Privacy Policy

Ordus Property is a free suburb-level intelligence terminal for the Australian property market. This page describes what personal information we collect, why we collect it, and what we do with it. The short version: we collect your email so you can sign in, and we measure how the terminal gets used so we can improve it. We don't sell data and we don't run advertising trackers.

Ordus runs on the web, including a version for phone browsers, and as an app for iPhone and Android. On this page, "the Ordus mobile app" means both the phone version of the website and the iPhone and Android app. Where the two differ, we say so, and The iPhone and Android app describes what is particular to the installed app.

What we collect

• Email address: provided when you sign up for the full terminal. Used only to send sign-in links and, if you ask us, occasional product update emails. We do not use it for marketing without your explicit consent.
• Sign-in with Google or Apple: you can sign in with an emailed link, with Google, or with Apple. If you use Google or Apple, we receive from them your email address and an identifier for your Google or Apple account that does not change, and we keep those two things against your Ordus account so you can sign in the same way next time. When you sign in with Apple in the iPhone app, Apple also gives us a token for that sign-in; we keep it encrypted and use it only to ask Apple to end Ordus's access to your Apple ID when you delete your account. Nothing else from Google or Apple is stored: not your name and not your picture. The first time you sign in with Apple, Apple may also send the name on your Apple account; we do not keep it. If you use Apple's Hide My Email, the address we receive is a relay address that Apple forwards to your own inbox. Both are deleted with your account.
• Session cookie: set after you sign in so the terminal recognises your session. Strictly necessary; cannot be disabled if you want to stay signed in. The iPhone and Android app holds the same sign-in in the phone's secure storage instead of a cookie.
• Page views: which pages were loaded, when, and rough geography (country/region derived from IP at the edge). Collected by two tools: Cloudflare Web Analytics, which is cookieless and cannot identify you, and PostHog, described below.
• Product usage: what you do inside the terminal: which workspace you open, that you added a suburb (and which one), that you ran an estimate, that you created a share link, how long you were actively using the page, and what you typed into the screener's search box (which is also sent to Anthropic to turn it into filters, see Who we share it with). In the Ordus mobile app, that search text is recorded with any price and street address taken out and every other number hidden, except a postcode. This is stored against a random identifier held in a cookie in your browser. If you are signed in, we link that identifier to your account so we can tell repeat use from new visits.
• Session recordings: a replay of your visit reconstructed from page events: clicks, scrolling, and navigation between screens. We use these to find where the terminal is confusing or broken. See Session recordings below for what is excluded. Website only: the iPhone and Android app does not record sessions.
• Addresses you look up: an address you search in the Ordus mobile app is sent to our property lookup service to find the home. See Property lookups and your home.
• Homes you record as visited: if you are signed in, the address and date of each open you record visiting, kept against your account. See Property lookups and your home.
• Your first-launch answers: if you are signed in, your answers to the questions the Ordus mobile app asks when you start, and the suburbs, council areas and postcodes you pick, kept against your account. See Your first-launch answers.
• Questions you ask Ordy: if you are signed in, sent to Anthropic to write the answer, with a masked copy in our server log. See Ordy.
• Notification registrations: if you turn on notifications in the iPhone and Android app, a notification address for that phone, kept against your account with the phone's platform and the app's version. See The iPhone and Android app.
• Email-delivery logs: Resend retains delivery metadata (delivered/opened/bounced) for sign-in emails for up to 30 days. Used only for diagnosing delivery problems.
• Local experts enquiries: if you send an enquiry through the Local experts page: the name, email address, phone number and message you enter, the suburb you enquired about, your budget and timeline if you gave them, the page you sent it from, and a hashed form of your IP address that we use only to limit spam. If you are a buyer's agent asking to claim a suburb, the details you enter on that form (name, agency, email, phone, licence number, website and the suburbs you want).

We do not collect payment details or browser fingerprints. Outside the Local experts enquiry form, we do not collect names or phone numbers. We never collect the street address of a property you enter into My Property, and no usage event we record contains one. Where we record that you looked at a suburb, we store the suburb and postcode only.

