Privacy Policy

Last updated: 2026-05-16

This Privacy Policy explains what personal information Property Tax Rebel collects when you use our website, how we use it, and the choices you have. This policy is part of the Terms of Service; words defined there carry the same meaning here.

If you have any question about this policy, email rebel@propertytaxrebel.com.

1. What we collect

We collect only what we need to deliver the evidence package, send your receipt, let you recover access, and keep the platform secure. We do not sell, rent, or share your personal information with advertisers or data brokers.

The categories we collect:

Category	Source	Purpose	Retained
Property address and HCAD account number	You type it during the free-analysis or checkout flow.	Running the CAMA analysis; pre-filling Form 50-132.	Kept with the order record.
Owner name, mailing address, phone, email	You type it during checkout.	Pre-filling Form 50-132; sending your receipt and magic-link; contacting you about the order.	Kept with the order record.
Special-status flags (senior 65+, disabled, military)	You tick a box during checkout.	Pre-filling Form 50-132 so the corresponding box is correctly checked in the filed form.	Kept with the order record.
Property-condition text disclosures (category flags, severity ratings, contractor estimate, written summary)	You optionally submit them at checkout or on the order page.	Rendering the Property Condition section of your evidence package and adjusting the CDU factor in your analysis.	Kept with the order record.
Property-condition photos	You optionally upload them during checkout step 2 or on the order page after purchase.	Embedded in the Property Condition section of your evidence package; presented to the appraiser at hearing. Before storage we strip GPS coordinates from the file's metadata and re-encode the image, which also removes most other camera metadata. We do not run facial recognition, license-plate recognition, or any other biometric analysis on photos you submit.	Kept with the order record. Photos staged before payment are stored temporarily in your own browser (IndexedDB) and uploaded to us only after you complete payment.
Cancellation reason + feedback	You optionally select a reason and leave a short free-text note when you cancel auto-renewal.	Understanding why subscribers cancel so we can improve the product. Aggregated internally; never shown to other customers.	Kept with the order record.
Subscription property-transfer history	Recorded automatically when you use Move my subscription.	Audit record of which HCAD parcel your subscription applied to in each tax year; support troubleshooting.	Kept with the order record.
Contact-form messages	You type them into the `/contact` form.	Answering your question; delivered to our support mailbox.	Retained in the support mailbox until the conversation is resolved, typically 12 months after the last message.
Subscription identifiers + renewal dates	Generated by Stripe when you choose Annual protection.	Managing the auto-renewal, sending the 14-day renewal reminder required by our Terms, and authenticating you into the Stripe Customer Portal.	Kept with the order record for as long as the subscription is active, then per the retention period below.
Payment tokens + receipt metadata	Provided by Stripe. We never see your card number.	Completing the payment, showing you a receipt, supporting refunds and disputes.	Kept for the retention period Stripe requires.
IP address, browser user-agent, request timestamps	Automatically collected when your browser hits the server.	Rate-limiting, abuse prevention, troubleshooting.	Kept in web-server logs for up to 90 days.
Email delivery events (sent / opened / bounced)	Provided by our email service (Postmark).	Confirming that receipts and magic-links reached you; diagnosing delivery failures.	Kept for up to 90 days.

We do not collect date-of-birth, Social Security number, driver's license number, bank-account number, or any financial information other than what Stripe handles directly. We do not embed advertising trackers or cookies for third-party targeting.

2. How we use what we collect

To deliver the product you paid for. Your property data drives the CAMA analysis; your owner details pre-fill your Form 50-132; your email receives the receipt and magic-link.
To let you get back in. When you request a magic-link at /recover, we look up orders matching the email you supplied and send you a link to re-download your PDF. We return the same confirmation message whether or not we find a match, so the form cannot be used to enumerate customers.
To keep the platform working. IP addresses and request timestamps feed the rate-limiter; error logs help us diagnose failures.
To meet legal and accounting requirements. Payment records are retained as long as Stripe and applicable law require.

We do not use your personal information to train machine-learning models, to profile you for marketing, or to make automated decisions that produce legal or similarly significant effects on you.

