Privacy policy

Scope and operator

This policy covers Kelsey Cronin’s public community and real-estate website and its private, invite-only RRCP application, together called the “Service.” RRCP Development operates the Service. Questions or deletion requests may be sent to [email protected].

Information we collect

• Newsletter signup information: the email address a visitor submits, the event types, cities, and neighborhoods requested, an audit history of preference changes, the consent-text version, signup source, pending confirmation and delivery status, and signup, confirmation, or unsubscribe timestamps. Unconfirmed requests expire after 24 hours. The public form does not ask for a name, phone number, or home address.
• Google sign-in information: a stable Google account identifier, name, verified email address, optional profile image, and the authentication records needed to maintain the account and session.
• Service content: assistant conversations, tool requests and results, delivery records, and the provenance needed to explain how an assistant reply was produced.
• Technical information: session identifiers, IP address, browser user agent, request and correlation identifiers, timestamps, health state, and security or error logs.

The Service does not request access to Gmail messages, Google Drive, Google Calendar, contacts, or other Google Workspace content.

How we use information

We use this information only to:

• maintain the requested newsletter list, match subscribers to newsletters using their current choices, and send community events, local posts, and occasional real-estate information;
• authenticate the invited user and maintain a secure session;
• provide the private application and its assistant;
• run requested tools and deliver their results;
• keep security, reliability, troubleshooting, and AI provenance records; and
• comply with legal obligations and protect the Service.

We do not sell personal information, use it for targeted advertising, or use Google user data to determine creditworthiness. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

Hosted AI processing

When an authorized user sends an assistant message, the message, relevant conversation context, tool definitions and results, and a pseudonymous safety identifier are sent to the OpenAI API to generate a reply. Google credentials, the user’s email address, and the Google profile are not included in that inference request. RRCP requests that OpenAI not store Responses API application state. OpenAI handles API data under its own terms and business data privacy commitments.

Service providers and disclosure

We disclose information only as needed to operate the Service: Google provides authentication, OpenAI provides hosted AI inference, Cloudflare provides DNS and tunnel ingress, Resend provides newsletter delivery and delivery-status processing, and Amazon Web Services hosts the development deployment. We may also disclose information when required by law, to investigate abuse or a security incident, or to protect rights and safety. We do not permit these operational disclosures to be used for advertising by RRCP.

Retention and security

Server-side sign-in sessions are designed to expire after seven days. An active newsletter subscription remains until the subscriber unsubscribes or requests deletion. Expired newsletter confirmation requests and their delivery evidence may be retained for consent and abuse auditing. Account, conversation, tool, job, and provenance records remain until they are deleted or the development service is retired. Backups may retain deleted records for up to seven additional days. We use HTTPS, invite-only access, server-side sessions, restricted deployment secrets, and private database networking, but no system can guarantee absolute security.

Your choices

You may choose not to join the newsletter, sign in, or use the assistant. A public newsletter request becomes active only after the recipient deliberately confirms the emailed link. Newsletter messages include separate links to change event preferences or unsubscribe from all email. Changing preferences does not resubscribe an unsubscribed address. A subscriber may also request removal through the contact address above. An authorized user may revoke the application through Google Account permissions. To request access to, correction of, or deletion of RRCP-held data, contact the address above. Removing Google access does not by itself delete records already stored by RRCP.

Changes to this policy

We may update this policy as the Service changes. A revised policy will show a new effective date. If a change materially expands how Google user data is used, we will update the disclosure and obtain consent when required before using that data in the new way.