Privacy Policy

You can search this entire site without telling us anything. There is no sign-up wall and nothing to fill in before you can look at a house. There is now a way to sign in, and it is optional — nothing on this site is behind it.

There is exactly one thing we ask you for, and only if you ask us first. Saving a home needs no email address: that list stays on your device. If you want to be told when a home’s price or a builder’s offer changes, we need somewhere to send that. We then store your verified email address, the words you agreed to, when you agreed to them, and the list of things you are watching. No profile, password or budget.

We only write to an address someone has proved is theirs. Typing an address into a form does not prove anything, so those addresses are held and never written to. Signing in with Google is the proof, and it is the only way an alert email gets sent — which is the entire reason signing in exists here. We do not ask Google for your name or profile picture.

What we also receive, from everyone, is the ordinary record of a web request — your IP address, your browser type, which page you asked for — plus cookieless usage analytics. And when a page shows a map or a photograph, your browser fetches those directly from other companies, which see your IP address as a result. All of that is set out in full below.

We do not sell anything about you, we run no advertising, and we do not track you across other websites.

What we ask, and when

Saving a home or community asks for nothing. The item stays in this browser’s local storage, and you can return to it without creating an account. If you choose Email me changes, we ask Google to verify an email address before we send anything.

The email permission and the notice that continuing accepts the Terms of Use are printed against the Google button. Saving on your device does not accept either one.

What we store

• Before verification: the saved item’s Dwellmark slug, its type, the alert switches and the date it was saved, all on this device.
• After verification: your verified email address, Google’s stable account identifier, what you saved and which kinds of change you asked to hear about.
• The exact consent and Terms sentences shown to you, copied word for word with the date and source page, plus a one-way hash of the random session token that lets this browser find the server list again.

That is the complete list. No name, profile, password, mobile number, postal address or information about you from another source.

Two things we want to be straight about

Older unverified subscriptions are never emailed. An earlier version of this site allowed someone to type an address. Those legacy records remain separate and silent until the owner verifies the address; the current product no longer creates them.

Deleting is a button, not a request. Your account page and your watchlist each carry a control that erases your address, your consent record, your Terms acceptance, every watch and every saved search immediately. You do not have to email anyone or explain why.

Signing in is optional and gates nothing. Every page, every search, every filter and every home on this site works without it, and saving something stays on your device. What signing in buys is one thing: alerts that actually arrive. We refuse to write to an address nobody has proved is theirs, proving it ourselves would mean emailing you a link — which is the very thing we are trying to earn the right to do — and Google has already done that check and will tell us the answer.

What Google tells us

• A stable account identifier. Not your email address: Google lets an account change its address, and this is the thing that does not move. It is how we know you are the same person next time.
• Your email address, and Google’s statement that it has been verified. We refuse the sign-in outright if that statement says otherwise.

What we ask Google for, and what we do not

We request two permissions — openid and email — which is the smallest set that produces the facts above. We do not request access to Gmail, your contacts, your calendar, your files, or anything else, and Google’s consent screen will confirm that.

We also deliberately do not ask for offline access. That is the permission that hands a site a long-lived key to talk to Google about you later, without you present. There is no moment after sign-in when this site needs to contact Google again, so we never hold one.

What happens to the list you already had

If you were already watching homes in that browser, those watches and saved searches move onto your account and the old unconfirmed record is deleted. It is your list either way — this only stops it disappearing at the moment you sign in. Nothing merges based on an address alone: only the subscription belonging to the browser you are signing in from, and never one that belongs to another signed-in account.

Signing out is not deletion, and we do not pretend otherwise. Signing out ends that browser’s session. Deleting your details erases the address, the consent record, every watch and every saved search — and that is a separate button that says so.

Server logs

Our host, Vercel, records the ordinary information any web server receives in order to serve a page and to stay online: your IP address, your browser and operating system, the page you requested, the page you came from, and the time. This is standard infrastructure logging, used to run the site, diagnose faults and defend against abuse. Vercel retains these logs for a limited period under its own retention policy; we do not build a separate copy of them and we do not use them to profile visitors.

