Terms of Service

Accounts

You can create an account on /signup and sign in on /login. Signing up stores an account record and signs you in with the ferrum_session cookie; both are described below under "Sign-in" and "Forms that store what you type". No verification or password-reset email is sent while no mail service is set up. /account shows your account and lets you sign out, which ends the session. Using the rest of the preview needs no account.

Stored in your browser

This site writes the keys below to your browser storage. The values stay in your browser, and the tools may use them when they make the requests listed further down. If your browser blocks storage, values are kept in memory for the page session only. Clearing site data removes them.

Information you send to this site's server

Forms that store what you type

Footer newsletter (every page)

Sent: Email address; the name is set to the text before the "@".Stored as: A record in the site database (name, email, product, source page, state, message, time).

/contact

Sent: First and last name, email address, subject and message.Stored as: A record in the site database (name, email, product, source page, state, message, time).

/demo

Sent: First and last name, email address, company and message.Stored as: A record in the site database (name, email, product, source page, state, message, time).

/dashboard and /project-workspace/projects (early access)

Sent: Name and email address.Stored as: A record in the site database (name, email, product, source page, state, message, time).

/products/transact waitlist

Sent: Name, email address and state.Stored as: A record in the site database (name, email, product, source page, state, message, time).

/products/transact case flow

Sent: Role (buyer or seller), contact name and contact email; then, if you use those steps, KYC (full name, document type, last four characters of a document reference), a scheduling request (date and time window) and a file upload.Stored as: Records in the site database. A file upload returns an error unless a storage bucket is bound; whether one is bound on the deployed Worker: UNAVAILABLE from the repo.

/signup

Sent: Email address, password and an optional name.Stored as: An account record in the site database: your email address, the name if you gave one, a salted PBKDF2 hash of your password (the password itself is not stored), whether your email is verified, and the time. It also creates a sign-in session and a one-time email-verification code record. No verification email is sent while no mail service is set up; the Ferrum team verifies accounts instead.

/login

Sent: Email address and password.Stored as: A sign-in session record (session id, your account, expiry) when the password matches. Every attempt, successful or not, also stores a rate-limit record (see "Rate limiting").

/forgot-password and /reset-password

Sent: Email address; then a reset code and a new password.Stored as: While no mail service is set up the server refuses the request before looking up the email, and stores nothing. With a mail service, a one-time reset code record is created, and a completed reset replaces the password hash.

/build/projects (Ferrum Build project workspace; signed-in project members only)

Sent: What members record on a project: issues, schedule stages, QC checklists, inspections and sign-offs, site work orders, daily logs, measurements and material receipts, quote selections, contract and milestones, invoices, payments and certifications, variations, snags, handover and warranty records, and photo records.Stored as: Records in the site database, tied to the project and to the member who made each change, with a time. History tables are append-only (the database refuses edits and deletions). Photo files are not uploaded: photo storage is not set up, so the upload routes answer "storage not configured".

/build/start (Ferrum Build project enquiry)

Sent: Building type, service mode and packages, project stage, city, locality and PIN code, area and unit, budget range, target start and finish, drawings, whether you want a consultation or a site visit and your preferred time, your name, phone number, optional email, whether WhatsApp is OK, and your consent.Stored as: A record in the site database with a reference number, a status and a history of status changes. Ferrum staff read and update it in the Build staff console.

Tools that send your entries to be computed

The Worker computes a result from what you enter and returns it. Nothing from these requests is stored except the rate-limit record described below.

IS check

Sends: Structure type and parameters.

IRR / NPV modeler

Sends: Cash flows and discount rate.

Ask-band estimator

Sends: Base value and urgency.

Stamp-duty estimator

Sends: The state you choose.

ULPIN lookup

Sends: The ULPIN you type.

CDE status (CommunityBuild page)

Sends: A project id.

Investment fit (LandIntel)

Sends: The looked-up parcel's state, district, area, land use and record status, plus the use, budget, asking price, growth assumption, holding period and target return you enter; no ULPIN, name or contact. When a judgment server is connected, the server sends a text summary of them to Ferrum's self-hosted judgment model; it stores none of them (only the rate-limit record below).

Views that need a session

The account and saved-work views (/account, /account/workspace, /project-workspace/projects), the command box in the workspace and the "Save to workspace" button on tools call routes that need a signed-in session. If you are not signed in, the server answers "unauthorized" before reading or storing what was sent. If you are signed in, "Save to workspace" stores that tool result (with its type, title and source) as a saved item under your account, the saved-work views store the projects and items you create there, and a share link you create stores a share code for that item. The workspace command box sends the text you typed for an answer and does not store it.