Only with the service providers we need to operate the platform:

Stripe, Inc. (payment processing). Stripe handles your card data directly under its own Privacy Policy. We never see or store your full card number.
Postmark (transactional email delivery). Postmark receives the recipient email and the contents of transactional messages we send to you.
Fly.io (cloud hosting). Fly hosts the application and the database; they have access only as their operational role requires.
Google Maps (comp-location maps inside the PDF). Map tiles are rendered server-side; your individual use of the site is not sent to Google. Attribution is included with each map.

We do not share your data with marketing partners, advertising networks, analytics resellers, or social-media platforms. We do not sell your data.

We may disclose information in response to a lawful subpoena, court order, or valid legal process, or to protect our rights or the safety of others. We will push back on overbroad requests where we can.

4. How long we keep it

Annual protest-evidence order records (property data, owner details, PDF snapshot): kept as long as your tax year remains protestable plus two years, so we can assist with disputes or chargebacks. Default 3 years total, then deleted.
§25.25 motion-for-correction orders: the prepared motion PDF, your saved motion details, and any uploaded photo exhibits are kept for twelve months from the date of purchase, then automatically removed by our daily janitor. A reminder email is sent thirty days before that removal. After removal, the order record itself (purchase date, order number, email, amount, and the audit log of edits and attestations) is retained indefinitely for our books and any future support questions; the heavyweight content (the PDF and the photos) is gone for good. This retention is shorter than the annual-protest product because HCAD reissues their correction form roughly once a year; keeping a stale filled-out motion on hand serves nobody.
Email address on the contact list: retained until you unsubscribe.
Server access logs: up to 90 days.
Email delivery events: up to 90 days.
Stripe payment records: retained per Stripe's retention policy and applicable tax law.

If you want your data deleted earlier, email rebel@propertytaxrebel.com with your order number and we will comply to the extent we lawfully can (some records must be retained for tax and dispute-resolution reasons).

5. How we protect it

HTTPS with HSTS on every request; the site will not serve over plain HTTP in production.
Strict Content Security Policy, X-Frame-Options, and the other standard security headers on every response.
Order tokens are cryptographically random and never appear in our logs.
Administrative access requires HTTP Basic authentication with a constant-time password compare; the admin surface fails closed if credentials are missing.
The PDF renderer runs JavaScript-disabled Chromium with a strict URL allow-list, so nothing in the evidence package can exfiltrate data.
Stripe webhooks are verified with HMAC signatures and deduplicated by event ID so a replayed or tampered event cannot double-credit an order.

No system is absolutely secure. If we ever believe your data has been accessed without authorization we will notify affected customers promptly and in compliance with Texas breach-notification law (Tex. Bus. & Com. Code § 521.053).

6. Your choices

Access / correction. Email us and we will give you a copy of the order data we hold for you, or correct anything that is wrong.
Deletion. Email us and we will delete to the extent we lawfully can.
Unsubscribe from non-transactional email. Click the unsubscribe link in any non-transactional email from us. Transactional emails (your receipt, your magic-link, condition-disclosure confirmation) cannot be unsubscribed from because they are part of the service you purchased.
What's in the frame of your photos. Photos you upload may incidentally include faces visible through windows, license plates in driveways, mail with names, or other personal information. Crop or blur before upload if you want to remove them; we will not edit submitted photos for you.
Do Not Track. Most browsers offer a "Do Not Track" setting. We do not run advertising trackers regardless of that setting, so there is nothing to change in our behavior.

7. Texas-specific notes

Property Tax Rebel is organized in Texas and operates under Texas law. Texas residents have the specific rights described above. We do not sell personal information as that term is defined under any state law, so no CCPA/CPRA-style opt-out is needed.

Under Texas Government Code § 552.137, an email address provided to a governmental body (such as HCAD) is confidential and not subject to public disclosure except with consent or as otherwise allowed by law. When you submit Form 50-132 to HCAD you are submitting your email to a governmental body; that confidentiality is HCAD's responsibility. Our handling of your email is governed by this Privacy Policy.

8. Children's privacy

Property Tax Rebel is a tool for adult property owners filing their own protest. It is not directed to children under 13, and we do not knowingly collect information from children.

9. Changes to this policy

We may update this Privacy Policy. Material changes will be flagged on the website and emailed to customers with active purchases. The version that governs your use of the site is the one in effect on the date you interact with us.

10. Contact

Questions about this Privacy Policy: rebel@propertytaxrebel.com

For legal notices: rebel@propertytaxrebel.com

A physical mailing address for legal notices is available on request to the contact email above.