Privacy notice

What stays transient

Interactive inputs are calculated in the browser. Until you choose a labeled save, keep, or handoff action, they remain only in the open page and disappear when that page state is lost. The relocation-runway planner keeps expected income, deposits, overlap months, moving costs, reserves, and calculated payback details transient. Its optional My Move Plan handoff records only reserve intact or short and modeled payback, no payback, or no outlay, plus a check date.

A Copy summary or Copy brief action writes only the displayed planning summary to your device clipboard; your browser or operating system may retain or synchronize clipboard history outside this site's control. Print or Save PDF hands the specifically labeled summary to the browser and operating system; any PDF or paper copy then lives outside the site. Neither action submits the summary, saves it to this site's server, or sends it to Roby.

Healthcare search terms, selected facilities, continuity-planning answers, and maternity comparisons are not written to Trip Plan, My Move Plan, the portability files, analytics, or a real-estate inquiry. Following an official or other external link is governed by that destination's privacy practices. Hosting and security providers may still process ordinary request information needed to deliver and protect the page.

A protected rollback or future private review may use a Secure, HttpOnly, SameSite access cookie after an authorized reviewer enters the review password. It authenticates access only; it is not an analytics or advertising identifier. Review logout clears it.

Custom first-party product analytics

The public site asks its own Cloudflare Worker which privacy tier applies before it creates any analytics identifier. A confirmed U.S. visit can use the detailed, short-lived model described below. A confirmed visit from another country can contribute only to unlinked daily counters: no visitor ID, session ID, first-touch profile, browser or operating-system field, city, state, or exact location is created or stored. Unknown-country visits remain off. The collector independently checks the country and privacy signals before it reads the event body. No country or eligibility result is used to follow a browser elsewhere.

For eligible U.S. visits, the site records pseudonymous page views, sessions, referral domains, UTM source, medium, campaign, content, and term labels, broad device/browser/operating-system classes, country and state/region when Cloudflare supplies them, approximate active engagement, scroll milestones, internal and outbound link actions, tool starts and actions, contact-path actions, successful submissions, and limited error or performance signals. A random visitor identifier stays in local storage so new and returning use can be compared. A separate first-party local-storage record coordinates one session identifier and arrival source across this site's tabs and windows; eligible activity keeps that session active, and at least 30 minutes without eligible site activity starts a new session. Detailed events and the visitor identifier expire after 90 days.

For eligible U.S. visits, the Worker immediately converts Cloudflare's country, state, and DMA/metro signals into one broad market bucket: Los Angeles DMA, other Southern California, other California, Las Vegas DMA, other Nevada, other United States, or unknown. The detailed event retains only that bucket. It does not store the raw city, postal code, latitude, longitude, DMA code, or IP address. A missing country or state, or a known DMA/state conflict, becomes unknown rather than being guessed. This is approximate network routing, not a home address or proof of residence, and a browser can move between buckets when its network changes.

Neighborhood Matcher result measurement writes public area slugs and their first, second, or third result position directly to anonymous daily counters. A separate counter records a click to the public area guide or atlas so aggregate result-to-guide use can be compared. The browser never sends the preferences or answers that produced those results. My Vegas Plan measurement likewise uses only six fixed stage names, should we move, cost, area comparison, everyday-life research, rent or buy, and move logistics, and the fixed actions opened, returned, or saved. It never sends the plan's note, address, answer, selection, amount, or saved text. The dashboard omits a matcher row until it has at least five result impressions and withholds nonzero click or stage-action cells below five recorded actions.

For a confirmed visit outside the United States, the browser sends only the event or action, canonical page and source paths, referral domain and bounded UTM labels, broad device class, approximate active time or scroll milestone where relevant, and privacy-screen signals. The Worker adds the two-letter country supplied by Cloudflare and immediately folds the event into a daily counter. It does not store an event row, visitor or session identity, browser or operating system, region or city, IP address, first-touch history, or a way to recognize a return visit. These counters can show that readers in a country viewed or used something, but cannot support unique-visitor, return-rate, path, or funnel claims.

