Effective and last updated: October 24, 2026
UrbanKit Studio LLC, a Texas limited liability company ("UrbanKit Studio", "we", "us", "our"), provides web-based planning and property-research tools such as public-notice radius mailing lists, Avery® label PDF generation, and parcel lookups against public county records (the "Service"). This Privacy Policy explains what information we collect, how we use it, and your choices.
In short: the property data the Service shows comes from public government records and is served as-is. We do not build profiles or dossiers on people, and we do not sell your personal information. Most of the personal data we hold is what you choose to give us: your email when you sign up, subscribe (including at the optional prompt before some free-tool downloads) or ask us to add a county; your name, email and message when you contact us or send feedback; your basic profile from Google or GitHub if you sign in with one; and payment details, which our payment processor handles, if you buy a paid plan. Using the Service also produces technical data. Your IP address reaches our hosting and security providers and is used for a short time to rate-limit requests. Our hosting provider's analytics records page visits. In some tools, the addresses and parcel numbers you look up pass through our servers. Each of these is described below.
Important: Please avoid uploading or entering sensitive personal information. Urban planning data can include addresses and owner names; treat that as personal data.
When you look up a parcel, the property-owner names, mailing addresses, and related fields you see come from public government records — county assessors, GIS departments, and similar public sources — which publish this information themselves. This is publicly-available information, and we serve it as-is and largely pass-through from the source.
We do not aggregate these records into profiles or dossiers on individuals, and we do not enrich them with non-public data. Paid plans charge for access to our lookup tools and API, which can return owner names and mailing addresses where the county publishes them, and, under a signed Team or Enterprise agreement, for extracts we prepare from these records. Customers must use what they receive lawfully and as our Terms allow. Customers pay for that service, not for ownership of the records. The Service is a directory and a thin client that helps you reach records the government already makes public.
Removal requests: If your name or home address appears through the Service and you want it hidden, email contact@urbankitstudio.com. We act on any written request. If you can, include the county and the parcel address or parcel number; if you cannot, tell us your name and home address and we will find the parcels. Within 10 business days we will hide the owner name, addresses and parcel number for every parcel we find at that home address in our tools, API and MCP server, leave them out of any extract we deliver after that, and tell you when it is done. If you are a federal or state judge, court employee, prosecutor, public defender, law enforcement or corrections officer, election official, or another person whom a federal or state law protects from having a home address published, or you are an authorized agent or government office acting for one, say so in your request: we will then hide the records within 72 hours of receiving it, stop including them in the owner results and extracts we deliver, help you find any other place they appear on our site, and confirm in writing. Where a law sets a different deadline or process, we follow that law. The record itself comes from the county, so it can still appear on the county's own website, and we will tell you which office keeps it.
The Service may accept CSV and GeoJSON files and may ask you to enter addresses for geocoding. In the free browser tools, files you upload are processed locally in your browser and are not uploaded to our servers: CSVs you map into labels, GeoJSON you upload for a radius, and the PDFs and CSVs you generate stay on your device.
Some tools are backed by our own API rather than running purely in your browser: bulk enrichment, auto-county radius lookups, and the parcel atlas API and MCP server. For those, the addresses or parcel you enter are sent to our servers so we can run the query against the relevant public county endpoint, and we may cache the county's response for up to 7 days for reliability and billing. We do not use those queries to build profiles of you or of the properties you look up, and we do not sell them.
If you create an account, we store the email you sign up with and your plan/subscription state (see Payments below). Accounts and application data are hosted with Supabase, a US-hosted database and authentication provider. If you sign in with Google or GitHub, that provider tells us your email address and basic profile details (such as your name and profile picture), which our authentication provider stores with your account. When you create an account with an email address, we check that its domain can receive mail by asking Google Public DNS; only the domain is sent, never the full address.
We use Vercel Web Analytics and Vercel Speed Insights, provided by our hosting provider, on every page of the site, including the free tools. They record page views with the page address, which can include its query string (on some tool links that carries an address you looked up), along with the referring page, browser, operating system, device type, approximate location derived from your IP address, and page-speed measurements; Speed Insights measures about half of visits. Vercel does not set cookies for these and identifies a visitor only by a hash it discards after 24 hours. We use these reports in aggregate to improve the Service.
