Privacy Policy

Effective August 11, 2026. Last updated August 11, 2026.

This policy covers the Shorty website at buyshorty.com, the web app at app.buyshorty.com, and the Shorty iOS app (together, “Shorty”). Shorty is operated by Longleaf Labs, LLC, a North Carolina limited liability company (“we”, “us”). Questions about anything below go to denny (at) dennydeaton (dot) com.

Shorty is a private, invitation-only tool. There is no public sign-up, no advertising in it, and no third-party analytics or tracking SDK in the app or on this site. We do not sell personal information, and we do not share it for cross-context behavioral advertising.

What we collect

Your phone number: Required. It is how you sign in and the only identifier an account needs. Stored in international format.
Your display name: Required, so other members of your household can tell whose vote, rating, or comment they are looking at.
Your email address: Optional, and collected only if you turn on the emailed digest.
Your profile photo: Optional. If you set one, the app asks iOS for access to your camera or photo library at that moment and uses it for nothing else. It does not read your photo library otherwise and does not save anything to it.
What you do in the app: Your votes, star ratings, comments, shortlist and removal decisions, the properties you look up on demand, and the search and underwriting preferences you set.
Device token for notifications: If you allow push notifications, Apple issues a token that identifies that installation of the app. We store it so we can send you a notification, and nothing else.
Sign-in and security records: A session identifier held in a cookie in your browser or app while you are signed in, the time you last signed in, and a short-lived record of each sign-in code we issue. The codes themselves are stored only as a one-way hash and expire within minutes.
Ordinary server logs: Our web server records the usual request lines — IP address, time, path, user agent — as any web server does. They are used for operating and securing the service.

We do not collect device location. The app never asks for location permission. Mapping and drive-time features work from the address of a property, not from where you are.

Why we use it

To sign you in and keep you signed in — your phone number, sign-in codes, and session identifier.
To provide the product — showing your household's shared shortlist and its votes, ratings, and comments, and applying the preferences you set to what Shorty searches for and how it scores what it finds.
To send what you asked for — the emailed digest, if you enabled it, and push notifications, if you allowed them.
To keep the service running and secure — rate-limiting sign-in attempts, diagnosing failures, and preventing abuse.

We do not use your information to build advertising profiles, and we do not use it to train machine-learning models.

Who else sees it

Shorty is built on a small number of service providers. Each receives only what its job requires, and each is bound by its own terms to use it only to provide that service.

Twilio: Receives your phone number in order to deliver your sign-in code by SMS.
Resend: Receives your email address in order to deliver the digest, if you enabled it.
Apple Push Notification service: Receives your device token and the notification text in order to deliver push notifications, if you allowed them.
Property data and market providers: Realty US (via RapidAPI), AirROI, and Mapbox receive queries about properties — addresses, coordinates, listing identifiers — in order to return listings, revenue estimates, and drive times. They do not receive your identity or your account information.
Anthropic: Receives listing photographs and listing text so that Shorty can summarize and flag them. No account information is sent.
Our hosting provider: Hosts the server and database on which the above is stored.

Other members of the household you belong to can see your display name, your profile photo, and the votes, ratings, and comments you leave on shared listings. That is the point of a shared shortlist; treat a comment the way you would treat a message to the group.

We will disclose information if we are legally required to, and we may transfer it as part of a sale or reorganization of the service — in which case this policy continues to apply to it, or you will be told before any new policy does.

How long we keep it

Sign-in codes expire within minutes and are purged after that.
Sessions expire on their own, and immediately when you sign out.
A device token is dropped when the installation stops re-registering — which is what happens when you delete the app.
Everything else in your account is kept until you ask us to delete it, because the point of the shortlist is that last month's decisions are still there.
Server logs rotate on the ordinary schedule of the server, a matter of weeks.

Deleting your account

You can delete your account yourself, from inside Shorty, without asking anyone: Profile → Delete my account → Delete for good. It happens immediately and cannot be undone.

Deleting removes:

your phone number, display name, and email address;
your profile photo, including the file on our server;
every signed-in session, so all your devices are signed out;
your device tokens, so notifications stop;
any pending household invitation addressed to your number, so the account cannot be quietly re-created by an old invite.

What happens to the opinions you left depends on who else is in your household, because a shared shortlist belongs to the household that formed it. If other members remain, your votes, ratings, and comments stay on the shortlist but are reassigned to an anonymous placeholder — they no longer identify you, and your name and photo are gone from them. If you were the last member, the household is removed and all of its votes, ratings, and comments are deleted with it.

Property and market data about listings is not personal information and is not affected either way.

Deleting the iOS app from your device does not delete your account. If you can no longer sign in and want the account gone, email denny (at) dennydeaton (dot) com from any address, name the phone number on it, and we will do it for you within 30 days.

Your rights

Depending on where you live, you may have the right to access a copy of the personal information we hold about you, to correct it, to delete it, to limit how it is used, and not to be discriminated against for exercising any of those rights. Shorty runs no such discrimination — there is no paid tier to be demoted from. Make any of these requests at denny (at) dennydeaton (dot) com and we will respond within the period the applicable law requires, and in any event within 45 days.

Security

Traffic to Shorty is encrypted in transit with TLS. Sign-in codes are stored only as hashes and are limited both in lifetime and in the number of attempts allowed against them. Profile photos are not served from a public directory; each is reachable only through an unguessable link. Access to the server and database is limited to the operator. No system is perfectly secure, and we do not claim otherwise.

Children

Shorty is a tool for adults evaluating real-estate purchases. It is not directed to children, and we do not knowingly collect personal information from anyone under 13. If you believe a child has provided us information, write to us and we will delete it.

Where your information is held

Shorty is operated from, and stores its data in, the United States. If you use it from elsewhere, you are sending your information to the United States, where privacy law differs from that of your own country.

Changes to this policy

If this policy changes, the effective date at the top changes with it. If a change materially affects what we collect or who receives it, we will tell account holders directly — by push notification, by email, or in the app — before it takes effect.

Contact

Longleaf Labs, LLC
denny (at) dennydeaton (dot) com
North Carolina, United States