9
- Sold or Shared?
- No
CCPA Category
Customer records (Cal. Civ. Code 1798.80(e))
- What We Actually Collect
- Billing name and email held by Stripe;
- Stripe customer and subscription IDs;
- invoice totals
- Source
- You; Stripe
- Purpose
- Billing, subscriptions, refunds
- Retention
- 7 years, for tax and accounting law
- Sold or Shared?
- No
CCPA Category
Commercial information
- What We Actually Collect
- Jobs you post, quotes, hires and success fees, subscription plan, reviews you write
- Source
- You; your use of the marketplace
- Purpose
- Running the marketplace and your subscription
- Retention
- While account active, plus up to 30 days after deletion
- Sold or Shared?
- No
CCPA Category
Internet or network activity
- What We Actually Collect
- First-party product-usage events (for example, that a job was posted, which screens you visited and for how long, or which buttons you tapped);
- cookieless page-view counts from our hosting provider's analytics service, with no cookie and no identifier that lasts beyond a day;
- on public pages only, and only if you allow it, Google Analytics visit data tied to a random cookie ID, not to your account (see Analytics in Section 3);
- push-notification subscription details
- Source
- Automatically, from your use of OakTend
- Purpose
- Understanding which features and pages are used;
- delivering push notifications you opted into
- Retention
- Disconnected from your account (de-identified) within 30 days of a deletion request;
- Google Analytics visit-level data 2 months in Google Analytics, see Section 9
- Sold or Shared?
- No
CCPA Category
Geolocation
- What We Actually Collect
- The latitude and longitude of your home, derived from the address you type in, not from your device's GPS
- Source
- Derived from your address, through our property-data provider, RentCast
- Purpose
- Matching you with pros who serve your area; localizing weather and safety alerts
- Retention
- While account active, plus up to 30 days after deletion
- Sold or Shared?
- No
CCPA Category
Professional or employment information (pros only)
- What We Actually Collect
- Business name, owner name, CSLB contractor license number, self-reported insurance carrier and expiration, background-check status
- Source
- You; the California CSLB public registry; Checkr, if background checks are enabled
- Purpose
- Showing the result of a public CSLB license lookup on a pro's profile and, where enabled, that a background check was completed
- Retention
- While account active, plus up to 30 days after deletion
- Sold or Shared?
- No
CCPA Category
Sensitive personal information
- What We Actually Collect
- See Section 4: precise geolocation, license numbers, background-check results, message contents, your password, financial details you enter
- Source
- You, and the sources above
- Purpose
- Running the specific feature that needs it; never advertising or profiling
- Retention
- See Section 9
- Sold or Shared?
- No
CCPA Category
Inferences
- What We Actually Collect
- A free-trial risk score (low, medium, or high), described in "Free-trial and fraud checks" in Section 3, and a daily count of AI questions asked
- Source
- Automatically, from your use of OakTend
- Purpose
- Free-trial and fraud checks; enforcing usage limits
- Retention
- While account is active
- Sold or Shared?
- No
CCPA Category
Audio, electronic, visual, or similar information
- What We Actually Collect
- Photos and documents you choose to upload: system photos, warranties, inspection reports, quotes
- Source
- You
- Purpose
- Building your home record; letting Ask OakTend read a document or photo you attach
- Retention
- While account active, plus up to 30 days after deletion
- Sold or Shared?
- No
We have not sold or shared any category of personal information in the preceding twelve (12) months, and we do not intend to. We may license de-identified and aggregated data, which California law does not treat as personal information; see De-identified and aggregated data in Section 6.
3. Information We Collect
Information you give us
If you sign up as a homeowner, we collect your email; your phone number, if you add one; your name, if you add one; an SMS-consent checkbox and timestamp if you opt into texts; any referral or invite token you used; your property address, which is required, plus city, state, ZIP code, year built, and square footage, which are optional; your home systems and their ages; maintenance tasks and reminders; issues you log; photos and documents you upload; your push-notification subscription; in-app messages you send; reviews you write; blocks or reports you file; and, if you subscribe to OakTend Plus, a Stripe customer and subscription ID.
If you sign up as a pro, we collect everything above that applies to you, plus your business name, your own name as the account owner, your California contractor (CSLB) license number, a snapshot of your license status, your self-reported insurance carrier and expiration date, any license or insurance documents you upload, your background-check status if that feature is enabled for your account, the jobs you apply to and are hired for and any success fees charged, the notes you keep on your own clients in OakTend's CRM tool, and any responses you write to reviews.