The first arrival source associated with that browser identifier is kept locally and copied into first-party analytics events for up to the same 90-day window. That makes it possible to compare original first touch with the source for a later session. It uses only this site's pseudonymous browser identifier, referral domain, and campaign labels; campaign URLs should never put a person's name, email, phone number, or other private information in a UTM label. The analytics does not follow the browser to another website or import a third-party advertising identity. Internal navigation is excluded as a new acquisition source.

Normal dashboard totals include only events that pass a server-side automated-traffic screen. The screen uses available Cloudflare verified-bot and bot-score signals, a private deployment-test marker, the browser's standard automation flag, same-site request context, and bounded crawler or automation patterns. Search crawlers, AI crawlers, link-preview services, monitors, headless tests, scanners, and suspicious non-browser requests are excluded from normal visitor and session reports. Rejected event submissions are kept only as daily category counts; the site does not retain their IP address, user-agent string, visitor ID, session ID, fingerprint, page, or payload. Events recorded before this screening version remain labeled unclassified and are excluded from current human totals rather than retroactively guessed to be people.

Analytics records Ask Roby, phone, text, and email clicks only as contact-intent actions; a click does not prove a conversation or delivered message. Contact-form and consultation-form starts and successful server-side deliveries are separate events. If a form cannot be submitted, analytics may retain only the form type and one fixed generic category, such as a browser-required field, abuse screening, rate limit, network failure, server validation, or email-delivery service failure. It never receives the entered name, email, phone number, message, field value, or detailed error. A successful form event means server-side delivery handling succeeded; it does not mean Roby read or answered the request.

Analytics never receives the body of a contact or consultation message, reply details, saved-plan notes, exact addresses, healthcare or school choices, keystrokes, or exact calculator inputs or results. Event fields are allowlisted, and likely email addresses, phone numbers, coordinate pairs, or sensitive key-value text in campaign labels are rejected. The only numerical measurement retained is active engagement/scroll detail for an engagement event and a bounded page-load duration for a slow-page signal.

Cloudflare necessarily receives an IP address to serve and protect an HTTP request. This site does not write that address to D1 or an application log. For one-minute abuse controls on analytics collection, forms, analytics sign-in, and private review access, the Worker immediately converts the address into a secret-keyed, purpose-specific identifier that changes each UTC day before sending it to Cloudflare's rate-limit counter. The raw address is then discarded by the application. Cloudflare may separately process ordinary network and security metadata. With Worker observability enabled, Cloudflare currently lists a three-day log-retention window on Workers Free and seven days on Workers Paid; this site does not add form bodies, analytics payloads, passwords, or raw addresses to custom application logs.

The pseudonymous visitor identifier and original first touch expire after 90 days. The shared session record becomes inactive after 30 minutes without eligible site activity and is replaced when a later eligible visit begins. Before scheduled cleanup removes detailed and legacy event rows after 90 days, an idempotent daily job first attempts to update anonymous daily and weekly totals plus broad return, source, content-family, tool-use, and contact cohorts. A short-lived working index uses the same pseudonymous browser and session IDs only inside that 90-day ceiling so a 7-, 30-, or 90-day cohort can mature; it is deleted as its source detail expires. A rollup failure is reported but does not extend raw detail past 90 days, so a missed historical slice may be unrecoverable. The retained long-term tables contain counts and broad dimensions only, never visitor or session IDs, form content, private notes, exact tool inputs, IP addresses, or a browser's raw history. Granular page transitions, source-to-family relationships, attribution, conversion assists, and cohort cells are retained only when at least five tracked browser profiles contribute; smaller cells are omitted rather than shown as zero. Those U.S. rollups, the unlinked country-level counters from outside the United States, and daily filtered-automation counts expire after 730 days. The two-year window permits a most-recent-12-month versus prior-12-month comparison without retaining two years of person-level history. A browser counted on multiple days can appear in multiple daily totals; it must not be described as one unique person across the year. Cloudflare D1 Time Travel can temporarily preserve recoverable database state after deletion for the provider's plan-dependent window. Global Privacy Control, Do Not Track, or the local analytics opt-out disables collection in that browser and removes any analytics identifiers previously created by this site.

