Privacy Policy

Our Privacy Commitment

1. Information We Collect

Information You Provide

• •Account Information: Email address and, if you choose password sign-in, a password securely managed by our authentication provider
• •Search Queries: Your apartment search queries, including natural language searches and filter selections
• •Alert Preferences: Saved search criteria, notification frequency (instant, daily, weekly), and alert names
• •SMS Alert Information: If you choose SMS delivery, we collect your phone number, SMS consent text and version, consent timestamp, verification status, opt-out status, and SMS delivery metadata.
• •Saved Listings: Listings you bookmark and any personal notes you add
• •Location Preferences: Addresses or locations you search for (e.g., workplace address for commute calculations, points of interest like gyms or grocery stores)

Information Collected Automatically

• •Device Information: Browser type, operating system, device type (mobile/desktop), and in our iPhone app, device model, iOS version and app version. On your account we keep which phone operating system (iOS or Android) you last used our website from, and when you first and last opened our iPhone app, so we only suggest the app where it can help you
• •Push Notification Token: If you turn on notifications in our iPhone app, a token from Apple's push service that lets us send alerts to that device. Turning notifications off or signing out stops them
• •Usage Data: Pages visited, features used, search patterns, and interaction with listings
• •Log Data: IP address, timestamps, and error logs for security and debugging

Information We Do NOT Collect

• ✕Precise real-time GPS location
• ✕Payment card numbers (paid features are processed by Stripe; your card details never touch our servers)
• ✕Social Security numbers, income documents, or credit information as part of the search and alert service

One important exception: if a licensed real estate agent invites you to complete a rental application packet, we collect the application documents you choose to upload, which can include income and identity documents (some of which may show your Social Security number), and, only if your agent asks for it after you submit, your Social Security number. Section 2 explains exactly what we collect there, who can see it, and when it is deleted. If you never use the Application Service, none of that collection applies to you.

2. Rental Applications

The Application Service helps you assemble a rental application when a licensed real estate agent invites you to apply for a specific apartment, whether as the primary applicant, a co-applicant, or a guarantor. It also covers your renter profile, where you prepare your own application without an agent. Because an apartment application involves sensitive documents, this section describes our practices for application data in detail. The Rental Application Terms govern your use of the feature.

What We Collect

• •Application documents you upload: depending on the requirements the agent sets, these can include a completed application form, government photo ID, pay stubs, employment letters, bank statements, W-2s, tax returns, credit reports, credit check authorization forms, landlord references, and the equivalent documents for a guarantor
• •Application details you provide: your legal name, annual income, employment or income type, and notes you share while assembling your packet
• •Verified phone number: collected with your separate, recorded consent so the agent and our service can reach you about your application

Documents you upload may inherently contain sensitive identifiers such as Social Security numbers or bank account numbers. We never ask for these as standalone fields, and we automatically strip them from any structured data our systems extract from your documents.

AI-Assisted Document Review (Agents’ Applications)

Who Can See Your Application

• •The agent who invited you can review your documents and the assembled packet
• •The landlord receives the assembled packet when the agent forwards your application
• •Nobody else on your application. Each applicant, co-applicant, and guarantor uploads their own documents through their own private link. A guarantor's files never pass through the applicant, and vice versa

Application documents are stored in private, access-controlled storage. They are never used for advertising, never sold, and never shared with anyone beyond the agent and landlord your application is addressed to, except as required by law.

If Your Agent Asks for Your Social Security Number

Leaseswap’s own application form does not ask for your Social Security number. If your agent uses their own application form instead, it may ask for it, and a completed form you upload is handled like your other application documents, as are pay stubs or tax forms that show it. Separately, after you submit, your agent may ask one tenant for it through Leaseswap for a stated reason, such as setting up a rent-payment account with the landlord. The rest of this section is about that request. You will see who is asking, why, and who will receive it before you enter anything, and you can tell us you cannot provide one instead. You enter it on a page that requires you to sign in; we never accept it by email, text, or chat.

