Privacy
RentStand is small, which is why this can be the plain version: what we keep, who can see it, and how to get rid of it. Everything below is the product as it works today, not what we're planning to add. If a sentence here isn't true, that's a bug like any other bug, and we want to hear about it.
Last updated September 12, 2026.
What we keep
If you run a shop. Your email address, which is your login. Your shop and listings: shop name, city and region, contact phone, payment instructions, your rental terms, your items and their photos. What's on your public shop page is public; that's what it's for.
- Two things on that same record are not public and never shown to someone just browsing: your payment instructions and your contact phone. Those reach a renter only once you've approved their booking.
- If you price delivery by distance, we also keep the centre point you set for your rings. We never publish it and never send it to a renter's browser. But read the location section below, because "we don't publish it" isn't the whole story.
If you're renting something. The name, email, phone and message you put in a booking request, and the dates you asked for. If you're asking for delivery: the address you type, and the pin you drop on the map if you drop one. All of it goes to exactly one place: the owner of the shop you booked with. Not other owners, not other renters, not anyone browsing the site.
Whoever you are.
- Your IP address, briefly and only in memory, so nobody can flood a shop with fake booking requests. We don't write it to our database.
- Which features get used: "a listing was published", "a request was approved", "a deposit came back". Those records hold the event name, internal ids, and where money moved, the amount. If you arrived from a link we put somewhere, they hold what that link said too. What they never hold is a name, an email address, a phone number, or a location.
- A cookie that keeps you logged in, and one that remembers your answer to the Google question for 13 months. If you said yes to Google, its own cookies too.
- One more, and only if you arrived from another site or from a link we put somewhere: it holds what that link said and the name of the site that sent you, for 90 days, so we can tell which of the things we try actually brings owners here. That is all it holds. It never gives you a number of your own, and nothing in it goes to anybody but us.
If we built a page for you. We may build an unpublished page from an operator's public listing: the items, prices and business name that listing already shows. Only that operator can see it, through a private link. We delete it when they ask, and on our own after 30 days if nobody claims it.
Location
Where you are is the most sensitive thing we hold, and it's the newest, so it gets the longest section on the page. It's worth the read.
Your pin, if you're renting. A delivery pin does two jobs: it works out what delivery costs, and it tells the owner where they're driving. It goes to that one owner, on that one booking: never public, never sold, and it never turns up in our usage numbers. And it's optional: a typed address works too.
Your centre point, if you run a shop and price delivery by distance. Your prices change with distance, which means every quote you give is an answer to "how far is this address from your centre?" And someone patient enough to ask that from enough addresses could work backwards to roughly where your centre is. That's true of any delivery priced by distance, ours included, and you should hear it from us rather than work it out yourself.
So before anything is measured, we round your centre onto a grid. The closest anyone gets by asking is a block-sized patch of roughly 400 by 550 metres, not your door. That limits it. It doesn't erase it. If that's more than you want to live with, two things work today: set your centre to a corner or a landmark near you instead of your own address (your prices stay right to within a block), or skip rings altogether and charge one flat delivery fee.
Maps. Map images load straight from OpenStreetMap's servers to your browser rather than through us, so OpenStreetMap sees your IP address and roughly which patch of the map you were looking at. They're a non-profit mapping project, not an advertising company: no cookies, no profile of you. They are still someone other than us, though, and that's the kind of thing this page is for.
"Use my location". That button does nothing until you tap it, and your browser asks you before it answers. The coordinates stay on your device unless you go on to submit them with a booking. That button is the only thing here that asks your device where you are, and it never asks on its own.
Photos
Listing photos are public. They're on a public shop page, so treat them that way.
Condition photos are the before-and-after pictures the two of you take at handover and at return. They are also, usually, pictures of somebody's driveway, garage or front room, so we treat them as the most private thing in the product.
- They're stored privately, and the link that shows you one is made the moment you open the page and stops working ten minutes later. It never goes into an email, and it never goes into a log.
- Two people can see them: the owner and the renter on that one booking. Nobody else: not another owner, not anyone browsing the shop.
- The location tag comes off before the photo is stored. Phone cameras quietly record the exact spot a picture was taken, which is usually somebody's home. Nobody should have to know that in order to be safe from it, so it comes off on upload, and a test fails our build if we ever stop doing it.
- Our rule is to delete them 24 months after a rental is finished, and to hold that back for another 6 months past the end of a dispute if there was one. Straight with you: RentStand is new, no photo here is close to two years old, so that clean-up hasn't had to run yet.
