The short version
Your deals are stored in your Transaction Assistant dashboard, encrypted. Your email, files and calendar stay in your own Google account.
The dashboard at transactions.tylerwiese.ca keeps your transaction records, so the Chrome extension, the Gmail add-on and the dashboard all see the same deals. The part that works with Gmail, Drive and Calendar runs as your own copy of a Google Apps Script project, under your own Google permissions; the dashboard never receives your email or files.
There is no analytics, no tracking, no advertising, and nothing is sold. You can download everything the dashboard holds, or delete your account and all of it, at any time from your account page.
Who this applies to
This policy covers the Transaction Assistant dashboard (transactions.tylerwiese.ca), the Transaction Assistant for Gmail Chrome extension, and the Google Apps Script project distributed with them. It is written for the real estate agent who uses them to manage their own transactions, and it also describes the client pages an agent can choose to share.
The product is provided by Tyler Wiese, Ontario, Canada.
What the dashboard stores
| What | Why | Kept until |
|---|---|---|
| Your email address | Your sign-in and your account | You delete your account |
| Your transactions: property address, client names, type and status, MLS number, lawyer, cooperating agent, brokerage deal ID, sale price and commission, the Gmail label, Drive folder and calendar each deal uses, sync notes, and its dates with any notes on them | The product itself: the dashboard, extension and Gmail add-on all read them from here | You delete your account. A deal you remove is hidden from every view but kept, encrypted, until then. |
| The address of your Apps Script project and its access key | So the dashboard can ask your project to act, for example to forget the link when you delete your account | You connect a different project or delete your account |
| Your default brokerage split (your share and a flat fee) | Starting new deals with your usual split | You change it or delete your account |
| Your deadline email settings (how often, what time, your time zone) and the day one was last sent | Sending the deadline email, if you turn it on | You delete your account |
| Client-page links you create | So a link you send a client opens their page | You revoke the link or delete your account |
| Sign-in records: sessions, one-time sign-in links, and a count of recent sign-in requests per network address | Keeping you signed in, and stopping sign-in abuse | Sessions last 30 days; sign-in links expire after 15 minutes; request counts are short-lived |
How it is protected
- Encrypted at rest. Everything that identifies a deal or a person (addresses, client names, the other people involved, prices, labels, folder links, notes) is encrypted with AES-256-GCM under a key unique to your account. Dates, statuses and standard date names such as "Closing Date" are kept readable so deals can be sorted and counted. Your Apps Script access key is encrypted the same way.
- Secrets are not stored. Sign-in links, sessions, client-page links and your project's dashboard token are kept only as one-way hashes, and network addresses only as salted hashes.
- Separated by account. Every record belongs to one account, and every request is checked against the signed-in account. No one else's sign-in can reach your deals.
- Encrypted in transit. Everything travels over HTTPS.
Being plain about access. Encryption protects your records if the database itself were exposed. It does not stop the service's operator: the encryption keys are held by the service so it can show you your deals. I do not look at your records, except with your explicit consent to fix a problem you have reported, or where the law requires it.
Service providers
- Cloudflare hosts the dashboard and its database (Cloudflare Pages and D1). The database's primary copy is in eastern North America. See Cloudflare's privacy policy.
- Resend delivers the sign-in emails, which contain your email address and a sign-in link, and the deadline email if you turn it on, which lists property addresses, dates and what is due (never client names, prices or notes). See Resend's privacy policy.
Neither receives your transactions for any purpose of its own. Nothing is shared with anyone else.
Cookies
The dashboard sets one cookie, ta_session, which keeps you signed in. It is marked HttpOnly and Secure, is sent only to this site, and ends when you sign out or after 30 days. There are no other cookies, and no third-party scripts.
Importing deals
A spreadsheet you import is read in your browser; only the rows you choose to import are sent to the dashboard. If you import from Notion, the Notion secret you paste is sent with each request to read your database and is then discarded; it is never stored, and nothing in Notion is changed.
