To generate and save your own audit, you sign in to a DealSkeptic account. Authentication is handled by the Brandon-controlled DealSkeptic Supabase project. We store the account identifier needed to keep your saved audits and revisions tied to you.

You provide deal figures and assumptions such as price, rent, expenses, financing terms, and target return, plus optional labels, addresses, and evidence notes. When an audit is saved, those raw inputs and evidence notes, payment state, revision history, and a random report token are stored in our database. Financial report calculations are rebuilt deterministically from the saved inputs and evidence rather than treated as separately stored source data.

Authenticated users can submit supported PNG, JPEG, WEBP, and PDF underwriting files for transcription, subject to the current file-size and usage limits. The file is sent to a DealSkeptic Supabase Edge Function and then to OpenAI's API so explicitly stated underwriting fields can be transcribed into a structured response for your review.

The current extraction request sets OpenAI's Responses API storage option to false. The current DealSkeptic extraction function does not write the uploaded file itself to DealSkeptic database tables or file storage. OpenAI states that API inputs and outputs are not used to train its models by default unless the API customer opts in. OpenAI may still retain customer content in abuse-monitoring logs for up to 30 days by default unless stricter approved retention controls apply.

The extraction function returns extracted values, confidence labels, and short source context to your browser. If you accept values and later save the audit, the accepted deal inputs and evidence context can become part of the saved audit, but the raw uploaded file is not stored as part of that audit by the current implementation.

To enforce the private-launch document-reading limit, DealSkeptic keeps a daily usage record associated with your account identifier. That record contains the UTC usage date, request count, and update time. It is not a copy of the uploaded document.

Document reading is a transcription aid, not independent verification. You review the extracted figures and choose the evidence status before the deterministic financial analysis runs.

Your account's saved audits appear in My Reports. Each saved audit also has a long random token in its report URL rather than a sequential public ID.

A locked report link exposes only the limited unpaid teaser. Once a report is unlocked, anyone who has its private link can read that unlocked report, so share the link only with people you want to see the deal.

Card checkout is handled by Stripe. DealSkeptic stores payment status and the provider references needed to verify that the correct audit was paid, but card numbers and card security codes do not reach or get stored by DealSkeptic.

We do not run advertising or marketing trackers, and we do not set marketing cookies. For private-launch product learning, DealSkeptic keeps simple daily aggregate counts of a small fixed set of product actions, such as starting an audit, reaching the teaser, starting checkout, opening What If, reading a document, or answering the one-question feedback prompt on an unlocked report.

The product-metrics table stores the event name, date, and aggregate count. It does not store deal inputs, addresses, report tokens, account identifiers, persistent device identifiers, or a cross-session analytics identifier. The paid-report feedback prompt records only the aggregate Yes / Not yet / No response event, not which account or report gave it.

The browser may use sessionStorage only to avoid sending the same aggregate event repeatedly in one tab or session. A local dedupe key may distinguish one report from another inside that browser session, but that key and the report token are not transmitted with the metric.

Standard server and platform logs may separately record ordinary request information for reliability, security, and abuse prevention.

Lovable hosts the public application. A Brandon-controlled Supabase project provides DealSkeptic authentication, saved-audit data, Edge Functions, document usage controls, and aggregate product metrics. OpenAI processes supported user-submitted documents for structured transcription. Stripe provides payment processing. We do not sell your information.

DealSkeptic does not currently buy or query third-party property data, MLS feeds, public records, tax rolls, or insurance data on your behalf. Those are separate future diligence capabilities, not part of Rental Red Team V1 today.

We use reasonable, commercially standard safeguards, including encrypted transport and server-controlled access to saved-audit records. Direct browser database access to audit rows and internal aggregate-metric tables is restricted. We do not claim any certification, audit, or compliance standard, and no internet service can be guaranteed secure. Do not enter information you are not comfortable storing or sending through the current document-processing providers.

Self-service deletion is not available in the MVP yet. If you need an account or saved audit removed, contact DealSkeptic support with enough information for us to identify the account or report safely.