Apasov & Sons LLC.
Weverit is operated by Apasov & Sons LLC, a New York limited liability company based in New York, NY. References to "we," "us," and "Weverit" mean Apasov & Sons LLC. Privacy questions go to apasovav@gmail.com.
The address you type, and standard server logs.
When you use Weverit, we receive:
- The address strings you type into the search input. These are the queries that drive a building report.
- Building identifiers we derive from your address — BBL (Borough-Block-Lot), BIN (Building Identification Number), borough, ZIP, latitude/longitude. These come back from the city's public geocoder and identify a specific NYC building.
- Standard server logs — IP address, user-agent, timestamp, and the URL requested. These are recorded by our hosting provider (Railway) for operational purposes. We do not aggregate, profile, or analyze them.
If you click into an article on /news, the article HTML loads two libraries (marked and DOMPurify) from the jsDelivr CDN, which sees your IP and user-agent. Every page on the site loads webfonts from Google Fonts, which similarly sees your IP and user-agent on font fetch.
No accounts, no payments, no ad tracking.
- No user accounts. There is no signup, no login, no profile. The free service is open and anonymous.
- No payment information. We do not have a payment processor connected today. When paid reports launch, payment will be handled by a third-party processor (planned: Stripe) and we will update this policy at that time.
- Measurement cookies only, and you can switch them off. Google Analytics sets its standard first-party measurement cookies. In the EEA, the UK and Switzerland nothing is set until you click Accept on the consent banner. Everywhere else measurement is on by default, we show no banner, and the Do not track my visit link in the footer of every page — or the switch in § 04 — stops it: no cookies set or read, no identifiers sent. No other cookies are set on a public visitor's browser. See § 04.
- No ad analytics. We use Google Analytics 4 for aggregate, IP-anonymized traffic measurement, and Microsoft Clarity for session replay and heatmaps with typed text masked — both under the same consent switch (see § 04). No Hotjar, Mixpanel, Segment or PostHog.
- No advertising pixels. No Facebook, Google Ads, TikTok, or other ad-network tracking.
One operator-only exception: the /admin route stores an authentication token in localStorage for the editorial CMS used to publish news articles. That token is set only after a manual operator login on /admin/login and is never set on a public visitor's browser.
Aggregate, IP-anonymized, and switchable off.
Weverit uses Google Analytics 4 to understand how visitors use the site — this helps us prioritize improvements and see which content is most useful. How it starts depends on where you are:
- EEA, United Kingdom, Switzerland: analytics is off by default. No cookies are set or read and no identifiers are sent until you click Accept on the consent banner — only the same cookieless consent-state signal described below. Declining or ignoring the banner leaves it off. This is also what happens if we cannot determine your country.
- United States and elsewhere: analytics is on by default and we show no consent banner. This page is the notice, and the opt-out is permanent rather than a one-time prompt: every page carries a Do not track my visit link in the footer, next to the link that brought you here, and the switch below does the same thing. Either one takes effect immediately for this browser: no cookies are set or read and no identifiers are sent. One thing it does not do is produce total silence — the page still sends Google a single cookieless signal saying you have opted out, because that is how Google's consent mode is built. It carries no identifier and nothing that describes you. This is notice-and-opt-out, which is what US privacy law requires for analytics of this kind — no advertising storage is ever enabled, in any region.
- Everywhere, without exception: "Do Not Track" enabled in your browser leaves analytics off — we do not load it at all and record nothing, and the switch below is disabled because your browser has already decided. We also never enable advertising storage, in any region.
Your country is determined from your IP address at the moment of the request, by our CDN, and is not stored.
Session replay and heatmaps (Microsoft Clarity). Alongside Google Analytics we use Microsoft Clarity to see how pages are actually used — where people scroll, what they click, where they give up. It records a reconstruction of the visit: mouse movement, clicks, scrolling, and the layout of the page. It runs under exactly the same switch as Google Analytics — off by default in the EEA, the UK and Switzerland until you accept, off entirely under "Do Not Track", and off the moment you opt out. Text you type is masked at the source, so the address you search for and anything you enter in a field is not recorded. Clarity is governed by Microsoft's privacy statement: privacy.microsoft.com/privacystatement.
What's collected (when analytics is on):
- Page views and navigation patterns
- Approximate location — country and city level only
- Device type (desktop / mobile / tablet), browser, and operating system
- Referring source — which site you arrived from
- Time spent on pages
- Which actions were taken on a page: that a search was run and whether we already had that building, which report sections were reached, which buttons and outbound links were clicked (by destination site). The address you search for is never sent to an analytics service — we record that a search happened and whether it found something, not what it was.
- For Clarity only: a replay of mouse movement, clicks and scrolling, with all typed text masked
What's never collected:
- No personal information — no name, email, or address
- No data resale to advertisers
- No advertising profiles built about you
- No tracking across other websites
- IP addresses are anonymized before storage
Your current setting on this device. Analytics is on.
Other ways to opt out:
- The Do not track my visit link in the footer of every page. Same switch as the button above.
- Decline on the consent banner, if you are in the EEA, the UK or Switzerland.
- Enable "Do Not Track" in your browser — Weverit honors it in every region and never loads analytics, and it overrides the switch above.
- Install Google's opt-out browser extension: tools.google.com/dlpage/gaoptout.
Your choice is stored in your own browser for 90 days. Google Analytics data is retained for 2 months in our GA4 configuration (see § 07). Google's own data handling is governed by their privacy policy: policies.google.com/privacy.
To run the report. That's it.
We use the address you type to:
- Geocode it (turn the text into BBL/BIN/coordinates),
- Query NYC public datasets for the matching building,
- Generate a plain-English summary of those records,
- Cache the result so a repeat lookup is fast.