Why we collect it

• To let you sign in: magic-link auth needs an email address and a session cookie. Signing in with Google or Apple needs the email address and the account identifier they send.
• To improve the product: usage data and recordings tell us which features get used, how long people actually spend in the terminal, where they get stuck, and which pages convert. We do not use any of it to build a profile of you, target advertising, or make decisions about you.
• To meet legal obligations: limited record-keeping (e.g. abuse investigations, fraud prevention) where required by Australian law.
• To connect you with a buyer's agent: an enquiry sent through the Local experts page is passed to the buyer's agent featured for that suburb so they can contact you about it. If no agent is featured, we hold the enquiry, use it to match you with a buyer's agent, and may email you about that match. We also count enquiries per suburb, because that count is how we decide what featured agents pay. A claim request is used to assess and respond to that request.

Who we share it with

Your data is stored and processed by these providers under their respective privacy policies:

• Cloudflare (Pages, D1 database, edge analytics): hosts the site, stores your user record, processes page-view analytics. Data is held in Cloudflare's Sydney (OC) region.
• PostHog: processes the product-usage data and session recordings described above. If you are signed in, PostHog also receives your email address so your activity can be linked to your account. PostHog stores this data on servers in the United States, so using the terminal means this information is disclosed overseas and handled under United States law. The iPhone and Android app sends PostHog the same kind of usage events, with the country and region PostHog works out from your IP address, and no session recordings.
• Expo: relays the iPhone and Android app's notifications to Apple and Google, which deliver them to your phone. Receives the phone's notification address and the notification itself, which names no address. Expo is in the United States.
• Apple and Google: if you sign in with them, they confirm your account to us as described above, under their own privacy policies. They also deliver the app's notifications. The app's maps come from Apple Maps on iPhone and Google Maps on Android; on Android, Google's map software sends Google technical details about the phone and how the map is used, such as the device model, crash reports and the IP address.
• Resend: sends sign-in emails and the Monday wrap-up of the homes you visited, and delivers Local experts enquiries. Receives your email address, the magic-link content, the homes listed in a wrap-up, and the content of any enquiry you send.
• Anthropic: provides the AI model behind Ordy and the screener's AI search. It receives the questions you ask Ordy, together with the conversation so far, a photo of a signboard or brochure you take in Ordy, and the text you type into the screener's AI search, and sends back the answer or the filters. Anthropic processes this in the United States. Under Anthropic's commercial terms it may not train its models on this content. Anthropic deletes what it receives within 30 days, unless its safety systems flag it under its usage policy or the law requires it to be kept longer. See also Anthropic's privacy policy.
• Featured buyer's agents: receive the enquiry you send them through the Local experts page: your name, email address, phone number, budget, timeline and message. They handle it under their own privacy policy.

We do not share, sell, or rent your data to anyone else. We do not use third-party advertising trackers.

Cookies

Ordus sets two kinds of cookie:

• A session token, after you sign in, so the terminal recognises your session. Strictly necessary.
• A PostHog analytics cookie, holding a random identifier that lets us tell one visit from another and recognise a returning visitor. Cloudflare Web Analytics remains cookieless.

We do not use advertising or marketing cookies, and we do not allow any third party to advertise to you based on your use of Ordus. The iPhone and Android app sets no cookies; what it keeps on the phone is described under The iPhone and Android app.

Session recordings

Some visits to the website are recorded so we can watch back how the terminal was used. The iPhone and Android app does not record sessions.

A recording is not video and does not use your camera or microphone. It is a reconstruction of the page built from what your browser did: where you clicked, what you scrolled, and which screens you moved between.

Two things are deliberately excluded:

• Everything you type is masked. Text entered into any field is replaced before it leaves your browser, so it never appears in a recording. The screener's search box is masked in recordings too, but what you type there is separately recorded as usage data, as described above, because knowing what people search for is how we decide what to build.
• The My Property workspace is excluded entirely. It is blanked out in recordings and clicks inside it are not captured, because it is where you enter a real street address. That address stays in your browser unless you create a share link for the property (see Property lookups and your home).

