Privacy Policy

1. Who we are and what this covers

Appraise Assist Commercial is made by Ruby Appraisals, Inc ("we", "us"). It is a plugin for Claude Code, in the Claude desktop app, for commercial real-estate appraisers, and it is in early access.

This policy covers the plugin, our instructions server and plugin downloads at commercial.appraise-assist.com, and the pages on this site. It applies to the appraisers who use Appraise Assist Commercial and to visitors to these pages. It does not cover Claude, Google or any other service we do not run.

2. Your documents are kept on your PC

The plugin runs on your own Windows PC, in the Claude desktop app.

• It reads your firm's reports and workfiles in place on that PC.
• It writes its own records there: your firm's profile, the wiki of your past reports, and the records of each job.
• Every change to a report is a tracked change in a new file on your PC.
• It never opens anything in a folder named PII.

None of your firm's documents, reports, workfiles or wiki is sent to our servers. We have no copy of them. What Claude reads from them while it works is a different matter: Anthropic processes it, as section 4 explains.

3. What our servers receive and keep

Your seat

When we give an appraiser a seat, we record the appraiser's name and email address, the date the seat was added, its last day, the date it was revoked if it was, and a random seat number. We keep this in a seat list on our server.

We use the seat list to decide who may sign in and, when we look into a problem or unusual use, to tell which seat a log code belongs to. When Claude asks for the status of your seat, we tell it whether the seat is active and its last day.

We keep a seat's entry while the seat is in use, and for one year after the seat ends. Then we delete it. You can ask us to delete it sooner (see section 10).

Signing in with Google

• When you sign in, your browser goes to Google, where you choose your Google account. We ask Google for three standard sign-in permissions: openid, email and profile. From what Google sends back we use only your verified email address and your name. We never receive your Google password, and we do not ask for access to your mail, files, contacts, calendar or anything else in your account.
• We use your email address to check it against a seat. We show your email address and name back to you on the page where you allow Claude to use Appraise Assist Commercial.
• Until Google has told us your email address, and it matches a seat, we keep nothing about your sign-in. What the sign-in needs travels, sealed, inside the web addresses your browser follows. If your email address matches no seat, we show it back to you on a page that says so, and keep nothing.
• We do not save what Google tells us about you. Once your email address matches a seat, the server holds your email address, your name and your seat number in its memory, never on disk, until you press Allow or Cancel. If you press neither, they are good for 15 minutes at most, and the server clears them from its memory at its next request; restarting the server clears them too.
• The server holds at most five such sign-ins for one seat, and the oldest goes when a sixth comes.
• After you press Allow or Cancel, the server remembers for one minute, and never past those 15 minutes, the web address it sent your browser to. That address holds a one-time code for Claude, or a refusal, and not your name or email address. It is kept so that a double-click on Allow does not send you round again.
• The sign-in sets one cookie in your browser, for 15 minutes at most, to tie the sign-in to that browser. It holds a random number and nothing about you, it is sent only to the sign-in pages, and it is removed when you press Allow or Cancel. The server keeps only a one-way hash of that number.
• Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Sign-in tokens

After you press Allow, our server gives Claude Code on your PC an access token that lasts about an hour and a refresh token that lasts about 60 days from the last time it is used. Each renewal gives Claude a new pair, and the access token it held before simply runs out in its own hour. They are random and hold no name or email address.

We keep only a one-way hash of each, with your seat number, the name and return address of the program that asked, which sign-in the token belongs to, and when it was made and when it ends. We keep no list of the programs that ask to sign in.

For each sign-in we also keep the hashes of its last 20 used refresh tokens, so that we can tell when one is used a second time. If that happens after the first minute, we end that whole sign-in and you sign in again.

When a token ends, we delete its record the next time the server updates its sign-in file, which happens whenever anyone signs in or renews a sign-in. When the seat list changes, the server deletes the tokens of a seat that is no longer good the next time anyone asks it for an instruction. Each request is checked against the seat list, so when a seat ends, its sign-in stops on the next request.

If you connect through Claude on the web instead of Claude Code on your PC, the tokens are held by Anthropic's servers rather than on your PC.

The request log

Each time Claude Code fetches or lists an instruction, asks for status, or is refused, and each time a sign-in ends, our server writes one line to its log.

A line holds the time, the kind of request, a code for the seat when one applies (a refused request or a sign-in that fails has none), the name of the instruction asked for, the instruction set and plugin version, the result, the size of the answer and the time taken.

The seat code is made from the seat number with a secret key, so it is neither your name nor your email address. Only we hold the key that links a seat code to a seat.

A line never holds your email address, your name, your internet address, details of your browser, a token, a document, or the text of an instruction.

When the plugin asks for an instruction, it sends our server a sign-in token, its own version numbers and the name of the instruction it wants. It sends no document, file name, job number or anything about a client.

The lines stay on our server in a log of fixed size that keeps only the latest lines. Older lines are discarded automatically, but only as the log fills, so while there are few seats a line can stay for many months. We have set no shorter time.