We encrypt it with a key that is held outside our database, separately from the rest of your application. Only the person your agent named as its recipient can view it, and only after signing in with that email address; other people on your application, and your agent unless they named themselves, cannot. It is never added to your packet, your e-signature forms, emails, messages, or analytics. We delete it 7 days after the recipient first views it, or 30 days after you first send it, whichever comes first. From that moment nobody can view it, and it is erased from our database within the hour. We cannot delete copies the recipient has already made in their own systems, and backups may hold the encrypted copy for up to 30 days after deletion.

Your Renter Profile

• •What we collect: the answers you give (your name, contact details, date of birth, current and prior addresses and landlords, employer details, income and where it comes from, household size and pets, an emergency contact, and a note), the documents you upload, and the applications you sign. We do not ask for your Social Security number
• •How we use it: to show which documents back up your answers, to fill in your application for each apartment, and to assemble the PDF you download. AI (Amazon Bedrock, under the zero data retention setup above) reads only each document’s type and date, which you can change; it reads nothing else from your documents, and your profile is never used to evaluate you
• •Who can see it: only you. We do not send it to agents, landlords, or anyone else; you download it and send it yourself. You sign through Documenso, an e-signature service we run on our own servers
• •How long we keep it: 6 months after you last update it. We email you 30 days before anything is deleted, and you can delete any document, application, or answer, or your whole renter profile, at any time. For an application you signed, our e-signature service keeps its record of the signature as evidence of the signing

How Long We Keep Application Data

We delete your uploaded documents and the compiled packet 30 days after your application reaches a final state (forwarded, accepted, rejected, withdrawn, or expired), and we purge the personal data our systems extracted from them at the same time. Deleting your account also deletes your packet documents.

3. How We Use Your Information

We use your information to:

Provide the Service

• •Process and display apartment search results based on your queries
• •Calculate commute times and distances to locations you specify
• •Send you email alerts, or push notifications in our iPhone app, when new listings match your saved searches
• •Send apartment alert text messages if you explicitly opt in to SMS delivery and verify your phone number
• •Store and sync your saved listings and notes across devices
• •Authenticate your account and maintain your session

Improve the Service

• •Analyze usage patterns to improve search quality and features
• •Debug errors and improve platform stability
• •Develop new features based on aggregate user behavior (not individual tracking)

Communicate With You

• •Send alert notifications you've configured
• •Respond to support requests
• •Send important service announcements (security issues, Terms changes)

Protect the Service

• •Detect and prevent fraud, abuse, and security threats
• •Enforce our Terms of Service
• •Comply with legal obligations

4. Search Query Processing

5. Location Data

When you use commute or distance filters, we process location data as follows:

• •Geocoding: We convert addresses you enter into coordinates using OpenStreetMap/Nominatim. When you type an address, our servers look up suggestions from NYC Planning’s GeoSearch and from Photon (komoot’s OpenStreetMap search); they receive what you type, not who you are
• •Commute Calculation: We use the Valhalla routing engine to calculate travel times by transit, walking, cycling, or driving
• •Caching: Calculated isochrones (commute areas) may be cached to improve performance
• •No GPS: We do not access your device's real-time GPS location

6. How We Share Your Information

Service Providers

We use trusted third-party services to operate Leaseswap:

We Do NOT Share With

• ✕Advertisers or marketing companies
• ✕Data brokers or aggregators
• ✕Landlords, brokers, or property managers, with one exception you control: if you complete a rental application packet, it is shared with the agent and landlord your application is addressed to (see Section 2). Your search and alert activity is never shared with listing sources
• ✕Social media platforms

Text messaging originator opt-in data and consent will not be shared with any third parties except as needed to provide messaging services. We do not sell or share SMS opt-in data or consent for marketing purposes.