First-party product telemetry, on account pages and in the client workspace app only. To diagnose problems and see which features work, the Service records a small set of product events in our own US-hosted database (Supabase). On this website it happens on the signed-in account and admin pages and nowhere else; the client workspace app keeps a separate log, described under Client workspaces. The public pages and the free browser tools send no events to this system (our hosting provider's analytics, described above, does count page views there). That is enforced in code by a single route check every event must pass, and a test in our repository fails the build if a public page ever gains one. One thing is counted outside that system: when a lookup names a county, we add to a per-county tally, described under Third-party services below. It holds no address, no IP address, no account and no record of an individual lookup. On the account pages the events recorded are: page views, account actions such as copying an API key or starting or returning from checkout, and client-side errors. Each event carries the page path (never the query string), a random session identifier, and your account id. It never includes the contents of your files, your lookups or your searches, and it is never sent to or shared with a third-party analytics service (error reports from the workspace app go to Sentry, described under Client workspaces). These records are visible only to UrbanKit Studio, are used for debugging, support, and product decisions, and are kept in that database until your account is deleted; no shorter retention period is set today.
Our hosting provider (Vercel) receives standard request information when you use the Service, including your IP address, the page or API address requested with its query string, your browser's user agent, and timestamps, and keeps it in short-lived request logs. Our database and authentication provider (Supabase) keeps similar logs for sign-in and database requests. We use your IP address to rate-limit requests, as described under Rate limiting and caching below. We may also use the approximate location derived from your IP address to restrict access from countries and regions under comprehensive U.S. sanctions. We do not store that location with your account. When you rotate or revoke an API key, we record that action with your IP address in our audit log, which also records billing and account actions with your account id. We use these logs for security, reliability, and troubleshooting.
When you use our contact page, the Teams inquiry form or the feedback button, we receive what you type (your name, email address, message, and for the Teams form your organization type) and send it to our own inbox through our email provider, Resend. Our email function logs your name and email address when it sends the message. We use it to reply to you and keep it in our inbox for as long as we need it to handle your request.
Our API stores short-lived counters in Upstash, a hosted Redis service, to limit how many requests one visitor can make. Each counter is keyed to your IP address (for some checks, the network part of an IPv6 address) and expires within about two days. Upstash also holds the API caches described above: county responses for up to 7 days and Census geocoding responses, keyed by a one-way hash of the address and including the matched address, for up to 30 days.
For organizations that hire us to monitor property ownership across a list of sites (for example, a public agency with a list of regulated facilities), we run a private client workspace. Unlike the free tools, a workspace keeps data on our servers, in the same US-hosted database (Supabase): the site list the client gives us, with the identifiers, addresses and other columns the client includes; what county public records said about each site's owner of record when we read them; the notes that workspace members and our operators write; the monthly registers we build and email to the client through Resend, the email service named below, which are stored as files in a private storage area with the same database provider; the email addresses of the client's members and of the people the registers are sent to; and an append-only log of workspace activity, including each time one of our operators opens the workspace. Workspace invitations are sent by our authentication provider. The workspace app also records client-side errors and a small set of product events (the page path and your account id) in that database; no retention period is set for that log today, and it is not removed when an account is deleted. The app sends error reports, with identifiers and free text scrubbed and no session recording, to Sentry, a US-hosted error-monitoring service. Only the client's members and our operators can see a workspace. We keep this data while the workspace is active. When an engagement ends, the workspace is closed rather than deleted, its activity log cannot be edited, and anything further is set by the client's agreement with us.
