Fact Lease

Fact Lease records what public web pages say about Houston and San Antonio commercial suites — dated, sourced, never invented.

Explore the map

Privacy

Fact Lease measures how this site is used. This page lists what that measurement records. It is effective 2026-10-07.

Write to hello@factlease.com with questions.

Who can see a visit

Robert Stovall reads visit records in a private dashboard. We do not publish them. We do not sell this information. We do not share it with advertisers, data brokers, or other websites.

Cloudflare hosts the site. Cloudflare sees the connection, including the IP address, because that is how the page is delivered. The visit rows sit in a database on that host. A court order can require us to produce rows we still have.

What the server records

When a browser asks for a page, the server can record the following. The IP address is not one of the stored fields.

  • The page address, the request method, and the HTTP status, including a 404.
  • City, region, region code, ZIP code, metro code, time zone, and country, taken from Cloudflare's IP geolocation. That geolocation is an estimate. It can be wrong. We do not use the browser's GPS.
  • Latitude and longitude rounded to two decimal places. The cell is about 1 kilometer on a side (about 1.1 km north to south). It is not a street address, and it is not only the city name.
  • The network's name and its ASN, and a coarse label for that network (for example residential, mobile, business, or data center).
  • Device class, browser family, browser major version, and operating system. We store those labels. We do not store the raw User-Agent string.
  • The language the browser asks for.
  • The referrer: the site and the path that linked here. A query string is kept only when it is the search term. When a search engine includes the search term, we store the term and the engine's name. When it does not, we do not invent one. When the linking site, or a campaign source, is a known AI product, we store that product's name.
  • UTM tags on the link: source, medium, campaign, term, and content.
  • The time of the request, in UTC.
  • The Cloudflare data center that served the request, the TLS version, and the HTTP version.
  • Sec-Fetch-Site, when the browser sends it: which site the navigation came from.
  • A label for whether the visit looked human or automated, a numeric score, the short reasons for that label, the name of a recognized crawler, and Cloudflare's bot score when Cloudflare supplies one.

The visitor log does not store your IP address. Not as a raw address, not as a hash, and not as a shortened address. The address is read in memory to build the session code described below, and then it is dropped.

The measurement script

A normal public HTML page, one that answers HTTP 200, also carries a small inline script. We serve that script from this host. It is not loaded from another company. It does not set a cookie. It does not read cookies or local storage. It does not probe canvas, audio, fonts, or the graphics chip. The content security policy allows it by a hash. That measurement is described on /privacy. A response that is not that page, including a 404, an embed, or a page that is not HTML, does not get the script. The server record above can still include it.

The script sends this host:

  • Time on the page, both active time and total time. Active time means the page is visible, focused, and used within the last 30 seconds.
  • Scroll depth, and which sections were on screen, with about how long each section was visible.
  • Clicks on links and buttons: the element label, an element id or a short path to the element, the link address, the position on the page, and the element's box on the page. Repeated clicks, and clicks that do not change the page, are recorded as their own events.
  • Copy events: the length of the copy, and up to 80 characters of the page text that was copied. Text inside a form field is not read.
  • On /contact and /list, the order of form fields that receive focus, by field name, and whether the form was submitted or left, with the last field name. The script does not read what you type. We store a short label for the strongest of those steps on that page: opening contact or the list, submitting, a mailto or tel link, or a download.
  • Page-speed metrics: largest contentful paint, input delay, layout shift, and time to first byte.
  • An approximate window width, rounded down to 10 pixels. Not the height, and not the screen density.

This is first-party measurement. It is not a third-party analytics tag. The homepage rent map is a separate feature script, also served from this host. That map loads tiles from OpenFreeMap. The measurement script does not.

Session code

Pages opened by the same browser, on the same network, on the same UTC day, share a session code. We store the order of those pages within the day. The code is a short HMAC. The key is a secret pepper plus a salt that changes every UTC day. The message is the IP address, the User-Agent, the language header, and the site host. Those raw values are not written to the visitor log.

At the end of the UTC day we delete that day's salt from the live table. Without that salt, the session code cannot be turned back into an address. The next day uses a new salt, so the codes do not match across days. The host can restore a recent copy of the database, including a deleted salt, for a limited time. We do not keep a second copy of the salt.

Do Not Track and Global Privacy Control

If the browser sends DNT: 1 or Sec-GPC: 1, we do not store a visit row, we do not build a session code, and we do not add the measurement script. We keep an aggregate count only: one hit for that hour, that signal, and that group of pages.

An hourly count that already exists can still include that request. It stores the country, the referrer host, and the page group. It does not store an IP address or a session code. For a visit labeled as a crawler we also keep an hourly count: the crawler's name, that label, the top reason, the network number and name, the country, the page group, and whether the status was a success or an error. Search and AI referrers have their own hourly counts, by source and page group. None of those hourly counts include a search term.

How long we keep it

Raw visit rows and engagement rows are kept for 90 days, then deleted. The opt-out counts, the crawler counts, and the older hourly counts are kept for 90 days.

We then keep aggregate counts for up to 25 months. Those counts are broken down by day, verdict, country, region code, city, ZIP code, network name, network type, referrer kind, referrer host, and the kind of page where the visit started. The figures are sessions, page views, sessions where the script ran, summed active time, and conversions. They are not a single site-wide total, and they are not tied to a session code. The 25-month counts do not include coordinates, search terms, copied text, or clicks.

When we know who you are

A visit does not include your name or your email. We learn an identity only when you give it to us. That happens if you use the contact form, if you email hello@factlease.com, if you sign up as a broker at /list, or if you open a personal link Robert sent that carries a tag (fl_ref). The tag is stored with the visit. The email stays with the message or the sign-up. It is not copied into the visit row.

Some forms you submit store the IP address of that submission, or a hash of it, so we can limit abuse. A broker listing can store the address. A request for a broker page, and an inquiry, can store a hash of the address. That storage is not the visitor log. The visitor log still does not store an IP address.

Cookies

If you only read pages, we do not set a cookie. The measurement script does not set a cookie. The private dashboard sets an HttpOnly cookie after a sign-in at /ops. The broker sign-up at /list sets a short-lived HttpOnly cookie named fl_list so the form can finish. Broker admin uses its own sign-in cookie.

What we cannot tell

  • Your legal name, email, or phone, unless you send them.
  • Your IP address, after the request ends, from the visitor log.
  • Your street address, or a GPS fix.
  • Whether the person who visited tomorrow is the person who visited today.
  • The raw User-Agent string, or the full list of languages the browser offered.
  • What you typed into a form. The script records field names and focus order, not values.
  • Other sites you visit, or an identity shared with those sites.
  • A device serial number, an account on this site (there is no reader account), or a precise screen.
  • The search term, when the search engine does not send it.
  • Whether Cloudflare's city or ZIP code is the right one.
  • Who sent DNT: 1 or Sec-GPC: 1, beyond the hourly count.

We can see the page text you copy, up to 80 characters, when the script runs. We can see the search term when the engine sends it. Those two items are easy to underestimate.

Questions

Email hello@factlease.com. Fact Lease does not publish a street address or a phone number. This page is /privacy.