Agreeing to our Terms. If you sign up with email, you tick a box that reads: "I am at least 18 years old and I have read and agree to the Terms and Privacy Policy." If you sign up with Google or Apple, the sign-up screen tells you that continuing confirms the same thing. We record that you agreed, along with the date, your IP address, and your browser's user agent string, as our proof.
One person can have both a homeowner account and a pro account (a "dual-side" account) if they use OakTend in both roles.
Information collected automatically
When you use OakTend, we automatically collect: your IP address and browser user agent, recorded at the moment you accept our Terms and, separately, in ordinary server request logs; a device identifier and a browser fingerprint, both described in "Free-trial and fraud checks" below, used only to notice when the same person appears to be creating multiple accounts to claim repeat free trials; your push-notification subscription (a web address and two keys your browser or phone generates, not your email or phone number); and first-party usage events we record ourselves, such as "a job was posted" or "the demo video was played," so we can see what parts of OakTend are and are not working. These events can also include how you arrived at OakTend: the web address that referred you (kept only as a site and page, without the link's query details) and any campaign tags on a link you clicked, so we can understand where new homeowners find us. It stays in our own database, tied to your account until you delete it, and is never sold or used for advertising.
Free-trial and fraud checks
To stop one person opening several accounts to repeat a free trial, we keep scrambled (salted, one-way hashed) versions of your device ID, browser fingerprint, network address, email address, phone number, home parcel, business name, and payment card fingerprint, and we compare them across accounts. The result is a low, medium, or high score kept with your account. It never blocks a purchase on its own. When this check is switched on, a medium or high score can mean a new membership starts billing right away instead of after a free trial. No memberships are sold during our preview, so this has no effect today. If it ever happens to you and you think it is a mistake, write to support@oaktend.com and a person will look at it. The hashes are deleted when your account is deleted. Someone who copied them without our separate secret key could not read the original values.
Analytics
We use Vercel Web Analytics, a cookieless, privacy-focused analytics service provided by our hosting provider. It records the page you viewed, the page that referred you, your country and region, your device type and browser family, and the outcome of certain in-app actions we define (for example "job posted" or "checkout started"). It does not set cookies, does not store your IP address or any identifier that persists beyond a single day, and cannot follow you across other websites. Vercel processes this data only on our behalf as a service provider and is not permitted to use it for its own purposes. We also keep a first-party record of product events in our own database, as described above, which is never shared with anyone. We do not use any advertising SDK, ad pixel, retargeting tag, session-recording tool, or heatmap tool.
Google Analytics (optional, public pages only). If you tap "Allow analytics" in our cookie notice, we use Google Analytics, a service of Google LLC, on our public pages, such as the home page, guides, city pages, pricing, and our legal pages. It never runs while you are signed in (any browser holding an OakTend sign-in session), inside the OakTend iPhone or Android app, or on account pages, sign-in or password-reset screens, or invite links. Until you allow it, nothing from Google Analytics loads and no Google Analytics cookie is set. If you allow analytics, Google, a third party, collects information about your visits to our public pages; with Google Signals off, we do not let Google connect it to your activity on other sites. When it runs, it receives the public page you viewed (with every part of the address that could identify you removed: all link parameters except standard campaign tags, and a pro's page is sent as "/p/[id]" with the title "Pro page"), the site you came from (reduced to its domain), how long you spend on the page, your device type, browser, screen size, and language, and your IP address, which Google uses to estimate an approximate location, such as your country or region. It uses two cookies, _ga and _ga_<id>, holding a random ID; we set them to last up to 13 months after your last visit. We do not send Google your name, email, phone number, home address, account ID, or anything you type into a form. We have turned off Google Signals and ad personalization, and we do not use Google Analytics for advertising, remarketing, or building ad audiences. We use it only to see which public pages people find useful. We keep visit-level Google Analytics data for 2 months; Google's summary reports, which do not identify anyone, can cover longer periods. You can turn it off at any time on our Cookie and Tracking Notice or Your Privacy Choices page, which also deletes its cookies from your browser. If your browser sends Global Privacy Control or Do Not Track, we do not load Google Analytics at all, even if you allowed it before. For how Google itself handles data from sites that use its services, see policies.google.com/technologies/partner-sites.
