Privacy Policy

Who We Are and What This Policy Covers

The Roofing Book is a free, sourced roofing reference directory — building materials, products, manufacturers, suppliers, trade organizations, and per-jurisdiction roofing permit and code requirements — operated as a sole proprietorship by an individual owner based in Colorado, United States ("The Roofing Book", "we", "us", or "our"). You can reach us at [email protected]. We do not yet publish a postal mailing address; see "Contact Us" for what we are doing about that and what it means for marketing email.

This Privacy Policy (the "Policy") covers the website at theroofingbook.com, including its subpages and the small number of server functions that power its forms and purchases (together, the "Site"), and the digital products we sell called "Supplement Packs" (see https://theroofingbook.com/supplements/). It does not cover third-party websites we link to, including the official government sources we cite and the Stripe-hosted checkout pages described below — those are governed by their operators' own policies.

The Site is directed to a United States audience. Your use of the Site is also governed by our Terms of Use, published at https://theroofingbook.com/terms/ in the same deployment as this Policy and sharing the same operator identity, contact address, and Colorado governing law. This Policy is effective as of July 21, 2026.

Summary of Key Points

• No accounts, no tracking. The Site has no user accounts or logins, sets no cookies of its own, and runs no analytics, advertising, or tracking scripts of any kind. Our host, Cloudflare, may set a short-lived, strictly necessary security cookie at the platform level to protect the Site from bots and abuse; we receive no analytics from it and do not use it to identify you. The only thing we store in your browser is a light/dark theme preference.
• You control what we receive. We only receive personal information when you deliberately submit a form on the Site, complete a purchase through Stripe, or email us.
• The estimate form is a contractor-matching form. Submitting it is a request to be contacted about your roofing project by phone, text, or email. As of the effective date of this Policy, we have no partner contractor arrangements in place and no contractor has received any information submitted through this Site — estimate submissions go to our operator inbox and stay there. The four conditions we will satisfy before any lead is shared with a contractor (written contracts, a published and capped partner list, a compliant consent checkbox with notice at the point of collection, and an updated version of this Policy) are set out in "How We Share Your Information" below.
• We do not currently sell or share personal data. If lead-sharing for compensation begins, some state laws may treat it as a "sale," we will say so here first, and you can opt out at any time — see "Do We Sell or Share Personal Data?"
• Everything else stays with our service providers. Stripe (payments), Resend (email delivery), and Cloudflare (hosting and storage) process data on our behalf as described below. We do not sell email lists or any other personal information.
• No newsletter has been sent yet. Checking the optional newsletter box records your interest. We will not send marketing email until we can include a valid physical postal address and a working unsubscribe link in every message, as CAN-SPAM requires.
• Email-based rights for everyone. You can request access, correction, deletion, or opt-out at any time by emailing [email protected], and we honor these requests for all users regardless of what state you live in.

Information You Provide: Free Cheat-Sheet and Supplement Interest Form

Many pages of the Site, including https://theroofingbook.com/supplements/, include a short email form for requesting our free cheat sheet or expressing interest in a Supplement Pack. Through this form we collect:

• Email address (required);
• Jurisdiction (optional — either a city/state you type in, or the name of the page you were on, which the form pre-fills);
• Which offer you requested (cheat sheet or supplement interest).

The form also contains a hidden field that is invisible to human visitors and used solely to detect spam bots (a "honeypot"); it collects nothing from real users.

When you submit this form, our server sends two emails through our email delivery provider, Resend: one to you (the requested content or a confirmation) and one notification to our operator inbox containing your email address and the jurisdiction you entered. This form does not write to any database. Our record of your submission is the notification email in our inbox, plus the delivery logs Resend keeps as our email provider. Information from this form is used to fulfill your request and, if you expressed interest in a Supplement Pack, to reply to you about it. It is not shared with contractors and is not sold.

Notice at the point of collection. A link to this Policy and to our Terms of Use appears directly beneath the submit button on this form, and in the footer of every page of the Site. You can also email us at any time to ask what we hold about you or to have it deleted.