The phone version of the website follows the same rules. Its property page and its Ordy tab are blanked out in recordings and clicks inside them are not captured, as with My Property. Elsewhere on it, the rows that show one of your addresses or one of your questions (address suggestions, Your properties, Watching and Recent) are hidden or masked in recordings, and a tap on one of them is not captured. It keeps the address of the home you are looking at, and a question you send from the Home search box to Ordy, in the part of the page address after the # sign. That part is removed from the page address PostHog records with each usage event, so no address or question travels with an event.

Alongside a recording we capture your browser's console messages, which are the diagnostic notes the site writes to itself when something goes wrong. They contain error details, not anything you typed. We do not capture the contents of network requests.

Recordings are kept by PostHog for 30 days and then deleted automatically.

Property lookups and your home

The Ordus mobile app has a page for a single home. When you search an address, the app sends that address to our property lookup service, which finds the home and builds its estimate. The service does not write the address to a database or a log.

A home you save stays on your device. Saving one needs a free account, but the home, why you saved it and the bedrooms you entered are kept in your browser's storage on that device, not on our servers and not against your account. In the iPhone and Android app they are kept in the app's own storage on the phone instead, in the same way. The app looks each saved home up again about once a day to refresh its estimate. Your watchlist, recent searches and display settings in the mobile app are kept on the device in the same way. The exception is the suburbs, council areas and postcodes you pick when you first open the app: those are kept against your account, as described under Your first-launch answers, and later changes to your watchlist stay on the device.

Homes you record as visited are also kept against your account. When you take a photo of a signboard or brochure in Ordy, or tap "I'm at this open" on a home's page, and you are signed in, we keep that home against your account: its address, suburb and postcode, the date you visited, and whether it came from a photo or the button. We keep them so the app can list them under Visited in Me and so we can send you the Monday wrap-up, an email listing the homes you visited the week before. You can remove any visit in Me, and the wrap-up email can be turned off in Me or from the link in the email. Visits are deleted with your account. Our usage analytics record that you recorded a visit and the suburb, never the address. Without an account, a visit you record stays on your device.

To stop the lookup service being scraped, each request is counted against a scrambled (hashed) form of your IP address, combined with your sign-in session if you have one. The count holds no IP address and no session token. Each count is kept only until its window closes, at the end of the minute or of the day (UTC), and is then deleted. The same kind of count limits the screener's AI search and Ordy.

If you create a share link for a My Property estimate in the desktop terminal, the link stores what you entered: the address, purchase year and price, property type, bedrooms, land size, whether it is your home or an investment, and your loan and tax rate if you gave them. It is stored on our servers against your account, and anyone with the link can see it. Email us to have a link deleted. Deleting your account deletes all of your share links.

Your first-launch answers

When you first open the Ordus mobile app, it asks a few questions: what brings you to Ordus, how soon you are looking to buy, a rough price range, and which suburbs, council areas (LGAs) and postcodes you want to follow. Every question is optional, and the app works the same if you skip them all. The timing and price questions are only asked if you say you are buying or investing.

The answers you give are kept against your account: the reasons you chose, the timeframe, the price range and the places you picked. The price range is kept as one of five bands, such as "$1M to $1.5M", never as an exact figure and never next to an address. We use the answers to set up your Home screen, to suggest suburbs that fit, and to choose the questions Ordy offers you to start with. Because they are kept against your account, the places you picked come back when you sign in on another phone or reinstall the app.

The price range is never sent to our usage analytics. They record the reasons you chose and the timeframe, and for the price question only whether you answered it. The price range and the timeframe are not sent to Ordy or to Anthropic, and no answer is written to our server logs. We do not sell or share your answers.

You can change your answers at any time under Me, Your answers. Remove a place there to drop it, and if you no longer say you are buying or investing, the timeframe and price range are cleared. To clear everything, email us and we will do it. Your answers are deleted with your account.