The private health report uses a separate identifier-free daily table for fixed operational counters such as accepted or rejected submissions, filtered automation, observed D1 write failures, report or export results, and scheduled-rollup status. It stores only UTC day, a fixed metric name, a count, and the latest timestamp, never an event payload, page, visitor or session ID, IP address, user agent, form value, private note, or precise location, and expires after 730 days. Privacy-ineligible requests remain completely uncounted, because an opt-out must not itself become telemetry. A complete D1 outage can also prevent its own health counter from being written, so the report is explicitly a lower-bound operational signal. The application does not contain a Cloudflare account-administrator token; Worker and D1 account usage must be checked through Cloudflare's own private dashboard.

Automated-traffic filtering improves the reports but cannot prove that every included browser is a person. A sophisticated bot can imitate ordinary browser requests, privacy tools can remove signals, and most crawlers that only request a page never send an analytics event at all. Cloudflare's richer bot fields are used when the account supplies them; the fallback remains conservative and does not create a fingerprint.

Public analytics uses first-party local storage, not a cookie. Where the browser supports it, the Web Locks API coordinates shared-session updates across tabs; a short-lived first-party local-storage lock is the fallback. The owner-only analytics dashboard uses a separate Secure, HttpOnly, SameSite=Strict authentication cookie for up to eight hours; that cookie is not used to measure public behavior. The dashboard is enforced by the Cloudflare Worker, noindex, no-store, absent from public navigation, and backed by a dedicated first-party database. Analytics data is not sold, used for advertising, or combined with third-party profiles.

The custom measurement is first-party, is not used for advertising or sale/share, honors browser privacy signals and an on-page opt-out, and creates no browser identifier or stored session profile for aggregate-only visits outside the United States. The site therefore does not add a general cookie banner for this custom implementation. The separate Cloudflare Web Analytics boundary is described below. This is a description of the deliberately narrow technical design, not a claim of completed legal review or a universal conclusion about every visitor's local law. No qualified privacy professional has reviewed this implementation. Any later advertising, cross-site tracking, international visitor profiling, or identifiable international measurement requires a fresh consent and legal review before activation.

Separate Cloudflare global analytics

Cloudflare Web Analytics is enabled on the production hostname as a separate high-level sanity check. Cloudflare automatically injects one beacon into public production HTML; the public Content Security Policy explicitly permits that script and its same-origin reporting request. Private analytics pages and protected-review responses are marked no-transform and retain restrictive script policies, local development traffic does not pass through the production proxy, and the site has no separate public staging hostname. The application source does not include a second beacon.

Cloudflare's private report can show provider-defined page views, visits, paths, referrers, devices, countries, and field performance, including LCP, INP, and CLS when enough real-user data exists. Those definitions and coverage differ from this site's eligible-browser model. Cloudflare numbers are never imported into D1, silently merged into the custom dashboard, or used as the denominator for custom visitor, return, funnel, or conversion rates.

Cloudflare describes this measurement as using no cookies, localStorage, sessionStorage, or fingerprinting and says the RUM system discards an IP address at the edge rather than storing it in the Web Analytics dataset. The Cloudflare setting currently excludes European visitor data. The on-page analytics choice controls the custom first-party tracker only; it does not control this separate provider measurement. Cloudflare remains the site's hosting, security, and Web Analytics provider and handles its service data under its own terms. No qualified privacy professional has reviewed this implementation.

Complete browser-storage inventory

The records below are independent. Clearing one tool does not imply that every other record or a downloaded file was erased. Browser storage is not encrypted, and another person using the same browser profile may be able to read it.