Information You Provide: Instant Estimate and Contractor Match Form

Our Colorado permitting pages include an instant-estimate widget. It works in two distinct steps, and the difference matters for your privacy:

• Step 1 — the estimate itself. You enter roof details (approximate square footage, number of stories, pitch, and material) and the estimate range is calculated entirely inside your browser from pricing data built into the page. Nothing from Step 1 leaves your device, and seeing your estimate never requires giving us contact information.
• Step 2 — requesting contractor contact. If you choose to submit the form, your browser sends us: your name, phone number, and/or email address; the roof details and estimate range from Step 1; your project timeline; how you expect to pay for the project (for example, cash, financing, or an insurance claim); the page and location the form was submitted from; whether you checked the consent checkbox (required — see "Phone and Text Communications"); and whether you checked the optional newsletter checkbox. The form also includes a hidden anti-spam honeypot field that collects nothing from real users.

Lead priority tier. From the timeline and payment-intent answers you give us, our server automatically assigns your submission a simple priority label (for example, insurance-claim-ready and urgent, qualified, or researching) and includes it in the notification email so we know which requests to answer first. This label is derived only from answers you provided, is used only to prioritize follow-up, and is not used to decide your price, your eligibility for anything, or any other outcome. If we ever begin forwarding leads to contractors, the label travels with the lead, and we have listed it in the shared-field list below for that reason.

Why the consent box is required. Step 2 exists for one purpose: to get you contacted about your project. We cannot arrange that without your permission to contact you, so the form will not submit unless the box is checked. To be clear about what that does and does not mean — consent is not a condition of buying anything from us, and it is not required to use any free part of the Site, including the estimate calculator itself. If you do not want to be contacted, do not submit Step 2; you still get your estimate.

When you submit Step 2, our server sends a lead-notification email (containing all of the fields above, the priority label, and a line recording that the consent box was checked, with a timestamp generated on our server when the submission is processed) through Resend to our operator inbox, and, if you provided an email address, a confirmation email to you with your estimate. As with the cheat-sheet form, this form does not write to any database; our record of your submission and your consent is that notification email.

What our consent record does and does not contain. Being precise about this matters: today the record is a single email containing the fact of the checkbox, a server-side timestamp, and the data you submitted. It does not include your IP address, your browser user agent, the exact wording of the disclosure as it was displayed to you, a version identifier for that wording, a snapshot of any contractor list, or a third-party consent certification. Before any lead is transmitted to a contractor, we will capture those elements server-side for every submission; we will not rely on today's thinner record to justify calls or texts by anyone else. We will retain consent records — and any revocation — for at least four years after the last contact with you.

Please do not include sensitive personal information (such as health information, government ID numbers, or financial account numbers) in any form field; the form does not ask for any of these, and we do not want them.

Information Collected When You Buy a Supplement Pack

Supplement Packs are sold through Stripe Payment Links. When you click a "buy" button on the Site, you leave theroofingbook.com and complete checkout on a page hosted by Stripe (stripe.com / buy.stripe.com). Stripe — through its Managed Payments service — is the merchant of record for these purchases: Stripe collects your name, email address, and payment card details, handles applicable sales tax, and maintains the full transaction record. Your payment card information is collected and processed entirely by Stripe and never touches our systems. Stripe's handling of your data is governed by Stripe's own privacy policy.

After a completed purchase, Stripe notifies our server, which receives a limited subset of the transaction data:

• Your email address (so we can deliver your purchase);
• The amount paid (used to identify which product you bought);
• For Single City Pack purchases, the jurisdiction you typed into the checkout's "Jurisdiction (City, State)" field;
• Stripe's internal event and session identifiers.

We use this information to email you your purchased files through Resend — a download link that expires after 7 days, and, for smaller single-city PDFs, the PDF itself as an attachment — and to send a sale notification, containing your email address and jurisdiction input, to our operator inbox. If your jurisdiction entry cannot be matched automatically or a file is unavailable, we fulfill your order manually, and the notification email we use to do so also contains your email address and jurisdiction text.

