Apply

Privacy

Privacy policy

What we collect, why we collect it, how long we keep it, and what you can ask us to do with it.

This policy is not yet final

The inventory below is accurate - it is what the application actually collects. The policy language itself needs counsel, because it is a binding commitment about data that includes Social Security numbers and identity documents.

TO CONFIRMfull privacy policy, drafted and reviewed by counsel

What we collect, and why

An accurate inventory for counsel to draft against:

  • Contact details - email or mobile number, to send your magic link, your decision, and status updates. This is the only thing we need to give you a saved-homes list or an alert.
  • Application details - name, date of birth, current and previous addresses, occupants, and pets.
  • Financial information - income, employment or self-employment details, and supporting documents such as pay stubs, bank statements, or tax returns.
  • Government identifiers - a Social Security number or ITIN, used to run the screening report described on our criteria page. It is never displayed back to you and never appears in a status view.
  • Screening results - the consumer report returned by our screening provider, and the decision we recorded against it.
  • Payment details - handled by a payment processor. Card numbers do not reach our systems.

Questions the final policy must answer

  • How long each category is retained, particularly for applicants who were declined.
  • Which third parties receive data - the screening provider, the payment processor, the property owners whose homes we lease - and what each receives.
  • How data is encrypted at rest and in transit, and who internally can see identifiers.
  • Breach notification obligations, which vary by state.
  • Your rights of access, correction, and deletion, which also vary by state.
  • Whether and how any analytics or advertising tooling is used.
TO CONFIRMretention periods, subprocessor list, and state-specific rights

What is already true

These are properties of how the product is built rather than promises to be drafted:

  • Prospects are never asked to create a password. Access works through single-use links exchanged for a session that expires.
  • Session credentials are stored hashed, never in readable form.
  • Pages behind a credential send no referrer and are excluded from search indexes.
  • An application status view shows status and next steps only - never a Social Security number and never your uploaded documents.