If you use a geocoding feature, the address you enter is sent to a geocoding service to return coordinates and match details. There are three paths. In the API-backed tools (bulk enrichment, auto-county radius lookups and the parcel atlas API and MCP server), our servers relay the address to the U.S. Census Bureau's geocoding service, so the address you type reaches us on the way. We cache the Census response for up to 30 days, and that cached response includes the address the Census Bureau matched. Caching also makes repeat lookups faster and sends fewer requests to the Census service. The Owner Lookup and Find My Parcel Number pages also relay the address through our servers to the Census Bureau; we keep no copy of that response and record only the county it fell in, in the tally described below, though the address can appear in our hosting provider's short-lived request logs. In the other browser tools, the request goes straight from your browser to the service and does not pass through our servers: the Radius Notice address box uses the Census Bureau's geocoding service (a paid auto-county radius lookup then asks again from our servers for the billed ring center), and the zoning case pages that offer an address search use OpenStreetMap's Nominatim service or, for New York City, NYC Planning Labs GeoSearch. Each service may log the request under its own policies; please review the Census Bureau's Terms of Service, the OpenStreetMap Foundation's Nominatim usage policy and NYC Planning Labs' terms for more information.
We also keep a count of which counties people look for, so that we know which counties to add next. The tally is one row per county rather than one per search: a public five-digit Census county code, that county's name and state, a running count, and the first and last time that county came up. It holds no address, no IP address, no account and no record of an individual lookup.
You can also ask us to add a county we do not cover yet. A request holds the county you name and anything else you choose to give us: an email address, a note, and a link to the county's own data. It also records where the request came from (our website, an AI agent using our MCP server, or our REST API) and whether the software that sent it looks like a web browser or an automated agent; we do not keep the user-agent string itself. We use the email address only to tell you when that county ships. We store the request where only our own server can read it, never in the anonymous county tally above; the tally counts a request only when it names an official Census county, once, under that county's Census name and never under text you typed. To stop the same request being sent over and over, we keep a keyed one-way hash of your IP address that changes every day, stored with the request. We delete each request, with its email address, note, link and hash, one year after it was sent; the deletion sweep runs once a day. Backups kept by our database provider can hold a deleted request for the length of its backup window.
The Service uses the open-source MapLibre library and loads map tiles from OpenStreetMap. When your browser requests map tiles, the tile host may receive limited technical data (such as IP address and browser details), as with any web request. We do not embed a paid or proprietary basemap.
When you run a free parcel lookup, your query goes directly from your browser to the relevant public county or government endpoint (for example, a county ArcGIS® REST service). That source may log the request under its own policies. In a county where a parcel is withheld on a legal notice (or, for a layer whose county we do not know, while a parcel in its state is withheld, or any parcel when we do not know its state either), the page also sends the county code and the parcel numbers of the results it is about to show to our server, which answers only which of them to hide; names and addresses are never sent, and the parcel numbers are not stored or logged. The ArcGIS-to-GeoJSON converter runs the same check, under the same conditions, on the parcel numbers it downloads. For the API-backed tools described above, the query is routed through our servers instead, and the county's response may be cached for up to 7 days for reliability and billing, and the county remains the system of record. Property reports go straight from your browser to the city's open-data portal, which may log the request under its own policies, and do not pass through our servers.
The newsletter form in the site footer uses Cloudflare Turnstile, so Turnstile loads on every page except the Terms, this policy, the advertising page and the articles. It also loads on the client workspace sign-in and protects sign-in, the contact, feedback and county-request forms, and the optional email prompt before a free-tool download. Turnstile evaluates browser signals, such as your IP address and browser details, to tell humans from bots without showing a puzzle in most cases. Cloudflare processes that data under its own privacy policy. When you submit a protected form, we or our authentication provider send the resulting token, and for some forms your IP address, to Cloudflare to check it; we receive a pass/fail result.
The client workspace app sends error reports to Sentry, a US-hosted error-monitoring service, with identifiers and free text scrubbed and no session recording, as described under Client workspaces. The public pages and the free browser tools send nothing to Sentry.
If you purchase a paid plan, payments are processed by Stripe, a US-based payment processor. Stripe collects and processes your payment details (such as card information) under its own privacy policy. We do not receive or store your full card number. When you start checkout we send Stripe the email tied to your account so it can create your customer record, and for pay-per-use plans we report your usage to Stripe under that customer record. We retain only limited billing and subscription information needed to provide the paid service (for example, your plan, status, the email tied to your account, and Stripe's customer and subscription identifiers).