Usage analytics

We use Vercel Web Analytics to understand which pages are used. It is worth stating precisely what it does, because “analytics” covers a lot of very different things:

• It sets no cookies and stores nothing on your device.
• It does not follow you to other websites. There is no cross-site identifier.
• It identifies a visit by a hash computed from your request — derived in part from your IP address — rather than by storing your IP address or a persistent ID. Vercel discards that hash after 24 hours.
• It records the page URL, the referring page, coarse location (country or region level), device type, operating system and browser, and the time.

We call this pseudonymous rather than anonymous, because that is what it is: for a day, a hash groups one visitor’s page views together. Note also that this site puts your search criteria in the page URL — the cities, price range, bedroom count and any text you typed — so those travel into the analytics record along with the URL. We do not use any of it to identify anyone, and we could not.

Some things on this site are served by other companies rather than by us. Your browser contacts them directly, which means they see your IP address even though we never send them anything about you. This is the part of a privacy policy most often left out, so here it is in full.

Vercel, Supabase and Resend handle data on our behalf, under contracts that let them use it to provide the service to us and for nothing of their own. CARTO and the image hosts are not doing anything for us — they are simply the servers your browser has to reach to draw a map or show a photo. Google is in both categories at once, and only if you choose to sign in.

One thing we do not do, which most sites do: our fonts are served from this site rather than from Google Fonts, so displaying a page here does not reveal your IP address to Google. That remains true on every Dwellmark page, including for people who have signed in.

Browsing this site sets no cookies at all. Not for analytics, not for preferences, not for anything. You can read every page here and leave nothing behind.

Saving a home while signed out uses your browser’s local storage. It records only the kind of item, its Dwellmark slug and whether you asked for price or incentive changes. It contains no email address or profile and never leaves your device until you choose to verify an email for alerts. Unsaving removes the record; clearing this site’s browser data removes the list.

There are exactly three kinds of cookies on this site, and none is set by looking around.

• When you subscribe to alerts or sign in, one cookie is set so your browser can find its own watchlist again. It holds a random token and nothing else — not your address, not your name, not what you are watching. It is HttpOnly, so no script on the page can read it, and SameSite, so it is not sent along with requests from other sites. It lasts a year, so you are not silently signed out of your own list. Signing out deletes it; so does deleting your details.
• While you are signing in with Google, a second cookie holds the handshake — a random value proving the sign-in coming back is the one this browser started, and where to return you to afterwards. It lasts ten minutes, is deleted the moment you land back here, and contains nothing about you.
• When an operator signs in to this site’s private operations portal, a session cookie keeps them signed in. It is never set for anyone who is not signing in to that portal.

None is an advertising, tracking or analytics cookie, and none follows you to any other site. The local saved list is functional storage created only when you press Save. There is no cookie banner because neither it nor a cookie is created by merely browsing.

These are true today, and we will change this page on the day any of them stops being:

• We do not sell your personal information, and we do not rent, trade or otherwise hand it to anyone for money or for anything else of value.
• We do not share it for advertising. There is no advertising on this site, no ad network, no advertising pixel, no conversion tracking and no behavioural-targeting arrangement with anyone.
• We do not track you across other websites, we do not let anyone else do it here, and we do not buy or receive data about you from data brokers.
• We do not write to unconfirmed addresses. We hold addresses people typed in and gave us permission to use, and we send nothing to any of them, because typing an address does not prove it is yours. The only messages that leave this site go to addresses confirmed by signing in.
• We do not track whether you opened an email. No tracking pixel, no rewritten links, no open or click reporting. We do not know, and have not asked our email provider to tell us.
• We have never sent a marketing email, and there is no mechanism to. The only two messages this site can produce are a change to something you asked to watch, and a one-off confirmation the first time you sign in.
• We do not ask for your location. The site never requests location access from your browser.
• We do not ask for anything we do not need. No name, no password, no budget, no “tell us about your search” form standing between you and a listing.

