Who we are

WhoOwnsYourHVAC.org is a free public resource that helps homeowners research HVAC contractor ownership. We are operated by an individual based in Colorado, reachable at admin@WhoOwnsYourHVAC.org.

Data we collect

We collect information you submit, limited service and security data, and optional analytics only if you explicitly accept.

Information you provide

Ownership corrections and company nominations may include a company, city, owner or parent-company name, evidence, and an optional submitter email address. Sponsorship inquiries include the organization, contact name, email address, selected tier, and optional message. These details are submitted only when you use the relevant form.

The former homeowner matching and referral form is retired and no longer creates new leads. Records from earlier use may still contain a homeowner’s name, email, optional phone number, project details, region, and matched contractor list. A person with an existing feedback link may submit contractor-contact status, outcome, issue categories, and optional comments.

Optional analytics

Google Analytics 4 and Plausible are not loaded unless you choose “Accept optional analytics.” If accepted, they receive limited pageview and interaction information such as a route without its query string and a small set of non-form event properties. Like any third-party script, their requests also expose connection data such as your IP address and browser/device metadata. We do not send search text, form contents, names, email addresses, phone numbers, or feedback-link tokens to analytics. Administrator, feedback, submission, sponsorship, and legacy match pages are excluded. Google advertising signals and ad personalization are disabled. Plausible is loaded in manual mode without automatic outbound-link tracking. If you reject or withdraw consent, the app stops future events, unloads the analytics scripts, and attempts to remove Google Analytics cookies.

Your analytics choice

Optional analytics remain off until you explicitly accept. Rejecting or closing the choice notice does not restrict the site, and continued browsing is not consent. The “Privacy choices” control in the public-site footer and the administrator area lets you change or withdraw your choice at any time. When your browser exposes a Global Privacy Control signal, it overrides a saved acceptance and keeps optional analytics off. A small first-party browser-storage value remembers your choice; it is not used to identify you.

How we use your data

We use submitted research tips and nominations to review ownership records and use sponsorship inquiries to respond to the sender. For historical homeowner-match records, we use the stored contact details only to administer those records, including follow-up and feedback where appropriate. We do not share research submissions with listed contractors as part of a referral process.

We do not use your personal information for advertising, profiling, or any purpose beyond reviewing your submission and responding when appropriate.

Who receives your data

Replit hosts the website and API and processes connection information needed to deliver and secure the service. Its infrastructure may receive your IP address, request path (including query strings), browser request metadata, and technical logs; platform log retention is controlled by Replit and is not set by this application. The application’s own request logs omit query strings. Replit Project Analytics is not used by the app. Replit may inject its optional analytics script when that Publishing setting is enabled; the app sets the script’s opt-out flag, but the Publishing setting must be disabled to prevent the script request itself.

A platform-set “GAESA” cookie appeared in a previously observed response. The app does not set it, and its exact purpose and retention are not verifiable from this project’s code; platform cookie behavior is controlled by Replit and its infrastructure providers.

When you view a map, your browser requests map tiles from OpenStreetMap tile services. Those services receive the request IP address and the map tile coordinates needed to display the area. Google Fonts are not used; the site uses system fonts.

A sponsorship inquiry is saved in the application database and sent to our administrative inbox through Resend, which processes the email on our behalf. Administrators may also send follow-up email through Resend to people with existing homeowner-match records; those emails can include a feedback or opt-out link. A research tip or nomination is saved in the application database for administrator review; the submission route does not send it to Resend.

Shopify is queried by our server for product information when you view the merch page and handles checkout if you proceed. Whop receives the plan and return URL only when you start a donation checkout; it then handles the donation checkout directly.

Data storage

Tips, nominations, sponsorship inquiries, correction reports, historical homeowner-match leads, and feedback are stored in the application’s private PostgreSQL database for administrator review and follow-up; they are not added to the public company-record catalog. Optional reply emails for ownership corrections are stored separately from correction evidence and review history. Administrator authentication uses a first-party session cookie that is HTTP-only, SameSite=Lax, secure in production, and lasts up to eight hours. The administrator interface also stores a reviewer display name in that administrator’s browser storage. You may request access or deletion by emailing the address below.

For abuse prevention, the API uses a client IP address as a temporary rate-limit key. The normal rate-limit window is 60 seconds and expired keys are periodically cleaned up. Request logs include request method, path, status, and request ID; feedback-token path segments are redacted in application logs. Replit’s infrastructure logs are outside the application’s retention controls.

How long we keep your data

The application does not automatically delete personal submissions or their review history. The administrator review queue flags closed personal inquiries after 12 months and retired homeowner lead records after 12 months from creation. If an older closed record has no recorded closure date, its creation date is used only as a review trigger and is identified as a proxy. An administrator must document a continuing purpose or preservation requirement to retain personal details, or approve a deletion review. Recording approval does not itself delete a record; no preexisting records are removed by this update. Research evidence and correction history are kept separate from optional reply contact details. Email, Replit hosting logs, and external checkout providers may have separate retention practices outside the application.

Your rights

You can ask what information we hold about you and request that it be corrected or deleted. We do not sell personal information. To withdraw analytics consent, use “Privacy choices” in the public-site footer or administrator area; Global Privacy Control also keeps optional analytics off.

To exercise any of these rights, email us at admin@WhoOwnsYourHVAC.org with the subject line "Privacy Request." We will respond within 45 days.

Children's privacy

This site is not directed at children under 13, and we do not knowingly collect personal information from anyone under 13.

Changes to this policy

We may update this Privacy Policy from time to time. The effective date at the top of the page will reflect the most recent revision. A policy update does not constitute consent to optional analytics; your separate privacy choice controls analytics.

Contact

Questions about this policy can be directed to admin@WhoOwnsYourHVAC.org.