What we hold, and what we do with it

What you give us

To prepare an appeal package we need your name, mailing address, phone number and email; the property’s address and OPA account number; the rent it collects and the expenses it incurs; the capitalization rate you choose; and any photographs you upload. All of it appears on the forms you file, which is the only reason we ask for it.

What we keep out of our logs

Your name, mailing address, phone number, email, OPA account number and financial figures are treated as sensitive throughout. The service is designed so that these are kept out of our application logs and redacted from error reports: when something goes wrong we record that it went wrong and where, not what you had typed at the time.

That is a description of how it is built rather than a guarantee about every line of code that will ever run. If we find somewhere a sensitive field could reach a log, we fix it.

Photographs

Photographs are re-encoded in your browser before they are uploaded, which is intended to remove every embedded metadata tag, including the GPS coordinates most phones record. The aim is that the location data attached to your photos does not leave your device at all. Metadata is stripped again on our side, because a browser that could not process the file sends it untouched.

Photographs are held in private storage. They are not publicly addressable, and the only way to read one is through a link we sign on request, which is short-lived and designed to expire a couple of minutes after it is issued.

Leases you upload

If you attach a lease it is held in private storage on the same terms as your photographs: not publicly addressable, and readable only through a short-lived link we sign on request. It is attached to the end of the package you download, because that is what the city asks to see.

A lease names your tenant and usually carries their signature, so you are uploading somebody else’s information as well as your own. We read a PDF once to find the monthly rent, show you the sentence it came from, and keep no other text out of it. We do not use it for anything else, and it goes wherever you send your package and nowhere we send it.

Your signature

If you sign your appeal on screen, the signature you draw stays in your browser. It is sent once, with the request that produces your package, and we do not keep a copy of the image. There is nothing to delete and nothing for anyone to reach: if you need to sign again, you draw it again.

It does appear on the finished package, the same way it would if you had signed a printed form and scanned it. That file is kept so you can download it again, in the same private storage as everything else, and it already contains your name, your address and your figures.

Your finished package

A copy of each package is kept so you can download it again without rebuilding it. It is stored in the same private storage as photographs, under the same rules. We do not send it anywhere, and in particular never to the city. Filing is your own action, and nothing in this software is capable of doing it for you.

What leaves the service

The city’s property records. When you search for your property, the address you typed is sent to the City of Philadelphia’s public records endpoint so we can find the parcel and read the assessment the city already holds. That is a city service and the city’s own terms apply to it. Nothing else about you is in that request.

Stripe, when you pay. Card details go straight to Stripe and never touch this site: there is no card field here, and we never see, hold or store a card number. Stripe is also given your email address, so it can send you a receipt, and the property address, so the receipt says what you bought. Nothing else about your appeal is sent, and Stripe never sees your figures.

That is all of it. Nothing else you enter is sent outside the service, and in particular your appeal is never sent to the city by us.

Who can see your appeal

You can. The database is configured to enforce that at the row level rather than trusting the application to remember, so that a request carrying your session reads your rows and not anyone else’s. Before you have created an account, your appeal is tied to a signed cookie your browser holds, which also means that clearing your cookies without signing up will lose access to it.

Our own staff can reach stored data for support and maintenance. There is no honest way to say otherwise about a hosted service.

Cookies

One cookie, containing a signed random identifier that ties your browser to your in-progress appeal. It is set so that JavaScript cannot read it, and it is not used to track you anywhere. Your draft is additionally kept in your browser’s local storage so that closing the tab does not lose your work; that copy never leaves your device except when it is saved to your appeal.

Philly Appeal runs no advertising trackers, and fonts are served from this site rather than fetched from Google, so loading a page does not tell an advertising network that you visited.

We do count visits, using Vercel Web Analytics, so we can see which pages people find and where they give up. It sets no cookie. Instead of identifying you, it derives a hash from the request, which means a visitor cannot be followed from one day to the next or from this site to another. What it records is the page path, the referring site, and coarse details such as country and browser.

Page paths are safe to report here because nothing personal is ever in one: the wizard keeps your address, your figures and your account number out of the URL, so a recorded path reads “/appeal/new/expenses” and never says whose expenses.

If you ask us to email you

After the free check, and in a few other places, we offer to email you a reminder before the filing deadline. That is optional, nothing about your appeal depends on it, and we do not add you because you typed an email address somewhere else on the site: you have to ask.

If you do ask, we keep your address, and the property address and tax year if you gave them, so a reminder can say which property it is about. We use it to send deadline reminders and occasional email about the service. We do not sell it, rent it, or pass it to anyone else for their own marketing.

Every message carries an unsubscribe link that works without a password, an account, or a reply. One click and we stop.

How long we keep it

Five years from your most recent package, after which your appeal, its photographs and any leases you attached are deleted or de-identified, unless a longer period is needed to meet a legal, tax or accounting obligation.

Five years because an appeal is an annual document and the figures behind one are the starting point for the next: an owner who comes back in three years should not have to reconstruct what they filed. You can ask us to delete everything sooner at any time, and we will.

Asking for your data, or its deletion

You may ask us to give you a copy of what we hold about you, to correct it, to delete it, or to stop writing to you. Write to support@phillyappeal.com and we will respond within a reasonable time. Deleting an in-progress appeal removes the figures, the photographs and any package generated from them.

If a breach ever affects your personal information, we will notify you as Pennsylvania law requires.

Children

This is software for property owners. It is not directed at children and we do not knowingly collect anything from them.

Changes

If this page changes in a way that affects what we do with your information, the date below changes with it.

Last updated 20 August 2026.