What local detail is deliberately excluded

A Move conclusion or progress status is intentionally broader than its supporting local record. Detailed route origins, destinations, times, and notes; exact amounts; checklist dates, needs, task owners, and notes; and exact-address fields can affect the on-device progress summary without appearing in its broad label. A restaurant, hike, or other trip reference alone does not make relocation work ready for Roby review.

The editable consultation summary leaves out healthcare choices, custom stops, addresses, notes, reservation details, exact amounts, checklist dates and task details, and underlying property research. Nothing reaches Roby until you review and submit the form with contact details and consent.

Redacted and private workspace files

A redacted file includes up to three public area IDs, bounded progress statuses, fixed decision notes, an export timestamp, and the date you checked those statuses. It excludes exact amounts, addresses, care or school choices, private notes, task owners, and personal dates. Importing it stores that redacted copy in the browser. Older version-one files remain readable but have no trustworthy export or check date, so the plan labels their age unknown.

An optional private file includes only the sections you select from Trip Plan, Move Brief, route tests, tax estimate, cost ledger, scouting plan, moving checklist, and exact-address property notes. It is plain-text JSON, not encrypted, and can reveal dates, addresses, finances, care or school choices, owners, and notes. Desert-home task completion, candidate-property comparison, runway amounts, the broad runway record, six-question move record, local handoffs, and consultation session context are not private-file sections.

Both file types are generated, read, and validated in the browser; the site does not upload them. The downloaded copy lives wherever your device or browser saves it and is no longer controlled by this site. Restoring a private file requires selecting sections, acknowledging the warning, and confirming replacement. Removing browser storage does not delete a file already downloaded elsewhere.

Clearing, loss, and device boundaries

Use each surface's Clear saved copy, Remove, Reset, or discard control for that record. Trip Plan and My Move Plan have separate clearing paths. Plans do not sync across browsers or devices, and the site keeps no cloud backup. Private browsing, storage cleanup, browser problems, or another device can make local work unavailable; a downloaded file must be managed separately.

Do not enter medical, financial-account, identity, confirmation-code, access-code, or other confidential information. Even fields intended for private notes are ordinary browser storage, not a secure document vault.

Contact and consultation requests

The forms collect only the information you choose to enter so Roby can respond. They do not accept file uploads.

Do not use them for tax returns, bank statements, identification documents, account numbers, medical or health information, healthcare-facility choices, or other sensitive records. Inquiry emails may remain in the recipient’s business email system as needed for follow-up, recordkeeping, security, and legal obligations. To ask a privacy question or request attention to submitted information, contact roby.sobieski@cbvegas.com.

What a submitted message contains

A contact request may include your name, the email address or phone number you provide, your chosen email, text, or phone-call reply channel, the topic, timing, question, consent choice, and the page that led to the form. A consultation request may also include a general goal, anything else you choose to write, and an optional editable summary you deliberately carry over from a planning tool or My Vegas Plan.

The forms use basic anti-spam and request-limit protections. The hosting and email-delivery providers may process request and delivery information necessary to operate, secure, and troubleshoot the service under their own terms.

How information is used and shared

Submitted information is used to deliver the request, respond, understand its context, protect the form from abuse, and maintain appropriate business records. The site does not run behavioral advertising, sell visitor profiles, or disclose calculator inputs to an analytics service. Information may be handled by the hosting and email providers that make delivery possible, or disclosed when required to comply with law or protect the service.

Retention, access, and deletion questions

LosAngelesToLasVegas.com does not maintain a separate inquiry database. A delivered request may remain in Roby’s business mailbox and related provider systems according to business, security, backup, and legal requirements. Contact roby.sobieski@cbvegas.com to ask about a message you submitted, request a correction, or request deletion where applicable. A request may require reasonable verification before action is taken.

External services

Official-source links, Roby’s public profiles, email applications, and any optional scheduling service have their own privacy practices. If the site adds a service that changes how visitor information is handled, this notice will be updated before that service is used.