Ordy

Ordy is the assistant in the Ordus mobile app. You ask it about a home, a price guide, a suburb or the market, and it answers from Ordus's data.

Ordy's written answers need a free account. When you are signed in, your question is sent to Anthropic with the conversation so far: your earlier questions in it, Ordy's earlier answers, and the figures Ordus looked up for them. When a question is about your own homes, Ordy also sends the homes you have saved (the address, why you saved it, its estimate, its last sale and bedrooms) and your watchlist. Anthropic's model chooses which of Ordus's figures to look up and writes the answer. Without an account, Ordy answers with figures only and nothing is sent to Anthropic, except a photo of a signboard or brochure you choose to take (below).

A photo you take of a signboard or a property brochure is sent to our service and to Anthropic to read the address and property details on it; the photo is not stored by us. Our server log for a photo keeps only what it showed (a sign, a brochure or a listing on a screen), whether it gave the rooms, the suburb and postcode read from it, and how long the read took; never the photo, the street, the price or the text on it. Without an account you can read three photos a day.

The sale prices, medians and estimates in an answer come from Ordus's data, not from the model. Ordy checks the numbers in each answer against that data and what you told it, and leaves out any sentence it cannot match. When Ordy gives its own read of a price, it is a round figure close to the sale prices it looked up.

Our server keeps no copy of your conversation. Its log keeps the first 80 characters of each question, with any street address replaced, every digit replaced, and email addresses and phone numbers removed, so addresses, prices and phone numbers do not appear in it. A suburb name you type can. The log also records which AI model answered, how long the answer took and whether it worked. It never records Ordy's answer.

Your conversations are kept on your device only, in your browser's storage (in the iPhone and Android app, the app's own storage on the phone): the last 30, each for up to 90 days. The last 8 questions you asked from the Home search box are kept on the device too, to show under Recent. "Clear Ordy history" in Me deletes both.

Each account can ask Ordy a limited number of questions a minute and a day. These are counted as described under Property lookups and your home.

The iPhone and Android app

The app does what the phone version of the website does, and everything above applies to it. This section covers what is particular to the installed app.

• What stays on your phone: your saved homes, your watchlist after you first set it up, recent searches and questions, your Ordy conversations, visits you record without an account, answers you give before you have an account (until you sign in), the name you enter in Me to sign offer drafts, and your display settings, including the appearance you choose. They are kept in the app's own storage on the phone, not on our servers. Deleting the app removes them.
• Your sign-in: the app keeps your session in the phone's secure storage (the iPhone Keychain or the Android Keystore) until you sign out, or until it goes 90 days without being used. A sign-in link we email you can open the app directly, and the code in it works once.
• Camera and photos: the app asks for the camera only when you tap the camera in Ordy to photograph a for-sale sign or a brochure. You can choose a photo from your phone instead: the phone's own photo picker gives the app only the photo you choose, and the app never reads your photo library on its own. The app makes the photo smaller on the phone and sends it once to be read, as described under Ordy. We do not keep it.
• Location: the app does not ask for or read your phone's location. A visit is recorded from the home you name or photograph, not from where your phone is, and the maps show the area you choose.
• Notifications: the app asks to send notifications only when you choose to turn them on. If you do, it sends us a notification address for that phone, made by Expo from the one Apple or Google gives the phone, with the platform (iPhone or Android) and the app's version. We keep it against your account and use it only for the Monday note about the homes you visited at the weekend. The note names no address. Signing out stops notifications to that phone, deleting your account deletes the address, and you can turn notifications off in your phone's settings at any time.
• Usage analytics: the versions of the app in the App Store and Google Play send PostHog usage events like the website's: which screens you open, that you added a suburb, that you ran an estimate, and what you typed into Discover's search. Before you sign in they are kept against a random identifier the app makes; once you sign in, against your account, with your email address. No usage event has a field for an address, a web link or a price, and Discover's search text is recorded with any price and street address taken out and every other number hidden, except a postcode. The app records no sessions, captures no screens and uses no advertising identifier. You can turn usage analytics off in Me, under Share usage data: from then on the app records no usage events, until you turn it back on.
• Agency pages: when you open an agency's listing from Nearby, the agency's own website opens in a browser sheet over the app, and what that site collects is under its own privacy policy. We add "utm_source=ordus" to the link so the agency can see the visit came from Ordus. Our usage analytics record that a page was opened and for which agency, never the address or the link.
• Help: questions about the app are answered at ordusproperty.com.au/support.

