Privacy Policy

1. Introduction

American Dream Index ("ADI," "we," "us," or "our") publishes data about what it takes to afford a home and build a life in cities across the United States. This policy explains what personal information we collect, why, who we share it with, how long we keep it, and what you can do about it. It covers americandreamindex.com and everything on it (the "Site"), which is currently in beta.

• We ask for what we need. We never ask for a Social Security number, a bank account, or a card number.
• We do not sell your personal information.
• The household details you type into the Site stay in your browser unless you choose to save them to your account. If you do, we store them encrypted.
• You can download or delete your data at any time, and deleting your account erases it.

2. What we collect

Information you give us

• Account details: your name, email address, and a password, which we store only in scrambled ("hashed") form. If you sign in with Google, Google gives us your name, email address, and profile picture. Administrators also use an authenticator app for two-step sign-in.
• Household details: your current location, each adult's occupation, birth year and income, other income, children's ages (current and planned), home size, savings toward a home, and whether you rent or own. You enter these to personalize the Site.
• Sign-up, waitlist and contact forms: your name, email address, organization, and any message you send.
• Feedback and requests: what you write to us, with your email address if you give one, and the cities you ask us to add.
• Email preferences: whether you want "Consumer updates," "Journalist updates," both, or neither, and when you chose.

Information collected automatically

• Approximate location: we look up your IP address once, when you open the sign-in window, to suggest your city. We keep only the city, region and country, not the IP address, with anything you submit.
• Device and log information: your IP address, browser and device type, and the pages you request, recorded by our hosting and error-monitoring services and, for signed-in sessions, with the session.
• Analytics: which pages you visit and how you use them, through Google Analytics, Microsoft Clarity and a Meta (Facebook) Pixel, loaded through Google Tag Manager.

We do not collect precise location, Social Security or government ID numbers, financial account numbers, or health information.

3. How we use your information

• To run the Site and your account, and to keep them secure.
• To personalize city and planning pages with the household details you give us.
• To respond to messages and requests, including requests to download or delete your data.
• To send the emails you need, such as verification and password reset.
• To send product updates and the newsletters you chose. Every email has an unsubscribe link.
• To understand how the Site is used and to improve it.
• To advertise ADI to people likely to be interested, through the pixels described in section 5.
• To detect and prevent fraud, abuse and security incidents, and to comply with the law.

We use sensitive personal information (your sign-in credentials) only to authenticate you and keep your account secure. We do not use it to infer anything about you.

4. Your household details

• Signed out, or signed in and not opted in: your household details are kept only in an encrypted cookie in your browser, for up to 30 days. Our servers read the cookie to build the pages you request but do not store its contents.
• Signed in and opted in: if you choose "Yes, save them," we store the details in your account, encrypted, so they follow you across devices. We use them only to personalize the Site. You can download or delete them from Account settings at any time.
• Shared computers: when you sign out, we remove details that came from your account from that browser.

5. Who we share it with

We do not sell personal information for money. These companies help us run the Site. Each handles data for us under its own terms, only for the purpose given:

Advertising and analytics ("sharing"). Advertising pixels such as Meta's can send usage data to the provider, which may use it to show you ads on other sites. California law calls this "sharing" personal information for cross-context behavioral advertising. We do not intentionally send your household details, account details or form contents through these pixels. To opt out, use the "Your Privacy Choices" switch below. We also honor the Global Privacy Control signal that some browsers and extensions send: we treat it as a request to opt out of sharing, and for that browser we do not load the advertising and analytics tags at all. You can also use a tracker-blocking browser, or email us at the address in section 10 and we will act on your request.

We may also disclose information if the law requires it, to protect people's safety or our rights, or as part of a sale or merger of ADI, in which case we will tell you and the new owner must honor this policy. We do not knowingly sell or share the personal information of anyone under 16.

California categories. In the last 12 months we collected these categories, for the purposes in section 3, and disclosed them to the companies above for business purposes:

6. How long we keep it

• Your account and what is tied to it: until you delete your account.
• Sessions: 7 days after you last use them.
• Accounts you never verified: removed after 30 days.
• Saved household details: until you delete them or your account.
• Household details in your browser: up to 30 days after you last save, or until you clear your cookies.
• Sign-up, waitlist, feedback and email choices: until you ask us to delete them or you delete your account.
• Security logs: up to 12 months.
• Analytics: Google Analytics is set to the shortest retention period Google allows. Other analytics providers keep data under their own settings.

7. How we protect it

• Data is encrypted in transit (HTTPS) and at rest in our database.
• Saved household details get an extra layer of encryption, with the key held by our database provider rather than in our code.
• Access to production data is limited to authorized administrators, with two-step sign-in and re-authentication for sensitive actions.
• We limit sign-in attempts, monitor for errors, and follow a written incident-response plan.

No system is perfectly secure. If a breach affects your personal information, we will tell you as the law requires.

8. Your rights and choices

Whether or not you live in California, you can:

• Know what we hold about you and get a copy in a portable format. Signed-in users can download their saved household details from Account settings; for anything else, contact us.
• Delete your information. Signed-in users can delete their account from Account settings. Deletion removes your sign-in, sessions and saved household details, replaces your email address, name, organization, location and comments in our contact records with placeholders, unsubscribes you from every list, and removes you from our email provider. A record that someone signed up on a given date remains, with nothing that identifies you. We will not try to re-identify it. We may keep a limited record where the law requires it.
• Correct information that is wrong, from Account settings or by contacting us.
• Opt out of sharing for advertising (section 5) and of email, using the unsubscribe link or the switches in Account settings.
• Be treated the same for using these rights. We will not deny service, charge you differently, or give you worse service.

How to make a request. Email privacy@americandreamindex.com. We confirm your identity by asking you to reply from the email address on the account or submission. We aim to acknowledge requests within 10 days and complete them within 45 days; if we need up to another 45 days, we will tell you why. You can use an authorized agent, and we may ask for proof they act for you. If we deny a request, you can appeal by replying to our response.

Do Not Track. The Site does not respond to the "Do Not Track" browser setting, because there is no common standard for it.

California "Shine the Light." California residents may ask once a year which categories of personal information we shared with third parties for their direct marketing, and with whom. We do not share information for third-party direct marketing.

9. Cookies

• Sign-in cookie: keeps you signed in. Essential.
• Household-details cookie: stores the details you enter, encrypted, for up to 30 days. Essential to the personalization you asked for.
• Location cookie: stores the city we guessed from your IP address so we do not look it up again.
• Analytics and advertising cookies: set by Google, Microsoft and Meta through Tag Manager. They do not run if your browser sends a Global Privacy Control signal or you use the "Your Privacy Choices" switch in section 5. You can also block them with a tracker-blocking browser or your browser's cookie settings; the Site keeps working.
• Privacy-choice cookie: remembers that you used the "Your Privacy Choices" switch, for 12 months. Set only if you use the switch.

10. Children, changes and contact

The Site is for adults. We do not knowingly collect personal information directly from anyone under 16. Adults may enter their own children's ages to personalize the Site; we do not collect children's names or other identifying details. If you think a child has given us personal information, contact us and we will delete it.

If we change this policy in a way that matters, we will post the new version here, update the date, and email account holders. Older versions are available on request.

Questions or requests: privacy@americandreamindex.com.