Privacy policy

Account details: your name, email address, and the sign-in credentials handled by our authentication provider. We never see or store your password.

Lease details: the property address, unit, deposit amount, move-in and move-out dates, the state whose deposit rules apply, and the names and email addresses of the parties.

Evidence: the photographs you take, any notes or annotations attached to them, the signatures recorded on a walkthrough, cost documents attached to a deduction, and the timestamps and SHA-256 digests recorded when each file arrives.

Activity: an append-only log of what happened on a lease and when. It records an invitation sent, a walkthrough sealed, a statement issued. Both parties can read it.

A walkthrough photographs rooms people live in. Those images can reveal a great deal that has nothing to do with a deposit. They can show religious objects, medical or mobility equipment, signs that children live there, personal correspondence left on a table. We treat them as personal information about everyone in the household, not merely as property records.

We do not analyse the contents of your photographs, we do not run image recognition over them, and we will not build a feature that surfaces them into tenant screening, scoring or background-check contexts. They exist to document a unit's condition to the two parties to one lease.

Phone cameras often embed GPS coordinates in the image file. At a home, that is precise geolocation, which California law treats as sensitive personal information.

We keep it on the ORIGINAL file and nowhere else. Its purpose is evidentiary: a photograph whose embedded coordinates match the unit is materially harder to dispute, and re-encoding the file to remove them would change the digest that proves the file has not been altered.

Every copy we generate has it stripped. That means the images you see in the app, the PDF reports, the itemized statement, anything shared or exported. It is never displayed anywhere in the product, and files that are not in a format we can reliably strip are refused at upload rather than passed through.

If you ask for a copy of your data we will tell you the coordinates exist and discuss how you want them handled, rather than mailing them to you without comment.

We hold it to run the service: to keep the record, to work out which deadlines apply, to send the notices a tenancy requires, and to produce the documents you ask for.

The other party to your lease sees the evidence on it. That is the design, not a leak. A record only one side can see is not evidence of anything. Before an invited tenant sees any of it, they must prove the email address the invitation was sent to is theirs.

We do not sell personal information and we do not share it for cross-context behavioural advertising. We have never done either and the business does not depend on it.

Outside the parties to your lease, your information reaches only the service providers that run the product for us. Those are authentication, database hosting, file storage, email delivery, and product analytics, and each of them may use it only to provide that service to us. The current list is available on request.

In the United States. Files and database records are held in US regions and we do not replicate them elsewhere. Our service providers may have staff outside the US who can access systems for support and maintenance.

Evidence on a lease is kept for the period below, measured from the end of the tenancy. The reason for the length is simple: a deposit dispute can be filed until the limitation period in that state runs out, and evidence deleted a month before someone needs it is worse than useless.

If either party tells us a dispute about a lease is live, nothing on that lease is removed until it is resolved. Automatically deleting evidence in a known dispute is a problem for everyone involved, so we would rather hear from you early.

You can ask us what we hold about you, ask for a copy, ask us to correct it, ask us to delete it, and ask us to limit how we use sensitive information. We will not treat you differently for asking. Write to us and a person will handle it: we will acknowledge within 10 business days and answer within 45 days, and if we cannot do part of what you ask we will tell you which part and why, in writing.

The limit is the other party. Evidence on a shared lease was created jointly, both of you were told at capture that neither could edit or delete it, and each of you may need it if the deposit is questioned later. So a deletion request removes your identifying details and your access; it does not remove the lease evidence itself, which stays for the retention period above, with the other party's access intact.

We will not tell you that evidence is anonymous once your account is gone. It still carries the property address, the lease dates, the other party's name, and the photographs themselves. What a deletion removes is your login and the details we hold about you as a user; what it cannot remove is a record that another person is relying on.

The service is for adults entering into tenancies and we do not knowingly collect information from anyone under 18. Walkthrough photographs may incidentally show that children live in a home; that material is treated like everything else here and is never used for anything beyond the deposit record.

If this policy changes materially we will say so before the change takes effect. The date it last changed is shown at the bottom of this page.