To prevent processing the same purchase twice, our server stores a small marker in our Cloudflare R2 storage recording the Stripe event ID and a timestamp. This marker contains no personal information — no name, email, or payment details. The download links we email you contain only a file identifier, an expiry time, and a cryptographic signature; they contain no personal information about you, and the download endpoint itself collects none.

Information You Send Us Directly, and Information Collected Automatically

Email you send us. The Site includes email links (for example, for corrections, listing claims, or general contact). Anything you choose to email to [email protected] comes to our operator inbox and is retained there as ordinary email correspondence.

Server and hosting logs. The Site is hosted on Cloudflare. Like essentially every website host, Cloudflare processes standard technical information about requests to the Site — such as IP address, browser type, and pages requested — in order to deliver the Site, protect it from abuse, and keep platform-level logs. This happens at the hosting layer for all visitors; we do not use this information to identify or profile you, and we run no analytics on top of it. In rare error conditions — for example, if an email delivery fails — a diagnostic log entry at our host may include the email address involved in the failed delivery. We are changing the code so that addresses are stripped from those log entries; we disclose it here because it can happen today.

What we do not collect. The Site collects no precise geolocation, no biometric information, no government identifiers, and no health, financial-account, or other sensitive personal information, and we do not knowingly want any of these submitted through free-text fields. The Site's search feature runs entirely inside your browser against a pre-built index — your search queries are never transmitted to us.

How We Use Your Information

We use the information described above only for the following purposes:

• Fulfilling your requests — sending the cheat sheet, replying about Supplement Packs, delivering your estimate confirmation, and delivering purchased files;
• Contacting you about your roofing project, and arranging contractor contact — when, and only when, you submit the instant-estimate form and check the consent box, as described in the next section;
• Prioritizing follow-up — categorizing estimate requests by the timeline and payment-intent answers you gave, so that urgent and claim-ready projects are answered first;
• Sending the newsletter — only if you affirmatively checked the optional newsletter box, and only once we can send compliant marketing email (see "Email Communications and Unsubscribing");
• Processing and supporting purchases — matching your payment to a product, delivering files, and handling delivery problems or support questions;
• Preventing spam and abuse — the hidden honeypot fields and Stripe's payment verification;
• Operating, securing, and maintaining the Site, and keeping ordinary business records of the messages described above;
• Honoring opt-outs — keeping a suppression list so we do not contact you again after you ask us to stop;
• Complying with law and responding to lawful requests where required.

We do not use your information for advertising or ad targeting, we do not engage in profiling in furtherance of decisions that produce legal or similarly significant effects concerning you, and we do not combine your information with data purchased or obtained from other sources.

How We Share Your Information

Roofing contractors — please read this carefully. The instant-estimate form is a contractor-matching (lead generation) form. Its purpose is to have a roofing contractor contact you about your project. If you submit it, you should expect that the information you submitted — your name, phone number, email address, roof details, estimate range, project timeline, payment intent, priority label, and the page and location you submitted from — may be given to an independent roofing contractor so that they can contact you by phone, text, or email.

What actually happens today. As of the effective date of this Policy, we have no partner contractor arrangements in place, and no information submitted through this Site has been given to any contractor. Estimate submissions are delivered to our operator inbox and stay there. If you submit the form today, the only person who may contact you is the operator of The Roofing Book. We currently receive no compensation from any contractor, because no leads are being passed to anyone.

What must be true before we share a single lead. We will not transmit any estimate lead to any contractor until all four of these are in place, and we will update this Policy — with a new effective date — before the first lead is shared:

• Written agreements. Each receiving contractor must sign an agreement requiring them to use your information only to contact you about the project you submitted, prohibiting resale or any further sharing of your lead, requiring them to honor opt-out, revocation, and deletion requests and to relay to us any they receive, and requiring compliance with the Telephone Consumer Protection Act and applicable state calling and texting laws.
• A named, capped, published list. A single estimate request will be shared with no more than three contractors serving your area, those contractors will be identified to you on the form before you submit (or in a short list published at theroofingbook.com/partners/ and linked from the form), and the list shown to you will be saved with your consent record.
• Notice and consent at the point of collection. The form will carry a plain notice next to the submit button stating that your contact information and project details will be shared with up to three partner contractors who may pay us for the referral, with a link to this Policy — and a consent checkbox meeting the FCC's prior-express-written-consent standard (see "Phone and Text Communications").
• An updated Policy. This section will be rewritten to describe the arrangement as it actually exists, including whether and how we are compensated.