Who else is involved
Running a website means renting a few things yourself. Here's everyone we rent from:
- Supabase: the database, the file storage and the login links. Everything described above lives there.
- Railway: runs the website itself.
- Resend: sends our email when there's email to send, and holds the list of people who asked for shop news. Untick the box in your settings and we take you off that list too.
- OpenStreetMap: the map images, as described above.
- OpenAI: if screenshot import is available and you choose to use it, reads the screenshots for one import request so it can fill an editable listing draft. RentStand does not save those screenshots. OpenAI does not use API content to train its models by default, but its standard abuse-monitoring logs may retain submitted content for up to 30 days.
We don't sell your data, and nobody can buy their way into it.
Google is the only company other than us that can be told anything about your visit, and it's told nothing unless you say so. There are two questions and they're separate on purpose: a yes to one isn't a yes to the other. Both start off.
Analytics. If you say yes, Google gets which pages you looked at and what you did on them, roughly where the visit came from, and when money moves on a booking, the amount. If you run a shop and you're signed in, it also gets a code that stands for your account. That code isn't your name and it isn't your email. It is still a code for one person rather than one browser, which is what lets Google tell that your phone and your laptop are you.
Advertising. Say yes and Google's advertising tag loads, and the same visit can be used to show you RentStand ads on other sites. Leave it off and that tag isn't on the page at all.
Neither loads until you say yes: no script, no cookie, nothing at all leaving your browser before then. Say no to both and Google never hears from your browser, not even a count. Nothing about the site works differently either way. If your browser sends a Global Privacy Control signal we read it as a no, so we don't ask and nothing loads.
Whatever you choose, Google never gets your name, your email address, your phone number, a delivery address, the dates on a booking, or anything a renter typed. The list of what may be sent is fixed in code, and a test fails our build if anything is added to it.
Change your mind whenever you like, under Cookie choices at the bottom of any page. We remember your answer for 13 months and then ask again. Turning something off stops the sending from then on. What Google already has stays with Google. Our anonymous aggregate page counts stay separate from the optional source measurement below.
Shared rental links
Shop owners must accept the updated terms before source measurement starts for their shop. Owners can continue managing their shop and bookings without enabling it. This does not replace each visitor's separate cookie choice.
With Analytics enabled under the current cookie choices, RentStand records the channel named in a shared rental link, the shop and visit time, and a random receipt stored in your browser tab. If you send that shop a rental request before that receipt expires, we attach the channel to the request. This helps the shop owner see aggregate counts of link visits, requests and completed bookings. A forwarded link keeps its original channel, so these are partial counts rather than proof of where someone found the shop.
We do not send this receipt or booking association to Google. The measurement records contain no name, email, phone number, IP address or device profile. The receipt expires after 24 hours. Our daily cleanup removes measurement records older than 31 days. Booking records follow their separate retention rules. Turning Analytics off stops future source measurement; existing counts remain until that cleanup. You can browse and book without agreeing.
An earlier choice that only mentioned Google does not authorize this new measurement. We ask again before adding it, and continue to honor earlier declines and Global Privacy Control.
There are two kinds of email from us. One is part of using the product and one is yours to switch on or off, and the difference between them is worth knowing.
About your account and your bookings. A sign-in link. A booking request. An approval. A payment receipt. A reminder the day before. A note when a deposit comes back. This is the product doing its job, so it isn't optional: if you have a booking with someone, you get the emails about it. When we pass a message between an owner and a renter, replying goes to that person rather than to us.
Shop news, which is yours to choose. This is the marketing kind, and there is one box for it. The box starts empty. You meet it when you set up your shop, and it lives in your settings after that. Tick it and we can email you tips for renting out your stuff, and what's new here. We never tick it for you, and agreeing to our terms is never the thing that opts you in.
Untick that same box whenever you like and we stop right away: no reason needed, no cost, nothing to wait for. We keep a record of what the box said and when you ticked it, so we can show you what you agreed to. None of it touches the emails about your bookings, which keep coming either way.
If you're renting something rather than running a shop, you are not on that list at all. The address you type into a booking request is used to run that booking, and it goes to that one owner.
Getting a copy, or getting it deleted
There's no delete button yet. Taking down an account, or a single booking request, is done by hand by a person, and that person tells you when it's done.
Email support@rentstand.co and say which you want: a copy of your data, or it gone. If you're renting, mention the shop you booked with and roughly when, so we can find the right record.
When this changes
The product is changing quickly, so this page will too. It gets updated when what we do changes, not afterwards.