Privacy, described rather than promised.

Copperline Home Loans is fictional. It is a company invented to demonstrate a website template. It has no offices, no employees, no systems and no customers, so it has no customer data. This page describes what the website itself does, because that is the only thing here that is real.

What the site is

A set of pre-built HTML files served as static assets. There is no application server, no database, no content management system, no login and no session. Every page is identical for every visitor. The calculators do their arithmetic in your browser; the numbers never leave the tab you are reading in.

What is stored on your device

Six preference values, and the record of the answer you gave the storage notice. They are written to localStorage in your browser, under the alp. prefix, and they stay on your device. localStorage is not a cookie: it is not attached to requests, so nothing about it is ever sent anywhere.

The six preferences are written only after you press Accept in the storage notice. If you press Decline, anything already stored under those six keys is deleted immediately, and your choices are kept in memory for the session instead — change the theme, and it reverts when you close the tab. The seventh value,alp.consent, is written either way: it is the record of which button you pressed, and without it the notice would reappear on every page. Clearing site data in your browser removes all of it.

Your preferences are also mirrored into the address bar as query parameters, so a link you copy carries the way the page looks to whoever you send it to. That is a convenience, not a tracker: the parameters describe the page, never the person.

What the forms do

Every form on this site — the quote request, the application, the pre-qualification, the second look, the agent request, the address form on the home value page and the contact form on each calculator — validates what you type and then throws it away. There is no endpoint. Nothing is emailed, queued, logged or stored. Nobody will call you, because there is nobody to call and no number to call from.

Each form has exactly one function in the source, named submit(), with a comment block explaining what a real deployment would put in it. That is the only place a real site would begin to collect anything, and it is empty here on purpose.

What this site cannot control

These files have to be served by somebody. Whatever host serves them keeps the ordinary web-server access log that every host keeps — an IP address, a timestamp, a path, a user agent. That is outside this site's code, it is not read by anything here, and it is the same record that is created when you request any file from any server on the internet.

The footer links to social profiles on other companies' websites. Following one takes you to that company, under their privacy policy, not this one.

What a real lender's privacy policy would have to cover

A licensed mortgage lender is a financial institution, and its privacy notice is a regulated document rather than a page of reassurance. None of the following applies to this demonstration, because it collects nothing — but all of it would apply to the real version of this business, and its absence here is the clearest sign that this is a template.

• The Gramm-Leach-Bliley Act and Regulation P. A model privacy notice delivered when the customer relationship begins and annually after that, on the prescribed form, stating the categories of nonpublic personal information collected, who it is shared with, and how to opt out of sharing with nonaffiliated third parties.
• The Fair Credit Reporting Act. Credit reports may be pulled only with a permissible purpose, and the borrower has to be told when a report was used against them, which bureau supplied it, and how to dispute it. Credit-score disclosures and adverse action notices are part of the same regime.
• The Safeguards Rule. A written information security program, a named person responsible for it, encryption of customer information in transit and at rest, multi-factor authentication, vendor oversight, penetration testing and a documented incident response plan.
• The service providers who see your file. Credit bureaus, automated underwriting systems, appraisers and appraisal management companies, title and escrow, flood certification, verification-of-employment vendors, document custodians, the servicer the loan is sold to. Each one would have to be named by category and bound by contract.
• State privacy law. This one claims to sit in Denver, so the Colorado Privacy Act would be in scope, alongside the equivalents in every other state it claimed to lend in, and each has its own definitions, rights and response deadlines.
• Retention and destruction. How long a completed file is kept, how long a declined file is kept, and how either is destroyed.

A real policy would also have a version date and a change history. This page has neither, because it describes the code in a repository rather than the practices of a company.

Questions

There is nowhere real to send them. The contact details a live site would print here are[email protected] and(720) 555-0139. The address ends in.example, a domain reserved so it can never be registered, and the number is inside the 555-0100 to 555-0199 block reserved for fiction. Neither reaches anybody.