The one qualification we will make on “we do not sell or share”: because maps and photographs are served by the other companies named above, loading a page necessarily reveals your IP address to them. We receive nothing in return except the map tile or the photograph itself. We would rather flag that than make a flat claim that a careful reader could pick apart.

Email alerts are running. Text messages are not. If you have signed in with Google, changes to the homes, communities and searches you watch are emailed to you. If you only typed an address into a form, it is being held and nothing is being sent to it — see above for why. No text message has ever been sent by this site to anyone.

These are the terms, and they are the ones written into the sentence you agreed to rather than a separate set of aspirations:

• We confirm your address before the first message. Nothing goes to an address that has not been confirmed — which also means nothing goes out on the strength of a permission recorded before the confirmation existed.
• At most one message a day for each kind of update — the homes you watch get an alert, the communities you follow get a brief — and only when something you are watching has actually changed. On a day when nothing changed, nothing arrives. Several changes on the same day become one message, not several. If you would rather read everything once a week, your account page can switch delivery to Saturday mornings — still at most one message per kind, covering the week.
• Only what you asked for. No newsletters, no “you might also like”, no re-engagement campaigns, no marketing of any kind. There is exactly one message that is not a change you subscribed to: a single confirmation the first time you sign in, saying what will and will not arrive. If we ever want to send anything else, we will ask separately.
• Every message has a working unsubscribe link, and honours the one-click unsubscribe button your mail app shows — and texts will honour STOP, with HELP returning who we are and how to reach us. All of them take effect immediately and permanently. Stopping the emails does not delete anything: your watchlist stays yours and you can switch them back on. You do not need a message to stop either, and if you want everything erased rather than paused, the button on your account page and on your watchlist does that instead.
• No open tracking and no click tracking. Our messages contain no tracking pixel and no rewritten links. We do not know whether you opened one.
• We will never sell, rent or share a subscriber list with builders, agents, lenders or anyone else. Not now, and not as part of any future arrangement.
• Text messages need their own consent, given separately, with the sender, the frequency, the rates, STOP and HELP shown next to the box rather than behind a link. Giving us an email address is not permission to text you, and there is no way to give us both at once.

An earlier version of this page warned that switching delivery on would force unsubscribing to leave behind a minimal suppression record — enough to know not to contact you again — and that this would be the one part of “delete erases everything” that had to change. It did not. Unsubscribing keeps your account and flips a switch on it, so there is nothing to suppress; and deleting erases the row entirely, after which nothing about you exists to be written to. We never import or re-import an address from anywhere, so there is no list you could reappear on. We are leaving the retracted warning here rather than deleting it, because a policy that quietly drops a promise it made is one nobody can rely on.

Most of what this site stores is information about houses: prices, floor areas, lot numbers, community names, builder offers and how those changed over time. It comes from builders’ public websites, and it describes new-construction inventory that a builder is currently advertising for sale — not a home someone lives in, and not anything about a buyer or an owner.

We do not collect or publish information about residents, owners, past sales, or the people involved in any transaction. If you believe something on this site identifies you personally, write to support@serenialabs.space and we will look into it and remove it if it does.

A policy that says “as long as necessary” has said nothing. Here is what each thing actually is:

• Your address, your consent record, your Terms acceptance and your watchlist: until you delete them. There is no expiry timer and no automatic clean-up, which we would rather admit than describe a job that does not run. What there is instead is a button on your account page and on your watchlist that removes all of it in one press, at any time, with no waiting on us.
• Messages we sent you: a record that a message went out, which message, and when — kept as long as your account is, and erased with it. Resend holds its own copy of what it delivered, under its retention schedule. We do not record whether you opened anything, because we do not collect that at all.
• Your session: one row per browser, holding a hash of a token and the time it was last seen. Removed when you delete your details or sign that browser out.
• Server logs: held by Vercel under its own retention schedule, which is a limited period measured in days for request logs. We keep no separate copy.
• Analytics: the per-visitor hash is discarded by Vercel after 24 hours. What survives is counts — page views by day, by country, by device — which are not about you and cannot be resolved back to you.
• Information about homes: kept indefinitely, on purpose. The history is the product, and a price observed in 2026 is worth more in 2028 than it was the day we saw it. None of it is about you.