Client pages
If you create a client link for a deal, anyone holding that link can see its property address, its dates, and your name and contact details. It never shows the client's name, MLS number, lawyer, prices, documents or notes. Revoking the link stops it working immediately.
The Chrome extension
The extension keeps the following in Chrome's storage on your computer. None of it is sent anywhere except as described below.
| What | Why | Kept until |
|---|---|---|
| Your Apps Script project's address and access key | So the panel can reach your own project | You clear it or uninstall |
| Your dashboard's address and your project's dashboard token, handed over by your project | So the panel can read your deals straight from your dashboard, which is faster | You connect a different project, the token is replaced, or you uninstall |
| Display density, collapsed sections, status and document filters | So the panel looks the way you left it | You clear it or uninstall |
| The subject line of the email you last opened outside your transaction labels | So the panel can offer a new transaction for an address it names | Replaced by the next email you open; ignored after 30 minutes |
| The Gmail label you last selected, and whether Gmail is in dark mode | So the panel opens on the right transaction and matches your theme | You clear it or uninstall |
| A cached copy of your transaction list | So the panel appears instantly instead of waiting on a request | When you close the browser, and immediately after any change you save |
On mail.google.com the extension reads exactly three things: the label in the page address, so it knows which transaction you are looking at; when an email is open outside your transaction labels, its subject line, from the page title Gmail sets, so it can offer to start a transaction for an address it names; and the page background colour, so it can match Gmail's theme. The subject is kept only on your computer, for 30 minutes. It does not read your messages. It talks to two places only: your own Apps Script project on script.google.com, and your dashboard at transactions.tylerwiese.ca to read your deals.
Your Apps Script project
Your copy of the project runs under your Google account, with permissions you grant it when you first run it:
| Permission | Used for |
|---|---|
| Read, compose and modify Gmail messages and labels | Applying transaction labels to mail and reading attachments you choose to file |
| Manage Gmail settings (filters and labels) | Creating the filters that sort incoming mail by property address |
| Gmail add-on access to the message you have open | Showing the transaction card beside an open email |
| Google Drive | Creating transaction folders and saving attachments you choose to file |
| Google Calendar events | Creating and updating events for transaction dates and their reminders |
| Connect to external services | Reaching your dashboard, and Notion or Google Places only if you turned them on |
| Manage its own triggers | The hourly maintenance that keeps labels and dates in order |
Your project sends the dashboard your transaction records and nothing else: never the content of your email, your files, or your calendar. It also talks to:
- Notion (
api.notion.com): only if you turn on the optional one-way Notion mirror, which copies your deals to a Notion database you choose. See Notion's privacy policy. - Google Places (
places.googleapis.com): only if you supply your own Google Maps key for address suggestions. What you type in the address box is then sent to Google.
Google API Services User Data Policy
Transaction Assistant's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Specifically: Google user data is used only to provide the features described here; it is not transferred to anyone except as needed to provide those features; it is never sold; it is not used for advertising; and no human reads it except with your explicit consent, to resolve a problem you have reported, or where required by law.
Your choices
- Download your data: your account page gives you every transaction and date as a file.
- Delete your account: the same page permanently removes your transactions, client links, sign-ins and the connection to your project, and tells your project to forget the dashboard. There is no undo.
- Remove the rest: uninstall the extension from
chrome://extensions, delete your Apps Script project from your Google account, and remove its access at Google Account permissions. Your Gmail labels, Drive folders and calendar events are yours and stay until you delete them.
Do not share your connection code or your project's access key: whoever holds them can act through your project. Treat them like passwords.
Children
This is a professional tool for licensed real estate agents. It is not directed at anyone under 18 and does not knowingly collect information from children.
Changes to this policy
If the product starts doing something materially different with your data, this page will be updated and the dates at the top will change. Treat the effective date as authoritative.
Contact
Questions about this policy, or about how the product handles something not covered here:
If you are in Canada and are not satisfied with a response, you may contact the Office of the Privacy Commissioner of Canada.