Recorded automatically by the server

Hosting

This preview runs on Cloudflare Workers with a Cloudflare D1 database. Cloudflare handles every request to it, including your IP address.

Rate limiting

For every API route that is rate limited, the Worker stores your IP address (as Cloudflare reports it), the route name and a time in the site database. Sign-up and sign-in attempts are also limited per email address: each attempt stores a record of the email address with the word "signup" or "login" and a time. No job that deletes these rows, or the form submissions above, was found in the code. Retention: UNAVAILABLE.

Request logs

Cloudflare Worker logging is switched on and persisted, with query strings redacted. The code adds events with the route (ids removed), method, status, duration and a request id. What else Cloudflare logs, and for how long: UNAVAILABLE from the repo.

Crash reports

If a page crashes, the browser sends the error name, message, page path and component stack so it can be logged. Query strings, form contents and cookies are not included.

Coarse region

On every page the SUTRA widget asks the Worker for a coarse country, region and time zone that Cloudflare derives from your connection; the response is marked as not persisted.

Payment demo

The payment demo on /products/transact creates an order record with a fixed illustrative amount (no name or email). Without Razorpay keys the Worker simulates the payment. Whether keys are set on the deployed Worker: UNAVAILABLE from the repo.

Email and payment providers

The Worker code can call api.resend.com (email) and api.razorpay.com (payments) when the matching secrets are set. Whether they are: UNAVAILABLE from the repo.

Third-party origins your browser may contact

Every host below receives your IP address and standard browser request headers by virtue of the request. Requests are subject to this site's Content-Security-Policy: a request the policy does not allow is blocked by the browser before it is sent.

tile.openstreetmap.org

Map tile images for the parcel map.Carries: Tile coordinates of the area you view.Seen contacted on build 981a13d2

unpkg.com

Leaflet marker icon images on the parcel map.Carries: A static image request.Seen contacted on build 981a13d2

tiles.openfreemap.org

Map style and vector tiles for the 3D site map.Carries: Tile coordinates of the area you view.Seen contacted on build 981a13d2

checkout.razorpay.com

Razorpay's checkout script, requested from the /products/transact page (payment demo). On build 981a13d2 the script in turn contacted cdn.razorpay.com, lumberjack.razorpay.com (a beacon) and api.razorpay.com (a hidden frame).Carries: What Razorpay's script stores or sends is defined by Razorpay, not by this code: UNAVAILABLE.Seen contacted on build 981a13d2

nominatim.openstreetmap.org

Place search and reverse geocoding in the ULPIN map explorer.Carries: The place text you type, or the coordinates you pick.Not seen on build 981a13d2

power.larc.nasa.gov

NASA POWER climate data for a site.Carries: Site latitude and longitude.Not seen on build 981a13d2

rest.isric.org

ISRIC SoilGrids soil properties for a site.Carries: Site latitude and longitude.Not seen on build 981a13d2

s3.amazonaws.com

Terrain elevation tiles (AWS open data, elevation-tiles-prod).Carries: Tile coordinates around the site.Not seen on build 981a13d2

api.frankfurter.dev

Currency exchange rate for cost estimates.Carries: A currency pair only.Not seen on build 981a13d2

overpass-api.de

OpenStreetMap building footprints and roads around the site for the 3D site context (Overpass API, first endpoint tried).Carries: A bounding box around the site latitude and longitude.Not seen on build 981a13d2

overpass.kumi.systems

The same OpenStreetMap buildings-and-roads query, tried only if overpass-api.de returns no usable answer. Both are the default endpoints; a build can replace them (NEXT_PUBLIC_OVERPASS_ENDPOINTS).Carries: A bounding box around the site latitude and longitude.Not seen on build 981a13d2

Hosts marked "not seen" are requested by the code when you use the matching tool. On build 981a13d2 the site's Content-Security-Policy did not list them, so the browser blocked those requests before sending them.

Device location

The "My location" control and the device-location button in the site-observation form ask your browser for your position only when you press them. The position is kept in this browser (the local parcel context or the site-observation record); this site's server is not sent it.

Not found in this build's code

Searched for on 2026-09-21; none was found:

• Analytics, advertising or tracking scripts.
• Page code that sets a cookie. The sign-in cookie (ferrum_session) is set by the server, not by page code; the one other cookie seen on the live build, rzp_unified_session_id, was set by Razorpay.

Retention periods, deletion requests and access requests: UNAVAILABLE until the operator publishes a procedure.