We do not sell, rent, or share your queries with advertisers or data brokers. We do not build user profiles. We do not do behavioral targeting.
The list, in full.
Generating a report involves talking to several services. Each one is listed below with what it actually receives.
- NYC Planning Labs (Pelias geocoder). Receives your typed address. Used to convert text into a BBL/BIN/coordinates. Public service operated by the NYC Department of City Planning.
- NYC Open Data / Socrata. Receives the BBL, BIN, and coordinates for the matched building. Used to query HPD violations, 311 complaints, NYPD CompStat, DOB records, PLUTO, and similar public datasets.
- JustFix (Who Owns What API). Receives only the BBL identifier (no raw address text). Used to look up rent-stabilized unit counts and landlord ownership associations. JustFix is a non-profit tenant-rights organization.
- Anthropic. Receives your typed address and the aggregated public-record data as part of the prompt that produces the plain-English summary. Anthropic's data handling is governed by their own privacy policy: anthropic.com/legal/privacy.
- Railway. Hosting provider for the website and the backend API. Sees all traffic in transit and stores our database. Standard hosting trust assumption applies.
- Cloudinary. Image hosting for editorial article images on /news. Does not receive any user-typed data; only serves images we publish.
- Microsoft Clarity. Session replay and heatmaps, under the same consent switch as Google Analytics (see § 04). Receives page URL, referrer, device/browser, and a reconstruction of mouse movement, clicks and scrolling. Typed text is masked before it leaves your browser. No data resale, no advertising profiles. Governed by Microsoft's privacy statement: privacy.microsoft.com/privacystatement.
- Google Analytics 4. Active by default outside the EEA/UK/Switzerland, and only after you accept inside them — see § 04, and note that measurement requests are routed through weverit.com before reaching Google. Receives page URL, referrer, approximate location (city level), device/browser, and IP address — the IP is anonymized before storage. Used for aggregate traffic measurement. No data resale, no advertising profiles, no cross-site tracking. Governed by Google's privacy policy: policies.google.com/privacy.
- Google Fonts. Serves the webfonts (Newsreader, JetBrains Mono) used across the site. Sees IP and user-agent when your browser fetches the stylesheet or font files.
- jsDelivr. Serves two open-source libraries (marked, DOMPurify) on article pages only. Sees IP and user-agent when those scripts load.
What the Chrome extension does, and doesn't.
The Weverit Chrome extension runs only on apartment-listing pages at StreetEasy, Zillow, and Apartments.com. On those pages it reads the listing's address from the page so it can show a “Check this building” button. When you click that button, the extension opens weverit.com/preview for that address in a new tab — exactly as if you had typed the address on this website, so the §§ 02, 05 and 06 disclosures above apply to the resulting report.
The extension does not run on any other site, does not read your browsing history, and does not collect or transmit any personally identifiable information. It stores only local, non-personal data in your browser via chrome.storage.local — an install date, simple usage counters, and display preferences — which never leaves your device. It requests the minimum permissions needed (activeTab and storage) and contains no third-party tracking, analytics, or remotely-hosted code.
What we keep, and for how long.
Our caches reduce latency and avoid hammering NYC public APIs. Different data has different retention:
- Per-module cache (HPD, 311, crime, DOB, PLUTO, schools, parking, etc.): from 24 hours up to 30 days, depending on how often the source dataset updates. Expired rows are deleted by an automatic cleanup function.
- Composite report cache: 24 hours, keyed by building (BIN), not by you. Expired rows are deleted automatically.
- AI summary cache: 24 hours.
- Geocode cache: stores the typed address you submitted alongside the resolved BBL/BIN. Rows are automatically deleted 90 days after they were last cached. Your right to request earlier deletion is covered in § 08.
- Server logs: managed by Railway under their default retention policy.
- Google Analytics data: retained for 2 months in our GA4 configuration, then deleted automatically by Google. Aggregated and IP-anonymized — not linked to an individual.
How to ask us about your data.
Address queries are not tied to user accounts (we don't have those), so we usually cannot connect a row to "you" without help. That said:
- Right to know what we have. Email us with the addresses you typed and an approximate date range, and we'll search our caches and tell you what's there.
- Right to deletion. Email us with the same information and we'll delete matching rows within 30 days.
- Email: apasovav@gmail.com.
If you are a California, Virginia, Colorado, Connecticut, or other state-privacy-law resident, you have additional statutory rights. Same email — we will honor any valid request consistent with the applicable law.
Not directed at children under 13.
Weverit is a service for adults researching NYC buildings. It is not directed at children under 13, and we do not knowingly collect data from children. If you believe we have inadvertently received data from a child, email apasovav@gmail.com and we will delete it.
What we collect for alerts, and how we use it.
If you sign up for lottery alerts, we collect your email address. We use it only to send you notifications about NYC affordable-housing lotteries and to let you manage or cancel that subscription.
After confirming your email, you may optionally tell us your household size, borough preferences, and approximate income range. We use this only to filter which lotteries we send you, so you receive listings you may qualify for rather than all of them. Providing this is optional; if you skip it, we send all current lotteries.
We store your income as a range, not an exact figure. We do not sell, rent, or share this information with landlords, developers, brokers, or any third party. We do not use it for advertising.
Every alert email includes a one-click unsubscribe link that works without logging in. When you unsubscribe, we stop sending immediately and delete your alert preferences. You can also email us to request deletion of your address entirely.
Lottery listings themselves come from public NYC Housing Connect data. We do not submit applications on your behalf and have no connection to NYC Housing Connect or HPD.
We update; the effective date moves.
We may update this policy as the service evolves — for example, when paid reports and Stripe launch. The effective date at the top reflects the latest version. Material changes will be reflected in a clearly visible update.
Questions go here.
Email apasovav@gmail.com. Apasov & Sons LLC, New York, NY.