Contractors who receive leads in the future may include independent roofing businesses with which we have no ownership relationship, or a roofing company owned by or affiliated with the operator of this Site; in either case they are not our employees or agents. Their own privacy practices will govern what they do with your information after they receive it, which is exactly why the written agreements above are a precondition rather than an aspiration. We do not share cheat-sheet form submissions, newsletter signups, or Supplement Pack buyer information with contractors, ever.

Service providers. We use a small number of companies to operate the Site, each of which processes data on our behalf for the purpose described:

• Stripe (stripe.com) — payment processing for Supplement Packs. Stripe, through its Managed Payments service, is the merchant of record: it collects your name, email, and payment details on its own checkout pages, handles sales tax, and maintains the transaction record under its own privacy policy.
• Resend (resend.com) — transactional email delivery. Every email the Site sends (cheat-sheet fulfillment, estimate confirmations, purchase delivery, and our internal notifications) is delivered through Resend, so the email addresses and message contents involved pass through, and are logged by, Resend as our email provider. Our messages are currently sent from an address at myroofrisk.com, a sending domain belonging to a related business the operator runs, so that is the "from" address you will see; replies reach the same operator inbox, and if a reply ever goes unanswered you can email [email protected] directly.
• Cloudflare — hosting, content delivery, serverless functions, and private file storage (R2) for purchased packs. Cloudflare processes standard request data for all visitors as our host, may set strictly necessary security cookies at the platform level, and stores the non-personal purchase markers and pack files described above.
• GitHub — hosts the Site's source code only. No visitor or customer personal data is stored in or transmitted to GitHub.

Legal and business transfers. We may disclose information if required by law, subpoena, or court order; to protect our rights, safety, or property or those of others; or, if the business is ever sold or transferred, to a successor who agrees to honor this Policy.

No other sharing. We do not share your personal information with anyone else, and we do not give or sell email lists to third parties.

Do We "Sell" or "Share" Personal Data? (And How to Opt Out)

Several state privacy laws — including the Colorado Privacy Act and the California Consumer Privacy Act — define the "sale" of personal data broadly to include exchanging personal data with a third party for money or other valuable consideration.

Today, we do not sell or share personal data. No estimate lead has been transmitted to any contractor, we receive no referral compensation, there is no advertising on the Site, no ad-tech, no data brokerage, and no cookie- or tracker-based sharing of any kind (see "Cookies, Local Storage, and Tracking" below).

If that changes, here is the honest label. If we begin passing estimate leads to partner roofing contractors and receive compensation for those referrals, that transfer may be considered a "sale" or "sharing" of personal data under some state laws, even though it would happen only when you have expressly asked to be connected with a contractor. We will not argue the classification — we will disclose it here before the first lead is transferred, and the opt-out below applies either way.

• Before submitting: the only way the Site would ever transfer your data to a contractor is the instant-estimate form. If you do not submit that form, no contractor ever receives anything about you.
• To opt out at any time, including after submitting: email [email protected] with the subject "Do Not Sell or Share" (or any words to that effect) from the email address you used, or include the phone number you submitted. We will stop any further sharing of your information immediately, add you to our suppression list so it does not start again, and — if any contractor has received your lead — instruct each of them to delete it and stop contacting you.

We honor opt-out requests for all users, in every state, regardless of whether a particular state statute applies to us.

Phone and Text Communications: TCPA Consent and How to Revoke It

The instant-estimate form includes a required consent checkbox, unchecked by default. As currently displayed on the Site, it reads:

"I agree that The Roofing Book and its partner contractors may contact me about my project by phone, text, or email. Consent is not a condition of purchase. Msg/data rates may apply."

