1. Who we are
Hoosier Home Fix is an educational tool for Indiana tenants, published at hoosierhomefix.org. This policy describes our actual data practices. It is written to meet the notice, minimization, security, and consumer-rights standards that apply to a site like this under federal FTC rules, the Indiana Consumer Data Protection Act (IC 24-15, the “ICDPA”), Indiana’s breach-notice statute (IC 24-4.9), CAN-SPAM, and COPPA.
Published by the operator of hoosierhomefix.org, a personal educational project. Contact the operator with the request form below. Do not send a Social Security number or a copy of an ID. A physical mailing address will be listed here before any paid promotional email is sent.
This site is not a law firm. Using it does not create an attorney-client relationship. This policy is not legal advice to the operator; counsel should review it before a large-scale public launch.
2. When these laws apply
ICDPA (IC 24-15). Indiana’s consumer privacy law applies to controllers that do business in Indiana (or target Indiana residents) and that process personal data of at least 100,000 Indiana consumers in a year, or 25,000 consumers if more than half of revenue comes from selling personal data. We do not sell personal data. Even if this project is still below those numeric thresholds, we honor the same consumer rights (know, access, correct, delete, portability, opt out of sale and targeted advertising) as a matter of practice, usually immediately through your account.
IC 24-4.9 (breach notice). If unencrypted personal information as Indiana defines it (typically a name plus SSN, driver’s license, or financial-account number) is acquired by someone who should not have it, Indiana residents must be notified without unreasonable delay, not more than 45 days, and the Attorney General must be notified when the statute requires. We do not ask for SSN, driver’s license, or bank numbers. Do not type them into any form.
Federal. We follow FTC rules against unfair or deceptive privacy claims: this page must match what the software actually does. Reminder email, if you opt in, is designed to meet CAN-SPAM (accurate subject, identification, working opt-out). We do not knowingly collect data from children under 13 (COPPA). This tool is for adults 18 or older.
3. Information we collect — and where it lives
We collect only what a step of the tool needs.
- In your browser only (not on our servers): the notice draft, the damages worksheet, lease text you upload for the claims packet, and exhibit photos — unless you sign in (autosave) or create a resume link. Clearing site data deletes the browser copy.
- Anonymous public totals: Indiana county of a completed notice; repair-outcome reports (county, status, days, rent-credit amount); site-feedback ratings and feature votes; impact-survey checkboxes; willingness-to-pay answers for coming-soon extras (yes/maybe/no per extra, optional comment); QR-code opens (which poster or flyer, and a timestamp). No name, email, phone, IP, or street address is stored with those totals.
- Optional account (sign-in required): email, password hash or Google/X sign-in identifier, notices you save, status updates, reminder consent, and inbox messages. Scoped to your user id. Signed-in drafts autosave so you can finish on another device.
- Resume link (optional, guest or signed-in): if you ask us to email or copy a finish-later link, we store the draft for 14 days behind a secret token (we keep only a hash of the token). Anyone with the link can open the draft. The link expires; do not post it.
- If you ask us to physically mail a letter: name and addresses needed by the print-and-mail vendor and USPS.
- ZIP lookup: the ZIP you type is sent to public geocoding services to find the county. We do not store the ZIP with your name.
- Technical logs: IP address, browser, and page for security, kept briefly.
Household questions (children, older adults, disability) are optional. If you answer them, they appear in your letter and optional account copy. They are not added to public stats. We treat disability-related answers as sensitive and do not use them for advertising or research datasets.
4. Why we process data (purpose limitation)
- To generate, send, and let you track a repair notice you requested.
- To show anonymous county and outcome totals that demonstrate the tool is used.
- To email follow-ups only if you opt in, and to stop when you opt out.
- To secure the site and debug failures.
We do not use this data to train advertising models or to score tenants for landlords.
5. Sale, sharing, and targeted ads
We do not sell personal information as Indiana and other U.S. state laws define a sale. We do not share it for cross-context behavioral advertising. We do not profile you to deny housing or credit. If your browser sends the Global Privacy Control (GPC) signal, we treat it as a “do not sell / do not share” request — which matches our default.
6. Who else may process data (processors, not buyers)
- Hosting and database (including Neon when deployed, and a local preview database).
- Sign-in: this app’s Better Auth store; Google or X only if you choose those buttons (via the Grok auth broker).
- Print-and-mail (Lob) if you choose physical mail; USPS to deliver the envelope.
- Payment processors if you pay postage or leave a tip: Stripe (cards, and PayPal when the operator has enabled it on Stripe) and/or PayPal Checkout. They receive the amount and whatever email they collect. We do not store full card numbers. The notice is not mailed until that processor reports payment succeeded.
- Public ZIP/county lookup (Zippopotam and FCC census).
- Email delivery, only if you opted into reminders and a mail service is configured.
Processors get only what that job requires. We may disclose information if required by law, a valid court order, or to protect someone’s safety.
7. Cookies
Signed-in sessions use an essential cookie (or a preview bearer token). We do not use advertising or third-party tracking cookies. A cookie banner is not required for this essential use under Indiana law; this paragraph is the notice.
8. Email reminders (CAN-SPAM)
Reminder email is off until you check a consent box on your account. Messages are about your own notice (transactional follow-up), identify Hoosier Home Fix, and tell you how to stop. Opt out on your account or with the form below. We honor opt-out as soon as the request is processed and do not sell the address. Commercial or promotional messages, if any are ever sent, will include a physical postal address as CAN-SPAM requires.
9. Children (COPPA)
This tool is for adult tenants or adults acting for a household. We do not knowingly collect personal information from anyone under 13. Do not create an account for a child. You must be 18 or older to sign up or send a notice.
10. Security and retention
Passwords are stored hashed. Account notices are queried only for the signed-in user. The site is served over HTTPS in production. No method is perfectly secure.
- Browser drafts — until you clear them.
- Account notices — until you delete the account or the individual record’s purpose ends.
- Anonymous totals — kept to show public statistics.
- Mailing records — long enough to prove a letter was sent, then as backups require.
11. Your rights (ICDPA-style)
Indiana residents (and anyone using this tool) may: know whether we process personal data about them; access it; correct inaccuracies they provided; delete it; obtain a portable copy; and opt out of sale, targeted advertising, and profiling in furtherance of decisions that produce legal or similarly significant effects. We do not sell, target-advertise, or so profile.
How to exercise: sign in and use Download my data or Delete my account — those run immediately. If you cannot sign in, file a request below. We will complete authenticated requests without unreasonable delay, and in any case within the ICDPA’s 45 days (extendable by 45 days with notice if the law applies and the request is complex).
Appeal: if we refuse a request, use the form and choose “Appeal.” If the ICDPA applies and you disagree with an appeal decision, you may contact the Indiana Attorney General’s Consumer Protection Division.
We will not deny the tool, charge a different price, or provide a different quality of service because you exercised a privacy right, except as the law allows for a bona fide account deletion.
Signed-in users: open your account privacy controls.
12. File a privacy request
Use this if you are not signed in, want to unsubscribe an email, or want to appeal. Do not include your full Social Security number or a copy of your ID in the box.
13. Changes
The “Last updated” date changes when this policy changes. If we ever expand how we use personal data, we will post that here before it applies to newly submitted notices.
See the Legal Disclaimer. Operators should have Indiana counsel review this policy and IC 24-15 / IC 24-4.9 before processing personal data at ICDPA scale.