Privacy policy

How we handle your information.

Effective August 17, 2026 · Last updated October 7, 2026

This policy explains what seecrime.com collects, why, who processes it on our behalf, and what you can ask us to do with it. It covers the website, the map application, the reports we generate, and the /api/v1 developer API.

seecrime.com is operated by P4 Security Solutions LLC, the billing entity of P4 Companies, at 2801 Finley Rd, Suite 103, Downers Grove, IL 60515.

The short version

We do not sell your personal information, and we do not share your saved areas or alert preferences with third parties.
The crime and 311 records on the map are public records published by city governments. They are not about you and are not collected from you.
We collect the minimum needed to run an account: your email, and what you choose to tell us.

What we collect

Information you give us

Data	Why we hold it	At rest
Email address	Sign-in, account recovery, and the reports and alerts you ask for	Stored in plain text — it is a lookup key for sign-in
Name	Addressing you in the app and in emails	Encrypted (AES-256-GCM)
Password	Sign-in	Stored only as a bcrypt hash — never in a recoverable form
ZIP code and how you plan to use the product	Collected at sign-up so we know which cities to prioritise	Plain text
Saved areas, filters, and alert settings	To render your map and send the reports you requested	Encrypted with a per-user key
Uploaded datasets (enterprise)	To plot your own point data alongside public data	Stored in your organisation's scope; visible only to your organisation

Information we record automatically

Security audit events — sign-ins, password changes, permission changes, and similar. These include your IP address, which we encrypt at rest (AES-256-GCM), because it is the record that lets us investigate account compromise.
Two sign-in cookies, so you stay signed in: a session cookie that ends when you close your browser, and a "remember me" cookie, set every time you sign in, that lasts up to 30 days. Both are signed; signing out ends them on that browser, and changing or resetting your password ends them everywhere. They are required for the site to work — we do not use advertising or cross-site tracking cookies.
Server logs of each request, for reliability and abuse investigation. Our application's request log records the web address (URL) of the page or API call, including its query string, the response status and size, and how long it took. A query string can carry what was looked up, such as the coordinates or street address of a risk-score lookup. That log does not record your IP address: the only IP address in it is our hosting provider's proxy. Our hosting provider, Railway, also keeps its own log of each request it receives, which does include your IP address, your browser's user agent and the page's path; it keeps that log for a period set by our hosting plan, between 3 and 90 days.
Connected AI apps (paid plans) — when you connect an AI app to our MCP server by signing in, we keep the name and web address the app gives for itself, when you connected it and when it last used the connection, and store its access tokens only as one-way hashes; disconnect it any time under Profile, Connected AI apps, and changing or resetting your password disconnects every one.

What we do not collect

We do not use advertising trackers or third-party analytics pixels, and we do not build advertising profiles.

Addresses and your location

When you search an address (on the map or for a risk score), your browser sends the address you search for to OpenStreetMap's Nominatim service (listed below) to find it, once you press Enter or the search button. If you use my location, your browser first asks for your permission, then sends your device's coordinates to Nominatim to name the place. The point is then sent to our server, like any point you pick on the map, to load the incidents and the risk score around it. We do not save it to your account unless you save it as a zone; like any map request, it can appear in our short-lived caches and in our server's request logs.

Who processes data for us

These are our sub-processors. Each one receives only what its job requires.

Provider	Purpose	What it receives
Railway	Hosting and the PostgreSQL database (US West region)	All application data
Resend	Transactional and report email	Your email address and the message
Anthropic	AI-written narrative in reports, the SQL assistant, and brand-palette extraction	Aggregated crime statistics for the requested area; your question text if you use the assistant. Not your name, password, or payment data.
US Census Bureau geocoder	Turning an address into coordinates	The address text only
US Census Bureau data API	Tract population, an input to the risk score’s activity index	A census tract identifier derived from the point you asked about — no address and no account identifier
FCC Area API	Turning a point into a census block, for the same index	The coordinates you asked about — no account identifier
OpenStreetMap / Nominatim (loaded by your browser)	Address search on the map and for the risk score, when you press Enter or the search button, and naming your location when you use "my location"	The address you search for; your device’s coordinates if you use "my location"; and, because your browser contacts it directly, your IP address
OpenStreetMap / Overpass	Points of interest for the risk score’s activity index: a monthly download of each covered US city’s points, and a live count where our stored copy does not cover a point	A city’s bounding box for the monthly download; the coordinates you asked about only when our stored copy does not cover them — no address and no account identifier
Private.coffee Overpass server (OpenStreetMap data)	The same as the server above, as its alternate (the live count tries this server first; the monthly download tries it second)	A city’s bounding box for the monthly download; the coordinates you asked about only when our stored copy does not cover them — no address and no account identifier
Have I Been Pwned	Checking a new password against known breach corpora	The first five characters of a SHA-1 hash of the password, and nothing else. The service cannot reconstruct the password or tell which account it belongs to.
Open-Meteo	Historical weather for the weather-correlation section of reports	An approximate area centroid and date range — no user identifier
CARTO (loaded by your browser)	Base map tiles	Standard web-request metadata, including IP, as with any map tile provider

Providers marked loaded by your browser are contacted by your browser rather than by our servers, so they see your IP address and browser details the same way any website's image or script host would.