We are telling you plainly that this wording is not good enough, and what we are doing about it. Under the FCC's prior-express-written-consent rules (47 C.F.R. 64.1200(f)), consent for marketing calls and texts must identify the specific sellers who may call, state that the calls or texts may be made using an automatic telephone dialing system or an artificial, prerecorded, or AI-generated voice, be tied to the telephone number you provided, and be signed electronically. As of July 21, 2026 the checkbox carries that language. It reads, verbatim:

"By checking this box, I provide my electronic signature and my prior express written consent to receive marketing and informational calls and text messages about my roofing project — including calls and texts made using an automatic telephone dialing system or an artificial, prerecorded, or AI-generated voice — from The Roofing Book at the telephone number I provided. Consent is not a condition of any purchase. Message frequency varies; message and data rates may apply. Wireless carriers are not liable for delayed or undelivered messages. I can revoke consent at any time, including by replying STOP to any text or emailing [email protected]; reply HELP for help. I have read the Privacy Policy and the Terms of Use."

• It names The Roofing Book only. We have no partner contractors today, and naming companies that do not exist would be inaccurate. Your submission is therefore not consent for calls or texts from any contractor.
• Before any contractor receives a lead, we will show a new disclosure naming the specific contractors who may contact you and collect fresh consent. Until then no contractor receives your submission, consistent with "How We Share Your Information" above.
• We record which version of the disclosure you agreed to, together with the timestamp of your submission, so there is a record of the exact text you were shown.

What checking the current box means. You are agreeing that The Roofing Book may contact you about your roofing project by phone call, text message, or email at the number and address you provided. The form cannot be submitted without it, because contact is the entire point of Step 2 — but consent is not a condition of purchasing anything, and you can use every free resource on the Site, including the instant estimate, without ever checking it. Message frequency varies. Message and data rates may apply. Reply HELP to any text for help. Mobile carriers are not liable for delayed or undelivered messages.

You may revoke this consent at any time, in any reasonable manner, including:

• Replying STOP (or "stop", "unsubscribe", "quit", "cancel", "end", "revoke", or "opt out") to any text message you receive;
• Telling any caller, by phone or voicemail, not to contact you again;
• Emailing [email protected] and telling us to stop — the best option if you want contact from everyone to stop at once.

When we receive a revocation, we stop contacting you immediately, add your number and email to our suppression list, and stop any further sharing of your information. We will honor a revocation directed to us promptly and in no event later than ten business days after receiving it, and if any contractor has received your lead we will relay your revocation to them within five business days. After you revoke, you may receive a single, non-marketing message confirming your opt-out or asking you to clarify its scope; if you do not reply, all messages stop. You never need to pay a fee, log in to anything, or use any particular channel to revoke consent.

If we ever do work with partner contractors, they will be independent businesses responsible for their own calling and texting practices. Our rule is simple and stated here so you can hold us to it: if you tell us a contractor contacted you after you revoked consent, that contractor is suspended from receiving any further leads immediately, pending proof that the problem is fixed. Report it to [email protected].

Email Communications and Unsubscribing

The Site sends two kinds of email, both delivered through Resend:

• Transactional email — the cheat sheet or content you requested, your estimate confirmation, purchase delivery emails with your download link, and replies to messages you send us. These are sent to fulfill something you asked for. They contain no marketing, and because each one is a direct response to your own request or purchase, they are not subscription messages you need to opt out of — if you make no further requests, you get no further transactional email.
• Newsletter email — occasional hail-season and roof-maintenance tips, which would be sent only if you affirmatively checked the optional (unchecked-by-default) newsletter box on the estimate form. That box currently reads: "Also email me the free Front Range Re-Roof Cheat Sheet plus occasional hail-season and roof-maintenance tips. Unsubscribe anytime."

Two things to be straight about. First, that single checkbox bundles a free document you may simply want (the cheat sheet) with agreement to receive marketing tips; we are splitting it into two separate choices so the marketing opt-in is unmistakable. Second, we have not sent any newsletter email, and will not send any, until we can include a valid physical postal address and a working unsubscribe link in every message, as CAN-SPAM requires. Until then, checking the box records your interest and nothing more.

