Privacy policy

The short version: rent pins carry no identity, we never store your raw IP address, we set no advertising or tracking cookies, and we never sell your data. The longer version is below.

What we collect

• IP address. Read from your request and immediately turned into a salted hash for anti-abuse (rate limits, and de-duplicating reports and ratings). The raw IP is never stored and the hash is never shown or linked to your identity.
• Location. The point you tap is rounded to about 100m before it is saved. The precise location is never stored.
• Rent and listing details. BHK, rent, furnishing, water source, an optional one-liner, and the like. Shown publicly (except contact fields). On the map feed the timestamp is coarsened to a date.
• Email. Required when you post a listing (so we can send you your private manage link and callback notices) or when you watch an area (so we can send alerts). Kept server-side only, never shown on the map, never in a public API, never sold. Every email has an unsubscribe link.
• Contact you volunteer in a callback. If you request a callback on a listing, the phone or email you type is stored and shown only to that one listing’s owner. Sharing it is your choice.
• Ratings and reports. A 1–5 locality or build score, or an abuse report, de-duplicated by your IP hash.

Rent pins themselves carry no name, email, or phone. Nothing on the map traces to a person.

How contact sharing works

There is no automatic matching and no bulk contact exchange. The rent map carries no contact at all, so there is nothing to share. In the marketplace, a poster shares no public contact. A seeker who wants to reach a listing leaves their own phone or email through “request a callback”. That contact goes only to that one listing’s owner, who reads it from a private manage link and, if they opted in, by email. The owner calls back. It is one-directional, explicit, and per-listing.

We never cc these to ourselves, and we never share contact with brokers, advertisers, or any third party outside this flow.

Third-party services

• Protomaps. The map draws from a basemap file we host ourselves; its fonts and icons load from Protomaps. That is the only third-party host your browser contacts while using the map. No Google Maps, no API key, no per-request tracking.
• Email delivery. When email is enabled, we hand the recipient address and message to an email provider (Resend) solely to deliver mail you asked for.
• Hosting. The app and its database run on our own server. Your data is not held in a third-party cloud database.

We use no advertising network, no analytics, and no Google, Supabase, or IP-lookup services.

Cookies

We set no advertising or cross-site tracking cookies, and run no analytics. The public site needs no login and sets no session cookie. (The moderation tool stores its access token in the moderator’s own browser; this never applies to public visitors.)

How long we keep it

• Rent pins: until you delete them, or until 3 distinct reports auto-hide them.
• Listings: until you mark them rented or delete them from your manage link.
• Emails (area watch, listing notifications): until you unsubscribe, or the listing is removed.
• Callback contact: with the listing, removed when the listing is deleted. Once the owner has seen it, we cannot recall what they noted down.
• IP hashes: retained for abuse prevention. As salted hashes with no stored raw IP, they cannot be traced back to you.

Your rights

• Delete your own pins any time (tap the pin, then delete), and listings from their manage link.
• Unsubscribe from any email through the link it carries.
• Request deletion of data associated with you by emailing hi@vaadagai.homes. Because map pins carry no identity and IPs are only ever stored hashed, there may be nothing that identifies you to erase.
• We never sell, rent, or trade personal data.

Security

Everything is served over HTTPS. Coordinates are rounded before storage, IPs are stored only as a salted hash, and the server refuses to start in production without a secret salt. Rate limits, a daily read budget, and low-zoom aggregation resist bulk scraping. With no passwords and no accounts, there is no credential store to breach.

Contact and changes

Questions or a data request: hi@vaadagai.homes. We may update this policy; continued use after a change means you accept it.