Information from third parties
We receive a limited amount of information about you from outside sources, each described further in Section 6: property, parcel, and automated valuation data from RentCast, when you add a home by address, including the owner name shown in public property records for that address, which we use only to compare with the name on your account and keep while the home is on your account; a snapshot of your California contractor license status from the CSLB's public license-lookup registry, if you are a pro; a pass or no-pass background-check result from Checkr, if that feature is enabled for your account; and your name and email address, if you choose to sign in with Google or Sign in with Apple instead of creating a password.
4. Sensitive Personal Information
California law treats some categories of personal information as "sensitive," giving you an extra right to ask that we limit our use of it (see Section 7). For OakTend, that includes:
- Precise geolocation. The latitude and longitude of the home you add, derived automatically from the street address you type. This is not your device's GPS location; OakTend does not track where your phone or laptop physically is.
- Government-issued license numbers. A pro's California contractor (CSLB) license number.
- Background-check results. For pros, only if background checks are enabled on your account: a pass or no-pass result from Checkr. OakTend never receives or stores the underlying report, your Social Security number, or your date of birth; you give those directly to Checkr, not to us.
- Message contents. What you write to a pro, to our support inbox, or to Ask OakTend.
- Your account password, which we store only as a salted, one-way hash. Nobody, including our own team, can read your actual password.
- Financial details you choose to enter, such as your mortgage balance, purchase price, assessed value, and insurance premium, used to power the home-value, tax-appeal, and insurance-checkup tools.
OakTend does not collect your Social Security number, driver's license number, full financial account or card numbers (Stripe holds those on its own systems), health information, racial or ethnic origin, or biometric data.
We use sensitive personal information only for the specific feature that needs it: matching you with pros near you, verifying a pro's license and insurance, answering the question you asked, and running billing. We do not use it to infer anything else about you, to build an advertising profile, or for any purpose beyond what the feature obviously does. Because of that, there is effectively nothing further to restrict beyond our current practice, but California law still gives you the right to limit the use of your sensitive personal information to what is reasonably necessary to provide OakTend. You can exercise that right the same way as the other rights described in Section 7.
5. How We Use Your Information
We use the categories described above to:
- Create, secure, and let you sign in to your account.
- Build and maintain your home profile: systems, maintenance schedule, and reminders.
- Match homeowners with pros, and let pros quote and message about jobs.
- Verify a pro's license status and, where enabled, background-check result.
- Process payments, subscriptions, and success fees, through Stripe.
- Send the push notifications, text messages, and emails you have opted into (Section 13).
- Look up property records, home valuations, weather forecasts, and appliance recall data relevant to your home.
- Detect and prevent free-trial abuse and account fraud, using one-way hashed identifiers (see "Free-trial and fraud checks" in Section 3).
- Operate, secure, and improve OakTend, including understanding which features actually get used.
- Comply with the law, respond to legal process, and enforce our Terms.
Ask OakTend and Anthropic
Ask OakTend is built on Anthropic's Claude API. When you ask it a question, we send Anthropic your question along with context about your home that helps it answer specifically: your first name; your property's street address, city, and state; your home's basic facts (year built, size, beds, baths, lot size, and property type); the county assessed value and our own estimated market value, if we have them; your home systems with their ages and condition, and our rough replacement cost ranges for them; up to 30 of your open maintenance tasks; up to 6 of your recently logged issues; a short summary of up to 20 documents you have saved; and the trade, date, and status of your 10 most recent job posts. If you attach a photo or a document, that is sent too, so the model can read it. On the pro side, Ask OakTend for Pros sends comparable account context: your trades and service area, license and verification status, background-check status, and the jobs you have open or applied to.
Two things worth stating plainly, because they surprise people:
- Your street address is included, not just your city. We send it because location-specific answers (local weather, typical local pricing, permit rules) need it.
- Your transcript is not stored on our servers. Ask OakTend conversations live only in your own browser's local storage. OakTend's server records a daily usage count, so we can enforce plan limits, but it does not record what you asked or what the model answered.
Apart from the assessed value and estimated value listed above, we send other financial details to Anthropic only when you actively use specific tools: your purchase price, along with the assessed value and OakTend's own home-value estimate, when you generate a Property Tax Appeal Kit; your insurance premium and renewal date when you generate an Insurance Requote Packet; and the full contents of an uploaded contractor's quote, which can include that contractor's name, license number, and contact details, when you use the quote analyzer. Your purchase price, insurance details, and uploaded quotes are not sent unless you use that specific tool.