To unsubscribe, reply "unsubscribe" to any email from us or send a note to [email protected] — no login, no fee, nothing required beyond your email address. We honor unsubscribe requests within two business days, and in no case more than seven days, after which you will receive no further newsletter email unless you sign up again. We never sell, rent, or transfer newsletter or subscriber email addresses to anyone, including after you unsubscribe. We do not send email to purchased or scraped lists — every address we email came to us directly from you.

Cookies, Local Storage, and Tracking

This section is short because there is very little to disclose, and we want to be precise about it:

• We set no cookies of our own. Not for analytics, not for advertising, not for functionality. Neither our pages nor our server functions set any cookie.
• Our host may set a security cookie. Cloudflare, which hosts and proxies the Site, may set a short-lived, strictly necessary cookie at the network layer (for example, for bot management or a challenge you pass) to protect the Site from abuse. That happens at the platform level rather than in our code; it is not used to track you across sites, and we receive no analytics or reports from it. We check the Site's response headers after any change to our hosting configuration and will update this section if what Cloudflare sets ever changes.
• The Site runs no analytics or tracking scripts — no Google Analytics, no tag managers, no session recording, no advertising pixels, no beacons. Every asset our pages load — stylesheet, script, search index, fonts (system fonts only) — is first-party and served from theroofingbook.com; we load no third-party scripts, fonts, images, or embedded frames.
• One item of browser storage: if you use the light/dark theme toggle, your preference is saved in your browser's localStorage under a single key (rd-theme). It contains only the word "dark" or "light", never leaves your device, and you can clear it at any time through your browser settings with no effect other than resetting the theme.
• Site search is local. The search box filters a pre-built index inside your browser; your queries are never sent to us.
• Stripe checkout is a separate site. Nothing from Stripe loads on our pages; Stripe's own pages (and any cookies Stripe uses there) come into play only after you click a buy button and leave the Site.

If we ever add analytics or any other tracking technology, we will update this Policy first to describe exactly what was added.

Global Privacy Control and Browser Opt-Out Signals

Global Privacy Control (GPC) is a browser signal that tells a website you do not want your personal data sold or shared. The Site does not currently detect or process GPC signals — we say that plainly rather than claim a capability we do not have. Today there is nothing on the Site that a GPC signal would switch off: we set no advertising or tracking cookies, and we are not selling or sharing personal data (see the section above).

We do not claim that a browser signal is incapable of governing form-based lead sharing. Our commitment is the opposite: if we begin passing estimate leads to contractors for compensation, we will honor GPC signals with respect to that sale or sharing — implementing detection of the Sec-GPC header and navigator.globalPrivacyControl so that a flagged submission is not shared — and we will update this section when we do. In the meantime, the email opt-out described in "Do We Sell or Share Personal Data?" is available to everyone and we honor it in every state.

Your Privacy Rights (All US Users)

Various state privacy laws — including those of Colorado, California, Texas, and others — give residents rights over their personal data, subject to statutory thresholds and conditions. Whether or not any particular statute applies to us or to you, we voluntarily honor the following rights, by policy, for every user in every state:

• Access: ask us what personal information we hold about you, and receive a copy of it;
• Correction: ask us to correct inaccurate information;
• Deletion: ask us to delete the personal information we hold about you — for estimate leads, this means deleting our lead-notification records, and if any contractor has received your lead, instructing them to delete it as well;
• Opt-out of sale/sharing: as described in "Do We Sell or Share Personal Data?" above;
• Opt-out of communications: as described in the phone/text and email sections above.

How to exercise these rights: email [email protected] and tell us what you want. Requests are free.

How we verify you. Because a phone number is easy for someone else to know, we treat request types differently:

• Opt-out, suppression, and revocation requests — low risk, since honoring them only stops contact. We accept these from the email address or the phone number in our records, and we act on them without further verification.
• Access, copy, correction, and deletion requests — these must come from (or be confirmable from) the email address in our records. If we hold only a phone number for you, we will contact that number to confirm the request before acting. In every case we send any copy of your data to the contact information already in our record, never to a new address supplied in the request. We will never ask for more information than we need to verify a request.