City open-data portals (Socrata, ArcGIS, CKAN and similar) are sources we read from. We send them no information about you.

How long we keep it

Account data — for as long as your account exists.
Pending email-change requests — purged automatically after 30 days.
Security audit events — sign-ins, password and permission changes and similar — are kept for 24 months (730 days) and then deleted automatically. We keep them that long so an account compromise discovered late can still be investigated.
Geocoding cache — address-to-coordinate results are cached for 30 days (unmatched addresses) or 30 days from last use, and contain no account identifier.

Your choices

See and correct your data — your account settings show what we hold and let you change it. Changing your email requires confirming the new address, and we notify the old one.
Stop the emails — every report and digest email carries an unsubscribe link, and you can turn reports off in your settings. Security emails (password resets, address-change notices) cannot be switched off while the account is open.
Delete your account — email us and we will delete it and its saved areas.

Rights under state and national privacy laws

Depending on where you live you may have additional rights. We extend the rights below to every user, wherever they live, rather than gating them by residence — it is simpler for you and simpler for us to operate.

Know and access — what we hold about you, and a copy of it.
Correct — anything inaccurate.
Delete — your account and the data attached to it.
Portability — your saved areas and settings in a machine-readable file.
Opt out of profiling — we do not profile you and we make no automated decisions about you, so there is nothing here to opt out of. The risk score describes an area, never a person.
Appeal — if we refuse a request, you may appeal it (below).

We do not sell or share your personal information

We do not sell your personal information, and we do not share it for cross-context behavioural advertising, as those terms are used in the California Consumer Privacy Act as amended by the CPRA and in comparable state laws. We have never done so. There is no “Do Not Sell or Share My Personal Information” link because there is nothing to opt out of.

How to make a request, and what happens next

Email privacy@seecrime.com from the address on the account, or write to the postal address below. Using the account address is how we verify the request; if you cannot, we may ask for other information sufficient to establish that the account is yours.
We acknowledge within 10 business days and respond substantively within 45 days. If a request is complex we may take up to a further 45 days, and we will tell you why before the first period ends.
Requests are free. We may charge, or decline, only where a request is manifestly unfounded or repetitive — and we will say which.
An authorised agent may act for you with written permission we can verify.
We will not discriminate against you for exercising any of these rights.

If we refuse

You may appeal by replying to our decision with the word appeal, or by writing to privacy@seecrime.com with the original request. A person who was not involved in the original decision will review it and respond within 45 days, with reasons. If we deny the appeal we will tell you how to complain to your state Attorney General or other supervisory authority.

Canada — PIPEDA and Quebec Law 25

seecrime.com covers cities in Canada, and Canadian residents may hold accounts. The crime and 311 records we publish are public records released by Canadian agencies under open licences — see data sources — and are not personal information we collected from you. Your account data is different, and for Canadian users we apply the following:

We handle account data consistently with PIPEDA and, for Quebec residents, the Act respecting the protection of personal information in the private sector as amended by Law 25.
Your data is stored and processed in the United States, on Railway's US West infrastructure, and the sub-processors listed above are largely US-based. By creating an account you acknowledge that transfer. We assess the protection afforded before adding a sub-processor that receives personal information.
The access, correction, deletion, portability and withdrawal-of-consent rights above are available to you, by the same route and on the same timelines.
Our Privacy Officer can be reached at privacy@seecrime.com, or at the postal address below. You may also complain to the Office of the Privacy Commissioner of Canada, or to the Commission d’accès à l’information du Québec.

We do not use profiling, automated decision-making, or technology that identifies or locates you, so the Law 25 notice obligations attached to those do not arise.

Security

Passwords are bcrypt-hashed. Sensitive fields — your name, and the IP addresses and detail text in audit records — are encrypted with AES-256-GCM before they are written. The database is hosted on Railway with encryption at rest, and traffic to the site is served over HTTPS. Accounts lock temporarily after repeated failed sign-ins.

No system is perfectly secure, and we do not claim otherwise. If you believe you have found a vulnerability, please contact us before disclosing it publicly.

Children

seecrime.com is not directed to children under 13, and we do not knowingly collect their personal information.

Changes

If we change this policy we will update the "last updated" date above, and for material changes we will tell account holders by email.

Contact

P4 Security Solutions LLC, 2801 Finley Rd, Suite 103, Downers Grove, IL 60515 · 312-502-1702 · Contact us.

About Privacy Terms Attribution Contact Status AI assistants API

A P4 Companies product — seecrime.com is operated by P4 Companies.

2801 Finley Rd, Suite 103, Downers Grove, IL 60515 · 312-502-1702