Opting out

Analytics and recordings load from PostHog's servers, so any browser extension or built-in setting that blocks third-party analytics (uBlock Origin, Privacy Badger, Brave's shields, Firefox strict tracking protection) will stop them, and the terminal works normally without them. In the iPhone and Android app, turn off Share usage data in Me and the app stops sending usage analytics. If you would rather we deleted what has already been collected about you, delete your account (see Deleting your account) or email us and we'll remove it.

Retention and deletion

We keep your email and anything kept against your account for as long as the account exists. Session recordings expire on their own after 30 days. Cloudflare's page-view counts cannot be deleted per person because they are never linked to you in the first place.

Deleting your account

You can delete your account yourself, at any time: in the Ordus mobile app under Me, or on the web at ordusproperty.com.au/delete-account, which works without the app. You confirm by typing your email address. Deletion is immediate and cannot be undone, and we send one email to confirm it. Deleting the app from your phone does not delete your account.

What is deleted, at once:

• your user record and every sign-in session, on every device;
• your saved chart views and the share links you created, with the record of who opened them;
• the homes you recorded as visited, and your Monday wrap-up setting;
• your first-launch answers, and the suburbs, council areas and postcodes you picked;
• your Google and Apple sign-in links. If you used Sign in with Apple, we also ask Apple to end Ordus's access to your Apple ID. In the iPhone app, Apple may ask you to confirm that first. Where we cannot do it, for example if you only used Apple on the website, you can remove Ordus yourself in your Apple ID settings, under Sign in with Apple;
• the mobile app's notification registrations;
• any record of our emails to your address, including replies and notes.

What is kept: counts that do not identify you. A Local experts enquiry you sent stays only as a count for its suburb; your name, email address, phone number, message and the rest of what you entered are removed from it. We also keep your email address on our suppression list, which is the list every email we send is checked against, so that we never email you again. Usage history held by PostHog is deleted within 30 days, and Resend's delivery logs expire on their own within 30 days.

On your device: when you delete the account in the mobile app or in this browser, the app also clears what it kept on the device for your account, namely your saved homes, your watchlist, your visits, your first-launch answers, your Ordy conversations and your recent questions. Anything left on another phone or browser can be cleared there in Me, by deleting the app, or by clearing this site's data in your browser.

If you cannot sign in, write to hello@ordusproperty.com.au from the email address on the account and we will delete it for you.

Your rights

Under the Privacy Act 1988 (Cth) you have the right to:

• Ask us what personal information we hold about you
• Ask us to correct it
• Ask us to delete it
• Lodge a complaint with the Office of the Australian Information Commissioner if you think we've handled your data badly

Email hello@ordusproperty.com.au with any of the above. We'll respond within 30 days.

Property data on Ordus

The suburb-level price, sales-volume, and demographic data on the site is aggregated from public and private sources (NSW Valuer General bulk releases, ABS Census, SQM Research, RBA statistics). It does not contain personal information about you or the current owners of any property. Where individual sale records are referenced, they are already published as public data by the source agency. The sale history and estimate for a single home are built from the NSW Valuer General's public sales records, with bedrooms and similar details from public listings where Ordus has them. An estimate is a model's output, not a valuation. We hold nothing about who owns a home now.

Children

Ordus is not intended for users under 13. We do not knowingly collect data from children under 13.

Changes to this policy

If we change anything material, we'll update the "last updated" date at the top and, where appropriate, notify signed-in users by email. Continued use after a change means you accept the new version.

Contact

Privacy questions, deletion requests, or anything else: hello@ordusproperty.com.au.