Security and privacy
The buildings in the list come from public government records. What you give us, like your email and territory, is used to run liftdue, email you about it, keep it safe and make it better. We don't sell it.
Updated
On this page
Short version
- Other companies on liftdue can't see your account, your territory or which buildings you look at.
- Sign-in is a one-time code sent by email. There's no password to leak; your inbox is the key, so keep it secure.
- Billing isn't open yet, so nothing is charged. When it opens, you pay on Stripe's page and your card number never reaches our servers.
- We record sessions on liftdue.com and in the app to see where people get stuck. Sign-in codes are masked. Other things you type, like your email, can show up in a recording.
- The app's database is in the US, in Northern Virginia. PostHog, our analytics service, keeps analytics and recordings in Frankfurt, Germany.
Session recordings and analytics
liftdue.com and the app use PostHog for analytics and session recordings. A recording shows what happened on the page: pages, clicks, scrolling, mouse movement, errors and browser console messages. It can include what you type into normal fields, like your email or ZIP code.
- Sign-in codes and fields we mark as secret are masked before anything leaves your browser.
- In the app, recordings also include the app's requests to our servers, with codes and tokens removed.
- Recordings are deleted after 30 days.
- PostHog stores your IP address and uses it to estimate roughly where a visit came from.
- Once you sign in, your activity, including earlier visits from the same browser, is linked to your account and email.
We use this to fix bugs and make liftdue easier to use. There are no ad networks and no advertising cookies on liftdue. The privacy policy lists what's stored in your browser.
Who can see your data
You, the teammates you invite, people at liftdue, and the services listed below that run liftdue. We don't tell building owners, agencies or other companies which buildings you look at or download. The privacy policy lists the only other exceptions. People at liftdue can see your account, your downloads and your session recordings. We use them to run liftdue, fix bugs and help you when you ask.
When you sign up, request a call, report a record or send feedback, a person at liftdue gets an email alert with what you entered.
How it's built
- Each sign-in code works for 15 minutes.
- Your connection to liftdue.com and the app is encrypted. Both only answer over HTTPS.
- Our database host, Convex, encrypts stored data and is checked by outside auditors (SOC 2 Type 2). Convex security
- Card payments go through Stripe's own checkout page. Stripe meets PCI Service Provider Level 1, the top level of the card industry's security standard. We keep a Stripe customer id and your plan, never card numbers. Security at Stripe
- Our keys to outside services are kept in a secrets manager, not in our code.
Services that handle your data
These are the outside services liftdue runs on. Each name links to its own privacy or security page, and each location links to the page that states it. We checked them on Nov 7, 2026.
| Service | What it does | What it holds | Where |
|---|---|---|---|
| Fly.io | Runs the web servers for liftdue.com and the app. | Web requests as they pass through, including your IP address and browser, and server logs. | Ashburn, Virginia, US Requests first reach Fly's nearest edge server, which can be outside the US. |
| Convex | The app's database and backend. | Your account, team and territory. Emails you give us, call requests, record reports, feedback with screenshots, a log of downloads, and visitor records (visitor id, IP address, browser). | AWS US East, Northern Virginia, US |
| Resend | Sends the app's email: sign-in codes, your list and onboarding emails. | Your email address, the emails we send you, and whether each one was delivered, opened or clicked. | US (Resend lists Amazon Web Services, USA, as its hosting and sending provider) |
| PostHog | Product analytics and session recordings on liftdue.com and in the app. | Pages viewed, clicks, session recordings, device and browser, IP address and the campaign that brought you. Once you sign in, your email. | PostHog Cloud EU, Frankfurt, Germany |
| Stripe Not in use yet: billing opens later. | Takes payments. | Your card and billing details, entered on Stripe's own checkout page, plus your email, invoices and subscription status. | Stripe, Inc., a US company |
| Google Workspace | Our own email. | Email alerts we get when someone signs up, requests a call, reports a record or sends feedback, with what they entered. Email you send us. Lists of elevator companies we may email (business names and work contacts). | Google's data centers (US and other countries) |
| GitHub | Stores our code and our outreach lists. | Lists of elevator companies we may email (business names and work contacts). | US and other countries where GitHub operates |
Deleting your data
Anyone can ask us to delete their own account and what's tied to it, like analytics, recordings and form entries. The team owner can ask us to delete the whole team. We'll do it within 30 days. The exceptions: what the law makes us keep, like billing records, and your email on a do-not-contact list if you asked us to stop writing. Building data comes from public records. If you're named in one, contact us and we'll look at it.
Report a problem
Found a security issue, or think something of yours was exposed? Email hello@liftdue.com with "Security" in the subject. Please don't touch other people's accounts or data while you look. If we find that your data was exposed, we'll email you and say what was exposed.
- hello@liftdue.com
- Talk to a person
- Book a call
- liftdue (Helios One)
3075 Clay St
San Francisco, CA 94115
More detail on what we collect and why is in the privacy policy.