True Mortgage Cost

Legal

Privacy Policy

Last updated: October 2026

This Privacy Policy explains how mortgagebystate.com ("we", "us", "our") handles information about visitors. It applies to this site only; links to third-party sites are governed by their own policies.

1. What we do NOT collect

mortgagebystate.com does not require you to create an account, log in, or submit any personal information to use the calculators or read the guides. We do not ask for your name, email, phone number, Social Security number, address, income, credit score or any other personally identifying information for the calculator to work.

The values you enter into the calculator (home price, down payment, interest rate, property tax rate, insurance, HOA) are processed entirely in your browser using JavaScript. These numbers are not sent to our server and are not stored or logged anywhere.

2. What we DO collect automatically

Like most websites, our hosting provider automatically logs some technical information when you visit a page:

  • IP address (used for security, rate limiting and geographic analytics; stored for up to 30 days then deleted)
  • Browser type and version (User-Agent header)
  • Pages visited, timestamps, and referring URL
  • Approximate location (country/state level, derived from IP)

This information is used to maintain and improve the site, prevent abuse, and produce aggregated usage statistics. It is not sold.

3. Cookies

We use a small number of cookies:

  • Session cookies — set by our server to maintain basic browser state (e.g. CSRF token). Expires when you close the browser.
  • Analytics cookies — Google Analytics 4 sets cookies (_ga, _ga_*) to measure anonymous site usage. Expiry up to 2 years. See Google's privacy policy.
  • Advertising cookies — Google AdSense and its partners may set cookies to personalize ads based on your interests. See Google ad settings for details and opt-out options.

You can refuse cookies in your browser settings; the calculators will still work. In the EU/UK you will see a consent banner on your first visit.

4. Third-party services we use

We rely on these third parties to run and monetize the site:

  • Cloudflare — DNS, caching and DDoS protection. Cloudflare may process your request headers. Policy.
  • Google Analytics 4 — anonymized usage analytics with IP anonymization enabled. Policy.
  • Google AdSense — displays ads and may use cookies for personalization. Policy.
  • Hetzner Online — our hosting provider. Server logs are retained per their German data protection standards. Policy.
  • Backblaze B2 — encrypted backup storage. No visitor data is backed up (only our own site files and the mortgage database schema). Policy.
  • FRED (St. Louis Fed) — we fetch public mortgage rate data from FRED weekly. No visitor data is sent to FRED.

5. Your rights under GDPR (EU/EEA, UK)

If you are in the European Union, European Economic Area, or United Kingdom, you have the following rights with respect to personal data about you:

  • Access — request a copy of any data we hold about you
  • Rectification — correct inaccurate data
  • Erasure — request deletion ("right to be forgotten")
  • Restriction — limit how we process data about you
  • Portability — receive your data in a machine-readable format
  • Objection — object to processing based on legitimate interests
  • Withdraw consent — withdraw cookie consent at any time via your browser settings

Because we do not require accounts and do not store PII, in most cases we hold no identifiable data about you. For analytics/ads data held by Google, use Google Ad Settings and GA opt-out.

To exercise GDPR rights with respect to our server logs: [email protected].

6. Your rights under CCPA (California)

California residents have the right to:

  • Know what personal information is collected about you
  • Request deletion of personal information
  • Opt out of sale of personal information (we do not sell personal information)
  • Non-discrimination for exercising these rights

To make a CCPA request: [email protected].

7. Children's privacy (COPPA)

mortgagebystate.com is not directed to children under 13 and we do not knowingly collect personal information from children under 13. If you believe a child under 13 has submitted information through our site, contact us at [email protected] and we will delete it.

8. Data security

The site runs on HTTPS. We use industry-standard security measures to protect server access (SSH key authentication, firewalling, fail2ban, regular updates). No system is 100% secure; we cannot guarantee that no breach will ever occur, but because we do not store personal data, the impact of any breach would be minimal.

9. International data transfer

Our server is located in Ashburn, Virginia, United States. By using the site from outside the US you consent to transfer of technical information (IP, headers) to the US. Google Analytics and AdSense may transfer data to other Google data centers worldwide; see Google's privacy policy.

10. Changes to this policy

We may update this Privacy Policy as the site evolves or as laws change. The "Last updated" date at the top reflects the most recent change. Significant changes will be announced on the home page for at least 30 days.

11. Contact

For any privacy question or request: [email protected]

See also: Terms of Service · Disclaimer