From the log we may make a daily count of requests for each seat code and each instruction. We keep such a count for no more than 90 days.

These pages and the downloads

These pages and the plugin downloads are plain files. They run no script, set no cookies and load nothing from other sites. The server that serves them keeps no access log, and the web proxy in front of it is not set to keep one. To answer a request our server must see your internet address, but it does not record it.

If you write to us

If you email support@appraise-assist.com, we receive your email address and what you write. We use them only to answer you. We keep what you send for 30 days after your question is resolved, then delete it. Please do not send a client's documents.

Problem reports

If a tool fails in a way the agent cannot fix, or you say something is wrong, the agent can offer to make a problem report for us. It shows you the exact text first, and nothing is sent or saved unless you say yes.

A report holds the plugin's version and a fingerprint of its code, the kind of computer, the date, the job's number (never its folder), the tool that failed and the refusal's code, the step the agent was at, and the words you gave.

The plugin puts in no document, no paragraph of a report, and no figure, name or address from a job. It takes your firm's own names, job numbers and folder paths out of your words, and any path, dollar amount, acreage, square footage, street address or company name it can tell by its shape.

It cannot tell a person's name or a place, so please read the whole text before you say yes.

Today a yes saves the report as a text file in the support folder of the plugin's data folder on your PC, and you email that file to support@appraise-assist.com. That email is how it reaches us. If a later version can send a report from the plugin itself, it will still do so only on your yes, and only to an address of ours.

How long we keep things

• A seat's entry: while the seat is in use, and for one year after it ends. Then we delete it.
• Your email address and name during a sign-in: in the server's memory only, until you answer, and for 15 minutes at most.
• Sign-in tokens: an access token for about an hour and a refresh token for about 60 days from its last use. Their hashes are deleted the next time the server updates its sign-in file after they end.
• Request log lines: in a log of fixed size, until newer lines push them out. We have set no shorter time.
• Daily counts made from the log: no more than 90 days.
• What you email to support: 30 days after your question is resolved.

4. Claude and Anthropic

The plugin works inside Claude Code. Your conversation with Claude, and every document Claude reads for you, are processed by Anthropic under your own Claude account and Anthropic's terms and privacy policy. We do not see that conversation or those documents, and we do not receive them.

What Anthropic does with them is set by your firm's agreement with Anthropic, not by us. Check that agreement against your clients' and your firm's confidentiality rules before you use real client material.

The instructions our server sends do pass through Claude into your conversation, so Anthropic's systems and Claude's session history on your PC hold them too. They are our confidential material.

5. Google

Signing in with Google is provided by Google and is covered by Google's own privacy policy. We use only your verified email address and name from it, as described above.

6. Other sites the plugin's work reaches

Two things the plugin does reach sites that are not ours, and neither goes through our servers.

The pages the plugin writes on your PC load a few public files when you open them in your browser: the report editor loads two scripts from the public script hosts of Cloudflare and jsDelivr, and the wiki site and the paired-sales exhibit load fonts from Google Fonts. Your browser asks those servers, so they see the request and your internet address. The text of your report is not in it.

The research agents also look public records up on the web, with Claude Code's own web search and page fetch. What they send is the parcel or account number, the address and the county, and never your documents, a client's or lender's name, a fee or a value. The public-record sites they read, and the search service Claude Code uses, see those words. Each of these sites handles what it receives under its own privacy policy.

7. What we do not do

• We do not sell your information.
• We do not share it for advertising.
• We do not use it, or anything the plugin handles, to train AI models.
• We use no analytics, advertising or tracking services.

8. Who we share information with

We rely on a small number of service providers. Akamai Cloud (Linode) hosts our server, and Google provides sign-in. Each handles information under its own privacy policy. We may also share information if the law requires it, or to protect the rights, property or safety of our users, of others or of ourselves.

9. Security

We use HTTPS for all traffic to our server. Sign-in tokens are kept only as one-way hashes. We limit access to the seat list, the tokens and the log to the people who run the service. No system is perfectly secure, and we cannot promise that information will never be reached without permission, but we work to keep it protected.

10. Your choices and rights

You can write to support@appraise-assist.com at any time and ask us to show you the information we hold about you, correct it, delete it, or end your seat. We will answer promptly, and within any deadline the law sets. We may keep a record where the law requires or allows it.

When a seat ends, its sign-in stops working on the next request.

If you live in a state with its own privacy law, you may have more rights. Write to us and we will honor the ones that apply.

11. Children

Appraise Assist Commercial is a professional tool for appraisers and their staff. It is not directed to anyone under 18, and we do not knowingly collect information from anyone under 18.

12. Changes to this policy

We may update this policy as the service changes. When we make a material change, we will change the date at the top and, where appropriate, tell seat holders by email.

13. Contact

Questions about this policy or your information? Write to support@appraise-assist.com.