We aim to respond within 45 days. If we decline a request (for example, because we cannot verify it, or the law requires us to keep something), we will tell you why, and you may reply to ask us to take a second look.

What deletion does and does not reach. Deleting reaches the records we control: the notification emails in our inbox. It does not automatically purge copies held by our service providers under their own systems and retention schedules — Resend's email delivery logs, Stripe's transaction records as merchant of record, and Cloudflare's platform request logs. Where a provider offers a deletion or log-retention control we can invoke on your behalf, we will use it and tell you we did; you also have rights directly against Stripe under its own privacy policy for the checkout data it holds. We also keep a small suppression record after a deletion request — see "Data Retention."

We will never discriminate against you — deny you the Site, charge different prices, or degrade the free reference content — for exercising any privacy right.

Data Retention

We describe our retention practices as they actually are. The Site keeps no customer database; the records that exist are email messages and one non-personal storage marker. Our schedule:

• Form submissions and leads: retained as email messages in our operator inbox. We review these at least twice a year and delete lead and cheat-sheet emails older than 24 months, and we delete sooner on request. For estimate leads, we keep the record of your consent (and of any revocation) for at least four years after our last contact with you, because we may need it to demonstrate that consent existed; after a deletion request, what survives is reduced to the consent and revocation facts alone.
• Suppression list: when you unsubscribe, opt out, or revoke consent, we keep your email address and/or phone number on a suppression list indefinitely, for the sole purpose of making sure we (and any contractor who received your lead) do not contact you again. We keep this record even if you ask us to delete everything else, because deleting it would make it possible for you to be contacted again by mistake.
• Purchase records: the full transaction record (name, email, payment details) lives with Stripe as merchant of record under Stripe's retention policies. Our own copy is the sale-notification email in our inbox, retained on the same 24-month review, plus the non-personal processed-event marker (Stripe event ID and timestamp only) in Cloudflare R2, which is kept indefinitely as a bookkeeping record of which purchases were fulfilled.
• Download links: expire automatically 7 days after issuance.
• Email delivery logs: Resend retains delivery logs for the emails it sends on our behalf under its own retention practices; where Resend offers log-deletion controls, we will use them on request.
• Hosting logs: Cloudflare retains standard platform request logs under its own retention practices.

You may request deletion of the records we control at any time by emailing [email protected], as described in "Your Privacy Rights" above.

Security

We take reasonable measures, proportionate to the small amount of personal data we handle, to protect your information:

• All connections to the Site are encrypted in transit with HTTPS/TLS, provided by our host, Cloudflare;
• Payment card data is collected and processed entirely by Stripe on Stripe's systems and never passes through ours;
• Purchased files are stored in a private storage bucket and served through signed links that expire after 7 days, or delivered directly as email attachments for smaller single-city PDFs;
• The email records described in this Policy are held in an email account accessible only to the operator; hardening that account (two-factor authentication and a business rather than consumer account for lead records) is on the open-items list below;
• The Site's minimal attack surface — no database of user records, no accounts, no stored passwords — is itself a meaningful protection: there is no customer database to breach.

That said, no method of transmission or storage is completely secure, and we cannot and do not guarantee absolute security. If we learn of a security incident affecting your personal information, we will notify affected users and authorities as required by applicable law, including Colorado's breach notification statute.

Children's Privacy

The Site is a professional and homeowner reference resource about roofing. It is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. The estimate and purchase flows are intended for adults (18 or older) arranging roofing work or buying professional reference documents. If you believe a child has submitted personal information through the Site, email [email protected] and we will delete it promptly.

United States Only

The Site, its content (which covers US building jurisdictions), and its products are directed to and intended for use by people in the United States. We do not target or market to individuals in the European Economic Area, the United Kingdom, or other non-US jurisdictions, and we do not offer goods or services to them. If you access the Site from outside the United States, you do so on your own initiative, and you understand that any information you submit will be processed in the United States under US law and this Policy.