Anthropic is the only AI provider OakTend uses. Under Anthropic's commercial API terms, the data you send and the answers you get back are not used to train Anthropic's models. Anthropic may keep what we send for a limited time under its own terms, to check for misuse. Voice input, when you use it, uses your browser's built-in speech recognition. Depending on your browser, your audio may be sent to the browser maker (for example Google or Apple) to be turned into text. We and Anthropic receive only the text. See our AI Disclosure page for a fuller explanation of how AI works in OakTend.
6. How We Share Your Information
With a pro you choose
When you post a job, pros who serve your area can see the job itself: the type of work, your description, its severity, your timing, a budget range if you gave one, your photos, your city, and your first name and last initial. They do not see your full name, street address, email, or phone number. When you choose a pro for the job, or when a pro accepts a request you sent straight to them, we give that one pro your name, email address, phone number, and property address so they can do the work. Pros never see your broader home profile: your other systems, your financial details, your documents, or your Ask OakTend history. This is not a "sale" or a "share" of your information under California law. It happens because you chose that pro and asked to be connected, to get a job done, not so anyone can advertise to you or build a profile of you.
During our homeowner preview. The Pro side of OakTend is not open yet, so no pros are applying to jobs. The OakTend team can read the jobs you post, and may look by hand for a local pro who could do the work. We ask you before we pass your name, email, phone number, or address to anyone, and we pass them only to a pro you have agreed to. A pro we find by hand during the preview is an independent business that has not signed up to OakTend, so it has not agreed to our Homeowner Data Use Addendum. That is one reason we ask you first.
With people you invite to your home
If you invite someone to share your home in OakTend (a household member), they see what you see for that home: your systems, tasks, issues, photos, documents, job posts, your messages with pros, and the money pages (home value, purchase price, mortgage balance, property tax, and insurance). Only invite people you would show all of that to. You can remove a member at any time from Account > Household.
With a homeowner
If you are a pro, homeowners browsing OakTend can see your public profile: business name, service area, your license and insurance labels, reviews, and, if you chose to add it, your own name. A public profile only exists for pros who serve at least one (1) Orange County city, so nobody outside our current launch area is listed.
Service providers
We share information with the companies that help us run OakTend. The companies that process personal information for us (the first ten rows) work under data processing terms that limit them to providing their service to us. The rest are public or sign-in services that receive only what the table says, under their own terms:
Provider
Supabase
- What They Do
- Database, authentication, file storage
- What They Receive
- Your account and home data; this is where OakTend's data actually lives
Provider
Vercel
- What They Do
- Hosting, serverless functions, and cookieless web analytics
- What They Receive
- Request logs and IP address; cookieless page-view counts with no persistent identifier
Provider
Google (Google Analytics)
- What They Do
- Website analytics on our public pages, only if you allow it and only while you are signed out
- What They Receive
- The public page viewed, the referring site's domain, time on page, device and browser details, your IP address (used by Google to estimate approximate location), and a random cookie ID; never your name, email, address, or account ID
Provider
Cloudflare
- What They Do
- DNS, email routing, and CAPTCHA (Turnstile)
- What They Receive
- Domain routing information, and, for anyone who completes a CAPTCHA challenge, that fact
Provider
Stripe
- What They Do
- Payments and subscriptions
- What They Receive
- Your email and billing details; your card number goes directly to Stripe and never touches our servers
Provider
Twilio
- What They Do
- Text-message delivery
- What They Receive
- Your phone number and message content, only if you opted into texts
Provider
Resend
- What They Do
- Email delivery
- What They Receive
- Your email address and the content of the email
Provider
Anthropic
- What They Do
- AI assistant, document and photo analysis
- What They Receive
- See Section 5 above for the full detail
Provider
RentCast
- What They Do
- Property records and home valuation
- What They Receive
- Your street address, including any unit number, and ZIP code
Provider
Checkr
- What They Do
- Background checks for pros, when enabled
- What They Receive
- A pro's name and email address
Provider
Photon (Komoot, built on OpenStreetMap)
- What They Do
- Address suggestions while you type
- What They Receive
- The partial address you're typing
Provider
California CSLB
- What They Do
- Public contractor license lookup
- What They Receive
- A pro's license number
Provider
Google
- What They Do
- Sign in with Google
- What They Receive
