1. Who we are
Deep Oʻahu is a property-research website for Oʻahu, Hawaiʻi, at deepoahu.com. It is operated by Deep Oahu LLC, 2525 Date St, Honolulu, HI 96826. Where privacy law uses the words controller or business, that entity is the one responsible for the information described here.
For anything in this policy, including a privacy request, email peter@deepoahu.com. It is the only contact channel for the site.
2. What this policy covers
This policy covers deepoahu.com and any Deep Oʻahu service that links to it. It covers two very different kinds of information, and the difference matters throughout:
- Information about you — what your browser sends when you load a page, and what you write to us. This is what most of the policy is about.
- Public-record information about property — government records that Deep Oʻahu republishes, some of which name property owners. That information is not collected from you, and it is handled under section 7.
3. What we collect today
Today the site has no accounts, no sign-in, no analytics, and no advertising tags. It has one form — the contact form on /contact, described below. The list below is complete as of the date at the top of this page.
Edge and server request logs
deepoahu.com is served through Cloudflare. Loading any page causes Cloudflare, acting for us, to process the ordinary information a web request carries: your IP address, the time, the URL requested, the referring page, your browser and device user-agent string, TLS and connection details, approximate location derived from the IP address, the response status, and abuse and bot-detection signals. Property and parcel pages are rendered on demand, so those requests also reach our own database, which records query and error information.
We use this to serve the site, keep it up, debug it, and defend it against abuse. We do not build profiles from it and we do not use it for advertising.
What you send us
The contact form asks for your name, your email address, an organisation if you want to give one, what the message is about, a property reference if it concerns one property, and the message itself. The website does not store any of it. A submission is sent straight to our own monitored mailbox as an email, and there is no leads database behind the form. The email also carries the time you sent it, the page you sent it from, and the two-letter country your request arrived from, so we can make sense of it when we reply. We do not put your IP address or your browser's user-agent string in it. If the message cannot be sent, nothing is kept anywhere and the form tells you so and gives you the address to write to instead.
Before the form will send, Cloudflare Turnstile checks that you are a person rather than a script. That check is run by Cloudflare on our behalf — see section 8 — and it needs JavaScript, so the form cannot be submitted without it.
You can also write to us directly — the address is on /contact. Either way what we end up with is an email: we receive your email address, whatever you put in the message — often a property address or TMK, your role, and your question — and the message metadata your mail provider attaches. We keep that email correspondence so we can answer it and so we have a record of what was asked and agreed.
Please do not send passwords, full payment-card numbers, Social Security numbers, or similar sensitive information by ordinary email. If we ever need something like that, we will provide a secure route for it.
What your browser loads
The map and property pages fetch data from these places, each of which sees your IP address:
- deepoahu.com — pages, map tiles, and property data, served through Cloudflare.
- search.deepoahu.com, imagery.deepoahu.com, scene.deepoahu.com — our own search index, aerial imagery and scene data, running on infrastructure we operate ourselves and reach through Cloudflare.
- tiles.openfreemap.org — the OpenFreeMap basemap. This is a third party. When the map loads, your browser connects to it directly and it receives your IP address and the map tiles you request. We do not send it anything else, and we have no account with it.
Storage on your device
We set no cookies of our own. The map stores one value in your browser's local storage, deepoahu:welcomed, so the welcome panel does not reappear on every visit. Nothing in it identifies you and it never leaves your device. You can clear it with your browser's site-data controls.
Cloudflare may set its own strictly necessary cookies for bot management and security. Those are Cloudflare's, they are described in Cloudflare's documentation, and they are not used for advertising or measurement.
What we do not do today
- no accounts, passwords, or sessions;
- no field on the contact form that asks for a password, a payment-card number or a government identifier, and no requirement to give an organisation or a property reference;
- no analytics product, first-party or third-party;
- no advertising, remarketing, or conversion tags;
- no tracking cookies, pixels, or device fingerprinting;
- no sale of personal information, and no sharing of it for cross-context behavioral advertising;
- no payment processing, because nothing on the site can be bought yet.
Each of those will change on a specific day, and this policy is updated before that day, not after it. See section 5 and section 6.
