Privacy

Who we are

ATXr ([Legal entity: TBA]) is a property development decision tool for Victoria, currently in a private, invite-only beta. Questions about your information go to hello@atxr.app.

What we collect

• Your account: your email address and, if you choose to give them on the welcome screen, a display name and what best describes you.
• Your password is handled by our sign-in provider, Supabase Auth, which stores it only in hashed form. ATXr does not store or log it.
• What you create: the addresses you look up, the areas you search in Scout and the results returned, your deals, saved properties and shortlists, notes, and feasibility scenarios.
• Usage counts: how many lookups and searches you have used, and any credits, so plan limits work.
• Billing status: your plan and your Stripe customer and subscription references. Stripe is in test mode during the beta, so no real payments are taken. ATXr never receives or holds your card details.
• Security records: sign-in events (your email, your IP address stored as a hash rather than in plain text, and your browser type), used to stop abuse.
• Basic server logs on our server, such as IP address, the page requested, the time and your browser type.
• Cookies: the ones that keep you signed in, and one that remembers you have seen the welcome screen. No advertising or analytics cookies.

Why we use it

To run your account and show you your work, keep the service secure and stop abuse, apply plan limits and billing, answer you when you contact us, and improve ATXr during the beta.

Where it is stored

Your account and everything you create are stored with Supabase in its Sydney (Australia) region. Planning information (zoning, overlays, parcels) comes from Vicmap, the Victorian Government's spatial data, held on ATXr's own server; the addresses you look up are sent to that server to fetch it.

Who helps us run ATXr

• Supabase — database and sign-in.
• Stripe — billing (test mode during the beta); receives your email address when you open checkout.
• Resend — sends sign-in and account emails, so it receives your email address.
• Cloudflare Turnstile — the bot check on sign-up, log-in and password reset; Cloudflare sees your browser and connection details to tell people from bots.
• Have I Been Pwned — checks whether a new password has appeared in a known data breach. It never receives your password: only the first five characters of a one-way hash of it are sent.
• Our hosting provider — runs the server ATXr is hosted on.

Some of these providers may process information outside Australia.

What we don't do

We don't sell your information. We don't use advertising trackers or third-party analytics.

Your copy, corrections and deletion

Email hello@atxr.appto ask for a copy of your information, to correct it, or to delete your account. Deleting your account removes your deals, saved properties, shortlists and scenarios. We haven't set fixed retention periods yet; if anything has to be kept for a while (for example security records), we'll tell you what and why. The final policy will set out retention periods. Copies held by our providers (for example Stripe and Resend) follow their own retention rules; we'll ask them to delete what they can.

Beta data

While ATXr is in beta, we may need to reset data. We'll give you notice first so you can keep a copy of anything you need.