AI, privacy and safety
A computer helps run your neighborhood. Here is exactly what it does.
Short version: a computer reads the email your community sends to itself, so your board does not have to sort it by hand. It writes things down. It does not talk to your neighbors, and it never spends your money.
Does a computer read our email?
Yes, and that is the point of it. When somebody emails your community's address to say a gutter is coming off, the software reads it, works out which home it is about, and writes up the repair request so it is waiting for your board instead of sitting in somebody's inbox.
It reads the mail sent to the community address. It has no way to reach your personal email, and it is not reading anything else you do.
Can it send something to the neighborhood on its own?
No. When the software writes an announcement or a letter, it makes a draft and stops. A person on your board reads it, changes whatever they like, and presses send. There is no setting that turns that off, because we do not think anyone should be able to.
Who can see my address and phone number?
Your board, and the neighbors your board chooses to show it to. That is all. We do not sell it, we do not rent it, we do not use it to advertise anything to you, and no other community can see it.
Can it take money out of anything?
No. When dues are collected, the money goes from the neighbor straight to your association's own bank account. It never passes through us, and nothing is ever charged without a person choosing to pay.
What happens if we stop using it?
You take everything with you. Every list, every repair, every document downloads as an ordinary spreadsheet or file that opens in whatever you use next. Nothing is held hostage.
What if it gets something wrong?
It will, sometimes. It might file a request under the wrong heading, or guess the wrong house. Everything it does can be changed or undone by a person, and anything it was unsure about waits for somebody to look at it rather than going ahead.
If your neighbor is the sort who wants to know which company runs the servers, press the other button at the top. It is all there.
Everything below is what the software actually does today, not a roadmap. If something here stops being true we change this page.
Where the data lives
Entirely on Cloudflare. Records in D1 (their managed SQLite), files and photos in R2, one-time sign-in codes and rate limits in KV with short expiries. The application is a Cloudflare Worker. There is no separate server we log into, and no second copy of your data anywhere else.
Which models see what
Two providers, chosen per call:
- Anthropic (Claude), reached through a Cloudflare AI Gateway, or directly if the gateway is unavailable. Used for drafting and for the harder reading tasks.
- Cloudflare Workers AI running
@cf/meta/llama-3.3-70b-instruct-fp8-fast. Used for inbound email classification, and as the fallback whenever the Claude routes fail.
What they see is the text of the thing being worked on: the body of an inbound email, or the work order and community details needed to draft a message. Neither provider is given your directory to train on, and neither is sent data from any community other than the one the request belongs to.
What the AI can and cannot do without a person
The line is drawn at anything leaving the building. No AI path composes and sends a message to residents. Announcements, violation notices and decision letters are all generated as editable drafts, and a human presses send.
Filing is different, and this is the part most vendors would not tell you. Inbound email handling has a per-community setting, triage_mode:
reviewis the default. Everything the AI reads is staged for a board member to confirm. Nothing is created.auto_confidentfiles a clean maintenance request on its own when the model's confidence is at least 0.8 and the required fields are present. Anything else still waits.auto_allfiles everything it can.
If your board switches auto-filing on, an auto-filed work order behaves exactly like one a person filed, which includes the ordinary internal notifications: an approval request to board members if it is over your threshold, or a handoff email to whoever your board routes that category to. Those go to your board, never to the neighborhood. Every auto-filed item keeps its original email attached, and one press undoes it.
Separation between communities
Every table carries a community_id and every query is scoped by it. Stored files live under a c/{community}/ prefix, and no route will take a storage key from a URL: a file request looks up the owning database row, scoped to the signed-in session's community, and serves that row's key. One community cannot address another's data even by guessing.
Sign-in and sessions
No passwords are stored, because none are set. Signing in is a six-digit code emailed to an address already in your directory, held in KV with a short expiry and a request limit, compared in constant time, and answered identically whether or not the address exists so the form cannot be used to discover who is a member.
Sessions are stateless cookies signed with HMAC, host-only, so a session for one community's portal is not valid at another's. Email links that sign you in directly are single-purpose signed tokens with their own expiry, typically fifteen minutes for sign-in and longer for a specific item handed to you.
What is logged
Two ledgers, both deliberately thin. mail_sends records that a message was sent, to whom, with what subject and status, so a board can prove a notice went out. ai_calls records that a model call happened, which model and provider, how long it took and whether it failed. Neither records the content of the message or of the AI request.
Payments
Dues run on Stripe Connect as direct charges on the association's own connected account, so funds settle to your bank and Stripe is the party holding card details. Card numbers never reach our code or our database. Autopay stores a Stripe payment-method reference against the home, not an instrument.
Leaving
Directory, homes, work orders, dues and documents all export as CSV or their original files from inside the application, at any time, without asking us. There is no export fee and no waiting period.
Honest limits
- Inbound mail arrives through Cloudflare Email Routing, so a sender whose domain publishes a strict DMARC policy can be rejected before we ever see the message. Every delivered message is archived before anything parses it, but we cannot show you mail that never arrived.
- Open tracking on community announcements is approximate. Many mail apps block the image it depends on, so the real number is always at least what we show.
- The AI is wrong sometimes. It is built so that being wrong is cheap: everything is reversible, and low confidence waits for a person.
- We are a small company. This page tells you exactly what the software does so you can decide for yourself, rather than asking you to trust a badge.
Something here not clear, or not what you expected? Reply to any email we send you, or start from the support pages. If this page is wrong we would rather fix it than have you guess.