4. How we use information
We use what we collect to:
- serve, operate, secure, debug and improve the site;
- answer your email and keep a record of the exchange;
- detect and stop abuse, scraping, fraud and attacks;
- keep the business, accounting and tax records we are required to keep;
- comply with law and respond to lawful requests;
- run accounts, subscriptions and reports once those exist.
We do not use your information to make decisions about you as a property owner, tenant, borrower or applicant, and we do not sell it.
5. What changes when accounts and billing launch
None of this is live yet. It is written down now so the change is visible before it happens rather than after. This policy will be updated with a new effective date on the day each item ships.
Accounts
Accounts will be handled by Better Auth running on infrastructure we operate. An account record will hold your email address, a hashed password — we never store or see the password itself — email-verification and password-reset tokens, session records with their creation time, IP address and user-agent, and the sign-in history needed to secure the account.
Subscriptions and entitlements
A paid account will also have subscription records: the plan, its status, the current period, any price lock, usage counters against plan limits, and a reference identifying you at our payment processor.
Payments
Payments will be handled by a third-party payment processor. Card numbers are entered with the processor, not with us. We never receive, store or process full payment-card numbers. We expect to receive only what a merchant normally receives: a customer and transaction reference, the amount, the last four digits and card brand, the billing country and postal code for tax and fraud purposes, and the success or failure of each charge.
Saved research
Paid features will let you save properties, searches and watchlists. Those are stored against your account. If a subscription lapses they become read-only and are kept, not deleted; see section 9.
6. Cookies, analytics and advertising
Today: none. No Google Analytics, no Google Ads tag, no conversion tracking, no remarketing. If you are reading this looking for a consent banner, there is nothing yet for it to consent to.
We intend to use Google Analytics and Google Ads to understand whether advertising reaches people the product is actually for. Before either tag is enabled, this section will be rewritten to state exactly what is running, and the following will be true:
- What gets added. Google Analytics and Google Ads set cookies or equivalent storage containing a randomly generated identifier, and process your IP address, device and browser information, the pages you view, and the actions we mark as conversions — such as requesting Pro access or asking about a report.
- Conversion tracking. If you arrive from an ad, Google can connect that click to a later action on the site. That connection is the point of the measurement, and it is the main thing we would be disclosing.
- Ad personalization and remarketing. These are separate, and each is a decision rather than a default. If we enable remarketing or personalized advertising, this section will say so plainly, and it will explain that Google may then use the data to show you Deep Oʻahu ads elsewhere.
- Consent. Where consent is required before advertising or analytics storage is read or written, a consent control will actually gate the tags — the tags will not load until consent is given, and withdrawing consent will stop them. A banner that records a choice but loads the tags anyway is worse than no banner, and we will not ship one.
- Google's own terms. Google's use of the data it receives is governed by Google's privacy policy and its advertising and analytics terms, not by this one. We will link to them here and name the specific Google products in use.
- Your controls. We will list them: Google's ads settings, the Google Analytics opt-out browser add-on, our own consent control, and your browser's cookie controls.
Until that rewrite happens, the presence of this section does not mean a tag is running. It means we have written down what we will owe you when one is.
7. Public-record property data, including owner names
Deep Oʻahu republishes government public records about property on Oʻahu. Those records include assessment and ownership information published by the City and County of Honolulu Real Property Assessment Division, parcel geometry and zoning from State of Hawaiʻi GIS, building permits, flood and sea-level-rise mapping, short-term-rental registrations, and other public datasets described on our Data and methodology page.
Some of those records name the owner of a property. Where an owner name appears on Deep Oʻahu, it appears because the county assessor publishes it as a public record. We do not research who lives at a property, we do not add anything the source did not publish, and we do not combine these records with information about you as a visitor.
Correcting a record
We are not the authority for any of it. If an ownership, assessment, permit or zoning record is wrong, the correction has to be made at the agency that maintains it — for assessment and ownership records, that is the Real Property Assessment Division. Once the source is corrected, our copy picks up the change on the next rebuild.
What we can fix ourselves is our own handling: a record joined to the wrong parcel, a stale copy, a decoded field shown incorrectly, or a page displaying something its source does not say. Email us with the page URL, the field, and the source that shows the correct value, and we will look at it.
Removal requests
What we will do. We will suppress or remove information from Deep Oʻahu where the law requires it, where a court orders it, where you are enrolled in an address-confidentiality or similar protection program, or where you can show a credible safety risk from the way our page presents the record. Tell us what the risk is and we will take it seriously.