- Your name and email address, only if you use this sign-in method
Provider
Apple
- What They Do
- Sign in with Apple; App Store distribution; iOS push notifications
- What They Receive
- Your name and email, only if you use Apple sign-in; a push token, only if you enable notifications on the iOS app
Provider
Web push services (run by Apple, Google, and Mozilla)
- What They Do
- Delivering browser and app push notifications
- What They Receive
- Your push subscription address and keys, not your email or phone number
| Provider | What They Do | What They Receive |
|---|---|---|
| Supabase | Database, authentication, file storage | Your account and home data; this is where OakTend's data actually lives |
| Vercel | Hosting, serverless functions, and cookieless web analytics | Request logs and IP address; cookieless page-view counts with no persistent identifier |
| Google (Google Analytics) | Website analytics on our public pages, only if you allow it and only while you are signed out | The public page viewed, the referring site's domain, time on page, device and browser details, your IP address (used by Google to estimate approximate location), and a random cookie ID; never your name, email, address, or account ID |
| Cloudflare | DNS, email routing, and CAPTCHA (Turnstile) | Domain routing information, and, for anyone who completes a CAPTCHA challenge, that fact |
| Stripe | Payments and subscriptions | Your email and billing details; your card number goes directly to Stripe and never touches our servers |
| Twilio | Text-message delivery | Your phone number and message content, only if you opted into texts |
| Resend | Email delivery | Your email address and the content of the email |
| Anthropic | AI assistant, document and photo analysis | See Section 5 above for the full detail |
| RentCast | Property records and home valuation | Your street address, including any unit number, and ZIP code |
| Checkr | Background checks for pros, when enabled | A pro's name and email address |
| Photon (Komoot, built on OpenStreetMap) | Address suggestions while you type | The partial address you're typing |
| California CSLB | Public contractor license lookup | A pro's license number |
| Sign in with Google | Your name and email address, only if you use this sign-in method | |
| Apple | Sign in with Apple; App Store distribution; iOS push notifications | Your name and email, only if you use Apple sign-in; a push token, only if you enable notifications on the iOS app |
| Web push services (run by Apple, Google, and Mozilla) | Delivering browser and app push notifications | Your push subscription address and keys, not your email or phone number |
Our Subprocessor and Vendor List page has the current, complete list, with a link to each provider's own privacy policy.
For legal reasons
We may disclose information if we reasonably believe it's necessary to comply with a subpoena, court order, or other legal process, to enforce our Terms, to detect or prevent fraud or a security incident, or to protect the rights, property, or safety of OakTend, our users, or the public.
Business transfer
If OakTend is acquired by, merges with, or sells substantially all of its assets to another company, your information may be transferred as part of that transaction. If that happens in a way that meaningfully changes how your information is handled, we will notify you before the change takes effect.
With your consent
We may share information for other purposes if you give us your clear, specific consent to do so.
What we do not do
We do not sell your personal information; we may license de-identified and aggregated data as described in De-identified and aggregated data below. We do not share personal information for cross-context behavioral advertising. We do not use data brokers or any ad network or advertising service, and we do not let anyone use your data for ads. Our hosting provider's cookieless analytics service acts as our service provider and may not use your data for its own purposes. Google Analytics, which runs only on our public pages and only if you allow it, is configured with Google Signals, ad personalization, and Google's data sharing settings turned off, and we use it only to measure our own pages, never for advertising. In the preceding twelve (12) months, we have not sold or shared any personal information, and we have no plans to start.
Why giving a pro your job details is not a "sale." Once the Pro side is open, pros apply to jobs at no charge (a success fee is charged to the pro only if you hire them), and your contact details go only to the pro you choose. California's privacy law treats a disclosure you direct yourself, to a recipient you chose, as outside the definition of a sale (Civil Code section 1798.140(ad)(2)(A)). That is how it works: you post a job, pros apply, you choose one, and choosing that pro is what releases your contact details to them. Every pro who joins OakTend agrees to our Homeowner Data Use Addendum, which limits them to using your details for that job, forbids resale or marketing use, and requires deletion on request. The one exception is a pro our team finds by hand during the preview, described above. That pro has not joined OakTend or agreed to the Addendum, which is why we pass your details only after you tell us to. We do not give your personal information to anyone else for their own use.