Third-Party Sites and Services

The Site links out to many third-party websites: the official government and manufacturer sources we cite (see https://theroofingbook.com/methodology/ for how we source our data), and Stripe's checkout pages for purchases. Once you leave theroofingbook.com, this Policy no longer applies — those sites' own privacy policies govern. We encourage you to review Stripe's privacy policy before checkout, since Stripe is the merchant of record and collects your payment information directly. Any roofing contractor who receives an estimate lead in the future will likewise be an independent business with its own privacy practices governing how it handles your information after receipt — subject to the contractual restrictions described in "How We Share Your Information."

Changes to This Policy

We may update this Policy from time to time — for example, if we add a new feature, tool, or service provider. When we do, we will post the revised Policy at https://theroofingbook.com/privacy/ with an updated effective date at the top. For material changes that affect how we handle information already collected — especially anything touching contractor lead-sharing, tracking, or selling of data — we will provide more prominent notice, such as a notice on the Site or an email to affected users where we have an address on file. Our promise of accuracy runs both ways: we will not add a tracking technology, data recipient, or new use of your information without updating this Policy first, and each version of this Policy describes our actual practices as of its effective date.

Contact Us

For privacy questions, rights requests, opt-outs, consent revocations, or anything else in this Policy, contact:

The Roofing Book — a Colorado sole proprietorship
Email: [email protected]

Postal address: we do not have one to publish yet. We are obtaining a USPS PO Box, which we will list here and include in the footer of every marketing email; until then we do not send marketing email at all. Email is our operational contact channel, and every right described in this Policy can be exercised through it.

Please also see our Terms of Use, which govern use of the Site and Supplement Pack purchases under the same operator identity, contact address, and Colorado law, and our Supplement Packs page and Methodology page for how our products and data work.

This Policy was written to describe our actual, verified practices as of July 21, 2026. It is a statement of our privacy practices, not legal advice to you.

Open Items: What Is Not Yet in Place

We would rather publish an honest list than imply protections that do not exist yet. These items are not in place as of the effective date. Each one is either already reflected in the commitments above (we do not do the thing until the safeguard exists) or is a change we are making to the Site. This list is published deliberately, and it will shrink.

• Contractor-specific consent language. The estimate checkbox now carries full prior-express-written-consent language for The Roofing Book (quoted verbatim in "Phone and Text Communications"). It does not name contractors, because there are none. Before any lead is shared, the disclosure must be reissued naming the specific contractors and fresh consent collected. No lead is shared and no automated calling or texting on a contractor's behalf occurs until that ships.
• Just-in-time notice at the submit button stating that the submission will be shared with up to three contractors who may pay us for the referral. (Links to this Policy and to the Terms of Use appear under both forms and in the site footer as of this Policy’s effective date.)
• Consent capture. Server-side capture per submission of the rendered disclosure text and its version ID, the contractor list shown, the page URL, a UTC timestamp, IP address, user agent, and the checkbox event — plus a third-party consent certification (such as TrustedForm or Jornaya) if lead-sharing begins. Consent and revocation records will be kept at least four years.
• Written contractor agreements covering permitted use, no resale, honoring and relaying opt-outs and deletions, TCPA compliance representations, and indemnification — a precondition to sharing any lead — together with a published partner list at /partners/ and a three-recipient cap.
• Operational plumbing: a suppression list checked before any contact or lead transmission, a log of which lead went to which contractor and when, and a labeled queue in the operator inbox for rights requests. Several promises in this Policy (opt-out, revocation relay, deletion) depend on these existing.
• A USPS PO Box for the Contact section and every marketing email footer, and a split of the bundled cheat-sheet/newsletter checkbox into two separate choices, before any newsletter is sent.
• Two verifications before publication: confirm the Site's live response headers (including under Cloudflare bot-management settings) so the cookie statement above stays accurate, and confirm that replies to our sending address at myroofrisk.com reach the operator — or set the reply-to address to [email protected].
• Code change to strip email addresses from failed-delivery error logs at our host.
• Legal review. Counsel should review whether the Terms should include a mutual arbitration provision with a class-action waiver, a small-claims carve-out, and a 30-day opt-out, and the Site should record which version of the Terms was displayed at each submission.

If you want to know the current status of any item on this list, email [email protected] and we will tell you.