If we ever start deleting dormant subscriptions on a schedule — which would be a reasonable thing to do — we will say so here, with the period, before it starts.

We have said we do not sell or share anything about you. That is the general rule, and it has three specific exceptions, all of which we would rather name than leave you to discover:

• The companies that run this thing for us. Vercel hosts the site, Supabase holds the database, and Resend sends the alert emails — which means Resend necessarily receives your address and the message itself. They process what they process in order to provide that service to us, under their terms, and not for purposes of their own. They are named above and there are no others.
• Google, if you choose to sign in. This one is the other way round from the rest of the list: signing in sends you to Google, and Google tells us a stable identifier and your verified address. We send them nothing about your watchlist, what you searched for or whether you came back.
• If the law compels it. We may disclose information where we are required to by law, by a subpoena or by other valid legal process, or where we believe in good faith it is necessary to prevent imminent physical harm. We will insist on process that is actually valid, we will give no more than it asks for, and we will tell you it happened unless we are legally prohibited from doing so — in which case we will tell you as soon as we are allowed to.
• If the business changes hands. If Serenia Labs LLC is sold, merged, or its assets transferred, subscriber information could transfer with the rest of the business. If that happens: any buyer takes it subject to this policy for information collected under it, and we will publish notice here — and email subscribers who have given us an address — before the transfer, with enough time to press the delete button first if you would rather not come along.

That is the complete list. Not to advertisers, not to builders, not to agents, not to lenders, not to data brokers, not for money, and not as a favour.

We will be straight with you about the legal position rather than claim a compliance badge. Our markets are in Arizona, California, Texas, Georgia, North Carolina, Florida and Tennessee, so those are the states most people reading this are in — though anyone in the country can use the site, and which state you are in changes what we owe you. Arizona has no general consumer privacy statute. California and Texas do — and as of the effective date of this policy, this is a small, free operation that falls under the entry thresholds those statutes set before they apply to anyone. We are not going to claim to “comply with” regimes that do not reach us; an unkept promise of that kind is worse than no promise.

That is not the whole picture, and we will not let it stand as if it were. A separate set of laws — California’s Online Privacy Protection Act among them — applies to any commercial website that collects personal information from a resident, with no size threshold at all. This document is written to meet those: it says what we collect, who else receives it, how to review and change it, when it took effect, how you will learn if it changes, and how we respond to tracking signals. And if we ever cross a threshold into one of the comprehensive statutes, we will comply with it and say so here rather than wait to be asked.

In the meantime we offer the same things voluntarily, to anyone who asks, wherever you live and without needing a legal basis for asking:

• Ask what we have about you. If you have subscribed, the answer is your address, the sentence you agreed to and when, the Terms acceptance recorded at the same moment, and your watchlist. If you have not, it is server logs and a day of pseudonymous analytics. Either way we will say so honestly, and your account page already shows you most of it without having to ask.
• Ask us to delete something. If we can identify it, we will.
• Ask us to correct something.
• Ask for a copy of what we hold about you, in a form you can keep.
• Ask a question and get an actual answer about how any of this works.

Write to support@serenialabs.space — starting the subject line with “Privacy” helps, but is not required. We aim to reply within 30 days, we will never charge you for asking, and we will never treat you differently for having asked. If we cannot identify you from what you send us — which is genuinely possible here, because we hold no name — we will tell you that rather than demand more personal information to prove a point.