De-identified and aggregated data
OakTend may create de-identified, aggregated statistics from information in the app, for example the share of homes in a ZIP code with a roof over twenty (20) years old, or the typical age of water heaters by neighborhood, and license those statistics to outside companies. We produce these statistics by removing your name, address, contact details, document contents, photos, and chat contents, and by grouping the results so that no individual home is identifiable. We never publish or license a statistic that describes fewer than twenty-five (25) homes, and we round and bucket values so that no single home can be picked out.
We publicly commit, as required by California Civil Code section 1798.140(m), that we will not attempt to re-identify de-identified data, and we maintain technical and business safeguards designed to keep it de-identified. We have not licensed this data to anyone yet. Before anyone receives it, we will require them to sign a contract that bars them from attempting to re-identify it, from combining it with other data to re-identify it, and from reselling it or passing it to anyone else except under the same restrictions.
We license this kind of data for uses such as maintenance benchmarks, service-life statistics for home systems, market research, and product development by companies that make or service home products.
This is not a sale of personal information under California law. De-identified, aggregated data is not personal information, and licensing it does not change the promise below.
Do we sell your personal information? We do not sell your personal information; we may license de-identified and aggregated data as described in that section.
7. Your California Privacy Rights
If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, "CCPA"), gives you these rights over your personal information:
- Right to know what we've collected, where it came from, why, and who we've disclosed it to.
- Right to delete, subject to the narrow legal exceptions described in Section 12.
- Right to correct anything inaccurate that we hold about you.
- Right to data portability: a copy of your information in a portable, readily usable format.
- Right to opt out of sale or sharing. We do not sell or share your information, so there is nothing to opt out of, but you may still submit this request and we will confirm that in writing.
- Right to limit the use of sensitive personal information, described in Section 4.
- Right to non-discrimination. We will never deny you service, charge you a different price, or give you a different level of quality because you exercised any of these rights.
How to exercise these rights
The fastest way is inside the app: go to Account > Privacy to download your data, as a JSON file or a PDF, or to permanently delete your account, without waiting on us. The download is ready right away. Deletion starts immediately and finishes within 30 days. For anything else, including a correction request or a general question, email privacy@oaktend.com, call (714) 468-5480, or write to 2108 N Street, Suite N, Sacramento, CA 95816.
Verification. Because you must already be signed in to use Account > Privacy, being logged into your own account is how we verify a request made that way. For a request made by email, we verify your identity by confirming that the email you're writing from matches the one on your account, and we may ask you to confirm additional information only the account holder would know before we act on the request.
Authorized agents. You may name someone else to submit a request on your behalf. We will ask that agent for proof of your written authorization, and we may still separately verify your own identity before completing the request.
Response time. We aim to respond within 45 days of receiving a request we can verify. If we need more time, we will tell you why, and we may take up to another 45 days.
Appeals. If we deny a request, you can appeal by replying to our denial or writing to privacy@oaktend.com. We will respond to an appeal within 45 days. If we deny the appeal, we will explain how to file a complaint with the California Privacy Protection Agency.
Global Privacy Control. Where your browser sends the Global Privacy Control (GPC) signal, OakTend treats it as a valid request to opt out of the sale and sharing of your personal information. Because we do not sell or share personal information in the first place, honoring GPC does not change how your account data is handled. It does turn off Google Analytics: if your browser sends GPC, we do not load Google Analytics, even if you allowed it before.
Do Not Track. OakTend runs no cross-site tracking. We treat a browser's "Do Not Track" signal the same way as Global Privacy Control for Google Analytics: with it on, we do not load Google Analytics.
Shine the Light (Cal. Civ. Code 1798.83). Once a year, free of charge, California residents may ask what personal information we disclosed to third parties for those third parties' own direct marketing purposes during the prior calendar year. We do not disclose personal information for that purpose, so there's nothing to report, but you can still send this request to privacy@oaktend.com and we will confirm that in writing.
Notice of financial incentive. OakTend Plus and OakTend Pro are planned paid subscriptions with paid features, such as a monthly home digest and higher AI usage limits. Neither can be bought during our preview. When they open, they will be products you pay for with money, not a financial incentive tied to your personal information under the CCPA. We do not offer any discount, benefit, or different price in exchange for the collection, sale, or retention of your personal information.