Legal Requirements

We may disclose information if required by law, subpoena, or court order, or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

7. Cookies & Analytics

Essential Cookies

We use essential cookies to maintain your session and authentication state. These are required for the service to function and cannot be disabled.

Analytics (PostHog)

We use PostHog, a privacy-focused analytics platform, to understand how users interact with Leaseswap. This platform:

• •Is privacy-respecting and GDPR-friendly
• •Does not sell data to third parties
• •Collects account-linked usage events outside the Application Service, including your email address when you are signed in
• •Is disabled on Application Service applicant, broker, and administrative pages, including session recording
• •Respects Do Not Track browser settings
• •Also runs in our iPhone app, where it records app installs, opens and screens viewed, linked to your account when you are signed in
• •Estimates an approximate, city-level location from your IP address; it never receives your device's GPS location

8. Data Security

We implement industry-standard security measures to protect your data:

• •Encryption in Transit: All data is transmitted over HTTPS/TLS
• •Encryption at Rest: Our hosting provider, Supabase, encrypts all stored customer data at rest with AES-256. This covers both our database and the private storage holding files you upload, such as application documents. We do not add a separate layer of encryption of our own on top of the platform’s, with one exception: a Social Security number sent through an Application Service SSN request is also encrypted by our application, with a key kept outside the database (see Section 2).
• •Private Document Storage: Uploaded application documents are held in a private storage bucket with no public URL. A file can only be opened through a link our server generates after confirming you are entitled to see it, and those links expire after ten minutes. You can reach the documents you uploaded yourself, and the agent for the listing can reach the documents submitted to their listing. The assembled packet is available to that agent.
• •Row-Level Security: Database policies ensure you can only access your own data
• •Passwordless Auth: Magic links eliminate password-related security risks
• •Regular Monitoring: We monitor for security threats and unauthorized access

While we take security seriously, no system is 100% secure. We encourage you to use a secure email account and notify us immediately if you suspect unauthorized access.

9. Data Retention

• •Account Data: Retained while your account is active and deleted upon account deletion
• •Search History: Retained to power your alerts; deleted with your account
• •Saved Listings: Retained until you remove them or delete your account
• •Analytics Data: Anonymized and aggregated; may be retained indefinitely
• •Application Documents: Deleted 30 days after your application reaches a final state, along with the compiled packet and the data extracted from your documents (see Section 2)
• •Renter Profile: Deleted 6 months after you last update it, after an email 30 days ahead; you can delete it sooner (see Section 2)
• •Social Security Numbers (Application Service): Deleted 7 days after the recipient first views it, or 30 days after you first send it, whichever comes first (no longer viewable from that moment, erased within the hour)
• •Backup Data: May persist for up to 30 days after deletion for disaster recovery

10. Your Rights & Choices

You have control over your data:

• •Access: View your saved data through your account profile
• •Correction: Update your profile information anytime
• •Deletion: Delete your account and all associated data through profile settings
• •Export: Request a copy of your data by contacting [email protected]
• •Email Preferences: Manage alert frequency or disable notifications in your account settings

California Residents (CCPA)

California residents have additional rights under the California Consumer Privacy Act, including the right to know what personal information we collect and the right to opt-out of the sale of personal information. We do not sell personal information.

11. Children's Privacy

Leaseswap is not intended for users under 18 years old. We do not knowingly collect information from children. If you believe we have inadvertently collected information from a minor, please contact us immediately at [email protected].

12. International Users

Leaseswap is operated from the United States and focused on New York City rentals. If you access the Service from outside the US, your information will be transferred to and processed in the United States, which may have different data protection laws than your jurisdiction.

By using Leaseswap, you consent to the transfer of your information to the United States.

13. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes:

• •We will notify you via email (if you have an account)
• •We will update the "Last updated" date at the top
• •Material changes will be highlighted on the website for 30 days

Your continued use of Leaseswap after changes constitutes acceptance of the updated Privacy Policy.

14. Contact Us

Questions about this Privacy Policy or your data? Contact us: