Privacy

Last updated 2026-07-20.

Short version: you can use Street Leaky without an account, and if you do, we can't tell who you are. If you create an account, we store the listings you look at so you can see your own history, and we delete them after 90 days.

Signed out: the default.

When you open a StreetEasy listing, the extension sends one thing to our server: the address of that listing. We use it to look up public city records and send the results back. There is no account, no cookie, and nothing that identifies you. We cache results by address so the next person viewing that building gets a fast response; that cache is not tied to anyone.

For abuse prevention our edge server counts requests per IP over a rolling one-minute window to enforce a rate limit. Those counters aren't used for anything else and aren't retained.

Signed in.

If you create an account, we additionally store:

• Your email address and a hashed password.
• A record of each listing you open while signed in: street address, apartment number, and the city's building identifier, plus a timestamp. We deliberately do not store the full URL, the page you came from, how long you looked, or any device or browser fingerprint.
• Your subscription status, if you have a paid plan.

Viewing history exists so you can see your own history. It is deleted automatically after 90 days, and you can erase all of it at any time from your account page. We do not build profiles from it, sell it, or share it.

Cookies.

The website sets a session cookie and a CSRF cookie when you sign in. That's it: no analytics cookies, no ad cookies, no third-party trackers. The extension itself sets no cookies.

Who else sees your data.

• Google Cloud: hosts the account service and database.
• Cloudflare: serves the public-records API and this site, and may keep standard request logs (IP, user agent, URL) for security and abuse handling.
• Stripe: processes payments if you subscribe. They receive your payment details directly; we never see your card number.
• Sightengine: if you use the paid photo check, the URLs of the listing's photos are sent to them for analysis. Those URLs are already public on StreetEasy. Nothing identifying you is sent with them.
• NYC and NY State open data: we query their public APIs by address. They see our server, not you.

What we still don't do.

• No analytics: no Google Analytics, no Plausible, nothing.
• No advertising, ad networks, or third-party trackers.
• No selling, sharing, or licensing of data about you.
• No fingerprinting or cross-site tracking.

Deleting your data.

Clear your viewing history any time from your account page. To delete your account entirely, email us and we'll remove it along with everything attached to it.

Open source.

The extension is open source. If any of the above sounds off, you can read the code and verify it yourself.