8. If You Live Outside California
OakTend currently serves homeowners in Orange County, California, but people travel, move, and read this policy from other places. If you live in Colorado, Connecticut, Virginia, or another state with a comprehensive consumer privacy law, you generally have rights similar to the ones in Section 7: to know, access, correct, delete, and receive a portable copy of your personal information, and to opt out of the sale of personal information, targeted advertising, and certain kinds of automated profiling. OakTend does not sell personal information or use it for targeted advertising for anyone, no matter what state you live in. You can exercise any of these rights the same way described in Section 7: through Account > Privacy, or by emailing privacy@oaktend.com.
9. How Long We Keep Your Information
What
Account and profile data
- How Long
- While your account is active, then deleted or de-identified within 30 days of a deletion request
What
Home records, photos, and documents
- How Long
- Same as above
What
Messages you sent and reviews you wrote
- How Long
- Same as above; content already visible to another user, such as a pro you messaged, may remain in their own view, de-identified where possible, because it's also their record of that job
What
Invoices, subscription, and payment records
- How Long
- 7 years, for tax and accounting purposes
What
Security and server logs
- How Long
- 12 months
What
SMS-consent records and Terms-acceptance records
- How Long
- 3 years after your account closes, as proof of consent
What
Our record that you made a privacy request
- How Long
- Kept as our own compliance record even after the rest of your account is deleted
What
First-party product-usage events
- How Long
- Disconnected from your account, and de-identified, within 30 days of a deletion request; once disconnected, the bare event carries no name, contact detail, or free text
What
Google Analytics visit data (public pages, only if you allowed it)
- How Long
- 2 months at the visit level in Google Analytics; the
_gacookies in your browser last up to 13 months after your last visit, or until you turn analytics off or clear them
What
Fraud-prevention hashes (Section 3)
- How Long
- Deleted when your account is deleted
What
Backups
- How Long
- Rotated out automatically within about 30 days
What
A pro's own copy of your contact information, if you chose one
- How Long
- Not controlled by OakTend; see Section 12
| What | How Long |
|---|---|
| Account and profile data | While your account is active, then deleted or de-identified within 30 days of a deletion request |
| Home records, photos, and documents | Same as above |
| Messages you sent and reviews you wrote | Same as above; content already visible to another user, such as a pro you messaged, may remain in their own view, de-identified where possible, because it's also their record of that job |
| Invoices, subscription, and payment records | 7 years, for tax and accounting purposes |
| Security and server logs | 12 months |
| SMS-consent records and Terms-acceptance records | 3 years after your account closes, as proof of consent |
| Our record that you made a privacy request | Kept as our own compliance record even after the rest of your account is deleted |
| First-party product-usage events | Disconnected from your account, and de-identified, within 30 days of a deletion request; once disconnected, the bare event carries no name, contact detail, or free text |
| Google Analytics visit data (public pages, only if you allowed it) | 2 months at the visit level in Google Analytics; the _ga cookies in your browser last up to 13 months after your last visit, or until you turn analytics off or clear them |
| Fraud-prevention hashes (Section 3) | Deleted when your account is deleted |
| Backups | Rotated out automatically within about 30 days |
| A pro's own copy of your contact information, if you chose one | Not controlled by OakTend; see Section 12 |
10. Security and Breach Notification
We use administrative, technical, and physical safeguards designed to protect your information, including: row-level security on our database tables, designed so that an account can only read its own data and the data shared with it; server-only service credentials, never exposed to your browser; verified webhook signatures on our Stripe and Twilio integrations, so those channels can't be spoofed; an upload guard that checks the actual bytes of anything you upload, not just its label, enforces a 15MB size cap, and automatically strips hidden metadata, including GPS location, from photos before they're stored; one-way, salted hashing for the fraud-prevention identifiers described in Section 3, so that someone who copied them without our separate secret key could not read the original values; HTTPS everywhere; and encryption of stored data, provided as a default by our infrastructure providers. A password-reset link expires in 15 minutes and works only once. If a device goes 30 days without signing in, it is automatically signed out and has to sign back in.
No system is perfectly secure, and we cannot promise your information will never be exposed. If a breach occurs that compromises your personal information, we will notify you without unreasonable delay, consistent with California Civil Code section 1798.82 and other applicable law.
11. Children's Privacy
OakTend is for adults 18 and older. When you create an account we ask you to confirm you are at least 18; we do not ask for or collect a birthdate, and we do not knowingly collect personal information from anyone under 18. Because OakTend does not sell or share personal information for anyone, the additional CCPA protections that apply specifically to the personal information of consumers under 16 do not change anything in how we actually operate. If you believe a minor has given us personal information, contact privacy@oaktend.com and we will remove it.