The Service does not currently display third-party advertising and does not set advertising cookies. If we introduce advertising in the future, we will update this policy first to describe the provider, the cookies or identifiers it uses, and how you can opt out. One free tool links to Amazon through our Amazon Associates account. If you follow that link, Amazon may set cookies and record your visit and purchases under Amazon's own privacy notice, and we may earn a commission. We receive no information about you from Amazon.
You can subscribe through the signup form in the footer or on the Parcel REST API Atlas page. Three free tools also offer it before a download (CSV to Labels, the Parcel Lookup PDF export, and the Radius Notice GeoJSON export). The email is optional there: skip it and the file still downloads. If you give it, you are subscribed to this newsletter. Either way your browser remembers your choice so it does not ask again. You can unsubscribe at any time, as described below.
The email address you enter. We do not require a name. We tag most submissions with the page they came from (for example, "footer" or "parcel-atlas") so we can see which placements work, and we record when you signed up and the contact reference our email provider gives your address. The address also appears in our email function's logs, which our database provider keeps for a limited time.
We send about one to two emails a month, when a new tool ships or a major article goes up. We do not run drip sequences, and we do not sell your address or share it with anyone for their own marketing.
Separately from the newsletter, we send account email through Resend: a welcome email when you start a paid plan, a reminder a day before a paid trial converts, and, if you asked us to add a county and gave an email, a note when it ships. Sign-in codes are sent by our authentication provider.
Email addresses are stored with Resend, a US-based transactional email provider, in an audience scoped to UrbanKit Studio. Resend's privacy policy applies to data stored on their platform, and Resend remains the authority for your subscription status — including unsubscribes.
We also keep our own copy of the subscriber list in our US-hosted database (Supabase): the email address, the page it was submitted from, the provider's contact reference, and signup timestamps. We keep this mirror so we can report signup growth and attribution without widening access to the email platform itself. It is locked to administrative access only, is never used to build recipient lists (those always come from Resend, which knows who has unsubscribed), and is removed on request along with your Resend record.
Every email includes a one-click unsubscribe link. You can also email contact@urbankitstudio.com and we will remove you within one business day.
Your browser's local storage keeps a few things for you on your device: the email you gave at a download prompt, or that you skipped it (so we do not ask again), your API key if you choose to have a tool remember it, your sign-in session if you have an account, and display preferences such as theme and language. On account pages your browser also holds a random session identifier for the product telemetry described above, for that browser session only. These stay on your device until you sign out or clear them in your browser settings; the email and API key are sent to us only when you use them.
For signed-in accounts and metered (pay-per-use) features, usage is also counted on our servers — that server-side ledger is what makes your plan limits and any usage-based billing accurate, and it is retained as part of your billing records. A row is written for every request to our developer API that passes the rate limit, including requests that carry no API key; those rows name no account, because there is none to name.
That ledger also records, for a request we could not answer, the five-digit Census county code the request named — either the code an address resolved to, or the code you sent us directly. We use it to see which counties people look for that our atlas does not yet cover, and build those next. It is a public county code, never your search text, the matched address or the county name, and it is recorded only when we had no answer for you.
A request can also name a county by its state and county slug rather than by a code — for example the state "illinois" and the county "kane-county". When our atlas does not carry that county there is no code to record, so we keep a separate count of the slug pair itself: one row per county, a running total, and the first and last time that county came up. A slug is a fixed shape rather than free text — at most 64 lowercase letters, digits and hyphens, which the database enforces — and we count the pair only when the state part names one of the fifty states or the District of Columbia. Both parts are what you typed, and we treat them as a name for a county we do not yet cover and nothing more. Like the county tally above, the row holds no address, no IP address, no account and no record of an individual request.
UrbanKit Studio does not set cookies of its own and does not use advertising or cross-site tracking cookies. Your sign-in session and the few choices described under Usage tracking and limits are kept in your browser's local storage. Cloudflare Turnstile, which protects our forms from bots, runs in a frame served by Cloudflare and keeps a small entry in your browser's storage for that frame. Our hosting provider's analytics (Vercel Web Analytics and Speed Insights) do not use cookies or store anything on your device. Stripe's checkout and billing pages, and Google or GitHub sign-in, open on those companies' own sites and set their own cookies under their own policies. You can clear or block local storage in your browser settings; doing so signs you out and may stop the bot check from completing.
