Security & privacy

What we collect, why, who processes it, how long we keep it, and how to delete it. We record a lot about how the product is used so we can make it better. We never sell it.

Last checked against the product and our processors on .

What we collect, and why

erateradar is run by Helios One. This covers erateradar.com, app.erateradar.com and the emails we send.

Your email address

Plus your name or company if you give them. When you enter your email to download a list, we store it with the territory on screen, your visit source, your browser and IP address.

Why: To sign you in, send your weekly list and account emails, and reply to what you send us.

Kept in: Convex, Resend

Your territory

The ZIP, city or SPIN office you set or search, and the list built for it.

Why: To build your list.

Kept in: Convex

How you found us

Your first and latest visit source: UTM tags, referring site, landing page. Stored on your account.

Why: To learn which pages and emails bring people in.

Kept in: Convex, PostHog

Usage analytics

Pages viewed, clicks, searches, device and browser, IP address and the approximate location it implies, page speed, errors. Automated and bot traffic is recorded and labelled.

Why: To see what works and fix what doesn’t.

Kept in: PostHog

Session replay

A recording of the page while you use it: mouse movement, scrolling, clicks, and what you type into fields such as ZIP and email. Passwords, sign-in codes, tokens and other secret fields are masked. Browser console messages and the network requests the page makes are recorded too, with their headers and contents; PostHog removes sign-in headers, cookies and password- or token-like fields from them.

Why: To watch where people get stuck, and to reproduce bugs.

Kept in: PostHog

Server events

Account milestones: trial started, list exported, weekly email sent and opened, subscription started or cancelled. The weekly email has a small tracking image so we know it was opened.

Why: To run your account and measure the product.

Kept in: Convex, PostHog

What you send us

Wrong-record reports, feedback (with an optional screenshot) and call requests, stored with details of the visit such as page, browser, IP address and a link to the session replay. Each one is emailed to a co-founder, and so is each new sign-up.

Why: So a co-founder reads and answers it.

Kept in: Convex, Resend

Billing

If you buy a plan: the plan, its status, and Stripe’s customer and subscription IDs. You type card details on Stripe’s page; they stay with Stripe and never reach us.

Why: To bill you and unlock paid features.

Kept in: Stripe, Convex

Web server logs

IP address, browser user agent and the page requested, for each request.

Why: To keep the site running and spot abuse.

Kept in: Fly.io

We hold no student data. The school records in your list are public USAC filings about what a school or library wants to buy.

Cookies and browser storage

NameWhat it holdsLasts
er_didA random visitor ID, so analytics connect your visits to erateradar.com and the app.400 days
er_touchYour first and latest visit source (UTM tags, referring site, landing page).400 days
ph_…_posthogPostHog’s copy of the visitor ID and session state (cookie and local storage).Set by PostHog
er_exit, er_exo_seenThat we already showed you the “take the list with you” offer, so it never shows twice.400 days
er_capture_pendingThis device only (local storage): an email you entered, with the area and visit source sent with it, when sending it failed (for example offline). We try again on your next page views and delete it once it is sent.Up to 7 days
er_internalOnly on our own team’s browsers, so our visits are filtered out.400 days

The app also keeps your sign-in session in your browser. We use no advertising cookies and no ad networks.

Where it runs

Checked against each provider’s settings on .

Who processes it

These services hold personal data for us, only to run erateradar:

ServiceWhat forData
Convex Northern Virginia, US (AWS us-east-1) Database and backend for the app Account email, territory, visit sources, reports, feedback, call requests (with browser and IP address), server events, copies of emails we send, billing status
Fly.io Ashburn, Virginia (US) Hosts erateradar.com and the app Web server logs: IP address, browser user agent, page requested
Resend Northern Virginia, US (Amazon SES us-east-1) Sends our email Your email address and the emails we send you (sign-in codes, weekly list, account emails)
PostHog (EU Cloud) Frankfurt, Germany Product analytics and session replay Visitor ID, pages, clicks, searches, device, browser, IP address, approximate location, session recordings, server events
Stripe Payments Card details and billing address (entered on Stripe), plan and invoices

Each name links to that company’s privacy policy; a location links to the page that states it (read ).

How long we keep it

The replay and analytics periods are our PostHog project and plan settings, read on .

Who can see your territory

Never other customers, schools, USAC or other providers. We don’t publish, share or sell territories or searches. The numbers on our site come from USAC data, not from customers.

Delete, export or stop emails

How we protect it

Found a security problem? Reply to any email from us or book a call. Both reach a co-founder’s inbox.

Contact

Helios One
3075 Clay St
San Francisco, CA 94115

Reply to any email from erateradar, or book a call with a co-founder.