12. Account Deletion
You can permanently delete your account and its data any time, from Account > Privacy. Doing this:
- Permanently deletes your photos and documents from storage.
- Permanently deletes most of your database rows: your properties, home systems, maintenance tasks, issues, messages you sent, and more.
- Cannot be undone.
We retain a narrow set of records even after deletion, either because the law requires it or because deleting them would delete someone else's own information:
- Invoices and payment records, kept for 7 years, for tax and accounting purposes.
- A record that you requested deletion, so we can prove we complied with your request.
- Messages and reviews already visible to another user, such as a pro you messaged or reviewed, which may remain in their own account, de-identified where possible, because it's also part of their record of that job.
- A pro's client record about you. If you chose a pro for a job, that pro is a separate business and may keep its own notes about you in the client list feature inside OakTend. When you delete your account, we remove your name, phone number, email, and address from the in-app client records connected to jobs you posted through OakTend within 30 days, leaving only the pro's own notes and the job history without your identifying details. Records a pro keeps outside OakTend, such as a signed contract or an invoice, belong to that pro, and our Pro Terms require pros to honor deletion requests we relay except where the law requires them to keep a record. If you want a specific pro to delete records held outside OakTend, contact that pro directly.
13. Your Communication Choices
Push notifications. Turning push on, in your browser or the iOS app, stores a subscription record so we can ask your device's own push service to show you a notification. Only certain kinds of notifications are ever pushed, such as a message from a pro or homeowner, a new lead, or a weather or safety alert; routine reminders and digests only appear inside the app. You can turn push off any time in Account > Notifications, or in your device's own settings, either of which removes the subscription record.
Text messages. Texting is opt-in and off by default. You turn it on with a checkbox in your account settings; pros use the same checkbox to opt into lead-alert texts. Every text we send includes instructions to reply STOP to opt out right away, or HELP for help; we also support START if you want to opt back in later. We only text 10-digit U.S. phone numbers, we only send account and job-related messages, never third-party marketing, and we never send texts between 9 p.m. and 8 a.m. Pacific time, no matter when the underlying event happened.
Email. We send transactional emails about your account and jobs (Stripe sends its own separate receipts), a monthly home digest (during our preview, for every homeowner), and occasional product updates. Every marketing or digest email includes an unsubscribe link and our mailing address; we honor unsubscribe requests within 10 business days. Transactional emails about your account or an active job keep going even if you unsubscribe from other emails, because those aren't optional marketing, they're how we tell you something happened on your account.
You can review and change all of these choices under Account > Notifications.
14. Cookies and Similar Technologies
OakTend uses a short list of first-party cookies needed to keep you signed in and support features like password reset, plus a handful of values in your browser's own local storage, such as your theme preference and your Ask OakTend chat history, which never leaves your browser. We also set a first-party cookie called oaktend_campaign for up to thirty (30) days when you arrive through a referral or partner link; it stores only a partner code, not anything else about you, so that if you sign up we can credit the right referral. Our hosting provider's analytics service does not set cookies at all, and we do not use advertising cookies. On our public pages, if you tap "Allow analytics," Google Analytics sets two cookies, _ga and _ga_<id>; until you choose, while you are signed in, inside the OakTend app, and if your browser sends Global Privacy Control or Do Not Track, it sets none. You can change your choice at any time on the Cookie and Tracking Notice or Your Privacy Choices page. See our full Cookie and Tracking Notice for the exact list of what we set, what each one does, and how to control it.
15. International Users and Where Your Data Is Stored
OakTend currently operates only in the United States, for homeowners in Orange County, California. Our servers and databases are located in the United States, and your information is stored and processed there. If you access OakTend from outside the United States, your information will still be transferred to, and processed in, the United States. One exception: if you allow Google Analytics on our public pages, Google may process that analytics data in the United States and other countries where it operates.
16. Changes to This Policy
We may update this policy as OakTend changes. We will always update the "Last updated" date at the top of this page. For a change that meaningfully affects what we collect, why, or who we share it with, we will also give you notice, such as an email to the address on your account or a notice inside the app, before it takes effect. Continuing to use OakTend after that means you accept the change.
Contact Us
OakTend LLC, a California limited liability company
2108 N Street, Suite N, Sacramento, CA 95816
Privacy: privacy@oaktend.com
Phone: (714) 468-5480
If you have an account, you can also reach us from the in-app Help page.