What we generally will not do. We will not remove a lawfully published public record from the site simply because the person named would prefer it were not visible, because doing so would make the site an unreliable mirror of the record while leaving the record itself public at its source. Removing it here does not remove it there.
8. Who else sees information
We do not sell personal information. We disclose it only to:
- Cloudflare — hosting, network, security and edge delivery for deepoahu.com. Every request passes through it.
- Our own infrastructure — the database, search index and imagery services we run ourselves.
- OpenFreeMap — receives your IP address when the basemap loads, as described in section 3.
- Our email provider — anything you email us is handled by the provider that carries that mailbox.
- A payment processor, once paid products exist, as described in section 5.
- Google, if and when analytics or advertising tags are enabled, as described in section 6.
- Professional advisors — an accountant, attorney or auditor, where genuinely needed.
We may also disclose information where the law requires it or legal process compels it, or where it is necessary to protect the site, our rights, or someone's safety. If Deep Oʻahu is sold, merged or reorganized, information may transfer as part of that transaction, subject to this policy and applicable law.
9. How long we keep things
- Edge and server logs — kept for the period our hosting configuration sets, then discarded.
- Email correspondence — kept for as long as the relationship and any resulting record needs it, and then deleted on request unless we have to keep it.
- Account records — kept while the account exists, and deleted a reasonable period after it is closed, except for what we must keep for tax, accounting or dispute records.
- Billing records — kept as long as tax and accounting law requires, which is longer than the account itself.
- Saved research — if a subscription lapses, saved properties, searches and watchlists are kept read-only for 12 months and can be exported at any time in that window. We do not delete a customer's work to pressure them into renewing.
- Public-record data — retained, including earlier versions, as part of the provenance record of what a source said and when.
10. Security
The site is served over HTTPS. The database is not exposed to the public internet; it is reached through an authenticated tunnel from the edge. Passwords, when accounts exist, will be stored only as hashes produced by Better Auth, and authentication will run behind its own boundary with its own least-privilege database credentials rather than inside general application code. Payment-card data will be handled by the payment processor and not by us.
No system is perfectly secure, and we do not claim otherwise. If you believe you have found a security problem, email us and we will respond.
11. Your privacy rights
Depending on where you live, you may have the right to know what personal information we hold about you, to get a copy of it, to correct it, to delete it, to limit certain uses, and not to be treated differently for exercising those rights. To exercise any of them, email peter@deepoahu.com and describe what you are asking for. We may need to verify who you are before acting, particularly for a deletion request.
Two limits are worth stating honestly. First, a right to delete does not reach a public record we republish from a government source; see section 7. Second, we may keep what we are legally required to keep.
California
The California Consumer Privacy Act, as amended by the CPRA, applies to a business only if it meets one of three thresholds: annual gross revenue above the statutory figure (US$25 million as enacted, adjusted for inflation); buying, selling or sharing the personal information of 100,000 or more California consumers or households a year; or deriving 50 percent or more of its revenue from selling or sharing personal information. Deep Oʻahu does not currently meet any of them, and it does not sell or share personal information at all.
Hawaiʻi
As far as we are aware, Hawaiʻi has not enacted a comprehensive consumer data-privacy statute of the California or Colorado kind. Hawaiʻi does have laws on security-breach notification and the destruction of personal-information records, and those apply to us.
Outside the United States
Deep Oʻahu is operated from the United States and is about property in Hawaiʻi. Information is processed in the United States. We do not target the site or its advertising at the European Economic Area or the United Kingdom, and we do not currently offer GDPR data-subject rights as such. If you are outside the US and use the site anyway, you are sending information to the US.
12. Children
Deep Oʻahu is a professional and consumer research tool for property. It is not directed to children, we do not knowingly collect personal information from anyone under 13, and accounts, when they exist, will not be offered to them. If you believe a child has given us personal information, email us and we will delete it.
13. Changes to this policy
We will update this page when the product changes. The effective date at the top always says which version is in force. For a material change — new categories of information, a new class of recipient, accounts, billing, analytics, or advertising — the update is published before the change goes live, not after, and we will say what changed.
14. Contact
Privacy questions, corrections, removal requests and rights requests all go to peter@deepoahu.com. Include the page URL and the property or field where that is relevant.