Persisted receipt
Owner-approved parcel lookups retain purpose, time, input and output categories, status, cost, retention, and refresh eligibility. They do not retain the full address, coordinate, URL, or raw payload in the receipt.
Privacy & providers
Privacy that names the provider
Homestead separates saved home facts from transient context and keeps an address-free receipt whenever the provider workflow supports one.
01
Four provider modes, never one vague “AI” bucket
Live, ephemeral context
Census, FEMA, USGS, USDA, and Open-Meteo power advisory site or weather context. Those older live paths do not persist a separate query receipt or raw response, and the Privacy Center says so explicitly.
Browser-only address tools
Google Maps autocomplete and geocoding run from the browser during owner-directed address setup. Homestead receives no provider request ID and does not invent a server receipt. Manual address entry remains available.
Dataset snapshot
FHFA area-index provenance and value snapshots live in the Value workspace. They are not represented as address-sharing receipts because the operation uses a dataset key, not the home’s street address.
02
What leaves, what returns, what stays
A reviewed property provider may receive an owner-approved address; downstream map sources may receive only a Census-derived coordinate. Returned facts are normalized into allowlisted categories. Raw parcel responses are not retained. Proposed public record facts stay separate from canonical home facts until Review accepts them.
Provider manifests define attribution, terms review date, raw and normalized retention, export permissions, deletion support, AI-use limits, request cost ceilings, and a safe-dark activation rule. A missing or unapproved contract prevents a call rather than degrading quietly into an unknown source.
03
Refresh, local forget, and provider forget are different
Refresh follows the source-specific eligibility time. Local snapshot removal deletes the provider run, receipt, proposed assertions, source records, and identifiers while preserving facts the owner already accepted into the canonical home record. Provider forget is broader: it can also clear matching accepted facts and may require instructions or a request outside Homestead when the provider offers no automated deletion channel.
04
Deletion status and retention exceptions
Only a household owner can record or cancel a home/account deletion review request. A request is shown as requested—not completed—until the broader deletion process is implemented and confirmed. Homestead may retain minimum security, fraud, billing, legal, and deletion-audit records when required. Public records remain at their source, and provider-held browser or service logs are marked unsupported when Homestead has no provider deletion channel.
05
Export V2 follows the same boundary
Home-record Export V2 carries a versioned manifest for every collection with a count, status, warnings, and a specific omission reason when data cannot travel. A readable summary accompanies the JSON, and the optional bounded ZIP adds only stored attachments listed as included in that same manifest.
It omits credentials, bearer capabilities and their hashes, notification endpoints, payment/provider request identifiers, internal storage keys, raw provider bodies, and licensed normalized fields whose source manifest prohibits export. Live-only context is inventoried as omitted rather than described as complete.