Privacy Policy

The route assistant is a pilot run by the owner of Legworthy (legworthy.com). Write to hello@legworthy.com with privacy questions or deletion requests.

You sign in with your Legworthy account: your email address and a one-time code. Legworthy keeps you signed in with a session cookie for legworthy.com and its subdomains. Each time you open the route assistant, its server sends that cookie, and only that cookie, to Legworthy, which answers with your account ID and email address in a signed token that lasts five minutes. The route assistant uses them only to let you in. It keeps them in memory, never on disk or in logs: with your working session while you use it, and in a short cache that drops them within a minute after that five-minute token expires. When Legworthy renews your session as you open a page, the route assistant passes the renewed cookie back to your browser unchanged and doesn't keep it. Your Legworthy account itself is kept by Legworthy.

The app sends pasted property-address text to Microsoft Azure OpenAI for structured extraction. After extraction, property addresses and the effective starting address are sent to Google Maps for geocoding. A starting address you type in its own field is sent only to Google, not to the model; one written in your paste is part of the text the model reads. Review the original and resolved addresses before confirming. After confirmation, the selected Google place IDs for the start and properties are sent to Google Routes for a driving-time matrix. The app calculates the visiting order locally; addresses and route results are not sent to the model for optimization.

For the address-check map, the server sends resolved coordinates to Google Maps Static API and keeps the returned image only in your session. The browser receives image bytes, not the server API key or Static Maps request URL. On the Check step, your browser also loads Google Maps Embed directly for flagged addresses with selected matches, sending their place IDs to Google for interactive satellite inspection. After confirmation, the browser loads Embed to show the road path, sending the route's place IDs. These embedded maps also send your IP address and normal browser/referrer information to Google. A separate Embed-only browser key is visible by design; paid API credentials remain server-side. Google's privacy policy applies to the embedded map. Tapping Open in Google Maps or Navigate sends the addresses (including unit text) and place IDs to Google Maps in your browser or installed app. Tapping View on Google Maps in a clean review row likewise sends that address and its place ID to Google Maps.

The optional Diagnostics page uses only fixed public Houston addresses for its extraction, geocoding and one-element driving-matrix check, never your addresses. Do not enter client names, access codes, contact information or other sensitive notes.

Application state is temporary and session-specific. Working addresses are cleared after 30 minutes without a submitted action. New route, signing out of Legworthy and that expiry clear addresses, matrices and route results; the expiry check runs while the browser remains connected. Reloads, disconnects and deployments may lose state. There is no route-history database or cross-user address cache. Billable keys remain server-side; the referrer-restricted Embed-only key is the exception above. Technical logs contain status codes, timings, request identifiers and usage counts, not addresses, coordinates, prompts, email addresses, session cookies, keys or full provider responses. Azure application logs have 30-day retention. Platform providers may process operational metadata under their own terms; application session expiry does not delete provider-held data.

Azure Global Standard inference is not guaranteed to process data in East US 2 or the US. See Microsoft's privacy statement, Azure OpenAI data privacy, and the Google Privacy Policy.

This app uses Streamlit's session/security mechanisms and does not enable advertising, analytics tracking, or full-payload LangSmith tracing. Both workflow graphs explicitly disable tracing.