Activity on other sites. We do not collect information about your activity on other websites over time, and no advertising company collects it through our site. Some other companies do receive technical information, such as your IP address and browser details, when your browser contacts them while you use our site: Cloudflare for the bot check, which loads on the site's pages and the client workspace sign-in except the Terms, this policy, the advertising page and the articles; our hosting provider Vercel, including its analytics; OpenStreetMap for the map tiles in the Radius Notice tool; Supabase for sign-in; Google or GitHub if you sign in with them; Stripe on its checkout and billing pages; Sentry for error reports from the client workspace app; the city open-data portals that property reports query from your browser; and the geocoding services and county servers that some free tools query straight from your browser, described under Third-party services. Each handles that information under its own privacy policy. Because we do not track you across sites, we do not change what we collect when your browser sends a Do Not Track signal.
Files you upload to the free browser tools are processed in your browser and are not stored by us. For the API-backed tools, a county's response is kept for up to 7 days and the Census geocoding response, which includes the matched address, for up to 30 days. Rate-limit counters keyed to your IP address expire within about two days. Account, subscription, and usage-ledger records are retained while your account is active and as required for billing and tax records. Product telemetry is kept until your account is deleted. Our audit log has no set retention period and is not removed when an account is deleted. Hosting and provider logs are kept for the periods those providers set.
We limit access to the information we hold to UrbanKit Studio, the providers named in this policy and, for a client workspace, that client's members. The database tables that hold account, subscription, usage and workspace data use row-level security, API keys are stored only as keyed hashes, and the Service is served only over encrypted connections. Card details stay with Stripe. No system is perfectly secure, so we cannot promise that information will never be accessed without permission. If a breach affects your personal information, we will tell you as the law requires.
You can ask us what personal information we hold about you, and ask us to correct it, delete it, or send you a copy. Send the request through our contact page or to contact@urbankitstudio.com. We may need to confirm the request comes from you, for example by asking you to reply from the email address on your account. We respond within 45 days.
We may keep information we must keep by law, such as billing and tax records, and information we need to resolve a dispute or enforce our Terms; if that applies, we will tell you what we kept and why. Deleted information can remain in backups and in our providers' logs for a limited time before it is overwritten. If we decline a request, you can ask us to reconsider by replying to our answer. We will not treat you differently for making a request.
You can unsubscribe from the newsletter with the link in any issue, and cancel a paid plan from your account.
The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13.
We do not sell your personal information. We charge for access to our lookup tools and API, which return public property records, including owner names and mailing addresses where the county publishes them, and, under a signed Team or Enterprise agreement, for extracts of those records. Customers must use what they receive lawfully and as our Terms allow. We do not share your email or account information with third parties for their own marketing. The limited third-party processors we use (our hosting provider Vercel, our database and authentication provider Supabase, Upstash for rate limiting and caching, Cloudflare for bot protection and email routing, Resend for email, Stripe for payments, Sentry for error reports from the client workspace app, and Google or GitHub if you sign in with them) handle data only to provide the Service on our behalf.
UrbanKit Studio LLC operates the Service from Texas, for users in the United States. Pricing is in US dollars and the Service is not localized, geo-targeted, or marketed to the European Union or other regions. We do not intentionally target or solicit users outside the United States. If you access the Service from elsewhere, you do so on your own initiative and are responsible for compliance with your local laws.
We may update this Privacy Policy from time to time. We will update the "Effective and last updated" date above when changes are made. If we make a material change to how we use personal information you have already given us, we will tell you by email or through the Service before the change takes effect.
Questions, or a removal request? Use our contact page at https://urbankitstudio.com/contact, or email contact@urbankitstudio.com. Our mailing address is UrbanKit Studio LLC, 5900 Balcones Dr Ste 100, Austin, TX 78731, USA.