Tracking signals

Do Not Track. This site behaves the same way whether or not your browser sends a Do Not Track signal, because there is nothing for it to switch off: we do no cross-site tracking, and we permit no third party to collect personally identifiable information about your activities over time and across other websites when you use this site.

Global Privacy Control. We honour it. We treat it as an instruction not to sell or share your information — which we already do not do, so it changes nothing, and we would rather say that plainly than imply we switched something off for you.

Things you can do without asking us

• Delete everything we hold about you, immediately. The button is on your account page and on your watchlist: it erases your address, consent record, Terms acceptance, every watch and every saved search, and signs your browser out. No email, no form, no waiting for us. A signed-out device list can be removed by unsaving its items or clearing this site’s browser data.
• Stop the emails without deleting anything. One switch on your account page, the link at the bottom of any message, or the unsubscribe button in your own mail app. Your watchlist is untouched and you can switch them back on.
• Stop watching one thing without removing anything else, from the watch button on any home or community.
• Block scripts or use a tracker blocker. The site is built to work without analytics, and blocking it costs you nothing.

Traffic to this site is encrypted in transit. Our database enforces row-level security, and the credential the website itself uses can only read the catalogue of homes — it cannot write to it, and it cannot read subscriber addresses or consent records at all. Those are reachable only from server code holding a separate credential that is never sent to a browser.

There are no passwords here to steal. Subscribing does not create one, because there is no login: your browser holds a random token, and what we store is a one-way hash of it. Someone with a copy of that table cannot turn it back into a working session. That removes the largest single category of breach from this site entirely.

No system is perfectly secure, and we are a small operation. If a breach affects personal information, we will notify the people affected and any regulator that the law requires — and we will get that right by where you are, not by where we are. Breach notification in the United States is set by the law of the state the affected person lives in, so a subscriber in California is owed California’s notice and a subscriber in Texas is owed Texas’s. Where we sit, Arizona sets 45 days. We will work to the shortest deadline that applies to anyone affected rather than the longest, and we will tell you what happened rather than the least we can get away with.

This site is for adults shopping for a house. It is not directed to children, and we do not knowingly collect personal information from anyone under 13. We do not ask anyone’s age, because collecting birthdates in order to prove we do not want them would mean collecting more personal information, not less. If you are a parent or guardian and believe your child has provided us with something, write to support@serenialabs.space and we will delete it.

This service is offered to people in the United States. It covers homes in Phoenix Metro (Arizona), San Francisco Bay Area (California), Austin Metro (Texas), Dallas–Fort Worth Metroplex (Texas), Houston Metro (Texas), Atlanta Metro (Georgia), Charlotte Metro (North Carolina), Orlando Metro (Florida), Tampa Bay (Florida) and Nashville Metro (Tennessee), and it is offered to people in Arizona, California, Texas, Georgia, North Carolina, Florida and Tennessee and anywhere else in the country someone might be shopping from. Our infrastructure is in the United States, so information is processed there.

It is not offered or directed to people in the European Economic Area, the United Kingdom or Switzerland, and we do not knowingly offer services to, or monitor the behaviour of, people located there.

When we change this policy, we will change the effective date at the top. If we make a change that materially reduces the protection this policy describes — for example if we add advertising, begin sharing information with a third party, or start sending messages — we will say so clearly on the site rather than quietly editing this page, and we will do it before the change takes effect, not after. Where we hold an email address for you, we will use it.

Previous versions are available on request.

For anything on this page, or any question about what we hold and why, write to support@serenialabs.space. A person reads it. This is the address designated for privacy requests, and it is a real inbox rather than an alias.

Serenia Labs LLC
Arizona limited liability company. We do not publish a street address for a business run out of a home; if you need one, ask and we will give you one.
support@serenialabs.space

See also the Terms of Use, which covers where the information about homes comes from, what our figures mean, and how a builder can ask us to correct or remove something.