Privacy Policy

[LEGAL ENTITY NAME], [REGISTERED ADDRESS], operating as Loctarim, is the controller of the personal data described here — meaning we decide what is collected and why.

For anything about your data, write to privacy@[YOURDOMAIN.COM]. We aim to respond within 30 days.

Only what the Service needs to work. In full:

You give us

Account details

Your email address, a display name, and a password — which we store only as a bcrypt hash and can never read back. Optionally a short bio.

Your approximate location

A neighbourhood you choose, stored as a coarse label and a coordinate pair. Used to measure distance. See Location.

Listings

Titles, descriptions, photos, condition, prices, quantities, availability, a public area label, and — separately — private pickup instructions.

Rental activity

Requests you make and receive, dates, quantities, the price breakdown at the time, status changes with timestamps and who made them, and any note attached to a request. If a damage claim is filed on a rental: the amount, the written reason, and how it was resolved.

Messages

The content of messages you send within a rental thread, with sender and timestamp.

Reviews

Ratings and review text you write, and those written about you.

Searches and saved items

Search text you choose to save, listings you favourite, and “wanted” posts you publish to the demand board — including the text as you typed it.

Reports

If you report a listing or a person: what you reported, the reason, and any detail you add.

We collect automatically

Session records

When you sign in we record a session with its creation and expiry time and a short device description, so you can see where you are signed in and sign out everywhere.

Server logs

Ordinary web-server and error logs, which may include IP addresses, timestamps and the page requested. Used to keep the Service running and secure.

Rate-limit counters

Failed sign-in attempts are counted against an email address and an IP address, in memory, to slow password guessing.

What we deliberately do not collect

• No card numbers. Where card payments are enabled, card details are entered on our payment processor's hosted pages. We receive only a token and a display label such as “Visa ···· 4242”. No card number, expiry or security code ever reaches our servers or our database.
• No government ID document, and no data extracted from one. Identity verification is optional. Where you choose to use it, the document photograph and the selfie are captured on our verification provider's own pages and are sent to them, not to us — the same arrangement as card details. We receive the outcome and nothing else: whether the check passed, when, and the provider's reference for the session. We never hold the images, your ID number, your date of birth or your address, and we run no background checks of any kind.
• No advertising or cross-site tracking. There are no third-party advertising tags, no analytics cookies and no tracking pixels on this Service. We do not build advertising profiles and we do not participate in cross-context behavioural advertising.
• No photo metadata. EXIF data — including GPS coordinates recorded by your phone — is stripped from uploaded images before they are stored.

Location is the most sensitive thing this Service holds, so it is worth being exact about how it moves.

• Coordinates are stored for your account, for each listing and for each demand post. They are used to compute distances.
• Coordinates are never sent to a browser. Distance is computed on the server; what a public page receives is a distance and a coarse area label such as “Sellwood-Moreland”.
• Any coordinate that does leave the server is displaced. Where a listing needs an approximate point for display, it is offset from the true position by roughly a quarter to one mile. The offset is derived from the listing id rather than randomly, so it does not shift between page loads and cannot be averaged away by requesting the page repeatedly.
• Private pickup instructions are released only on acceptance. The exact address, gate code or “bins by the garage door” detail an owner writes is visible to the owner, and to the renter only once a request has been accepted. It is never on a public page, in search results, or in the sitemap.
• Browser geolocation is optional. If you use it, your browser asks first, and you can decline and pick a neighbourhood instead.

The right-hand column matters if you are in the UK, the EU, or somewhere with comparable law; if you are not, read it as our reason.

To provide the Service — accounts, listings, search, rentals, messages

Performance of our contract with you. Without this data there is no service to provide.

To keep people safe — reports, moderation, abuse and fraud prevention

Our legitimate interest in a safe marketplace, and other users' legitimate interest in not being defrauded or harmed.

To secure the Service — sessions, rate limits, logs

Our legitimate interest in security, and our legal obligation to protect your data.

To process payments and payouts

Performance of our contract, and compliance with tax and anti-money-laundering law.

To send service emails — password resets, rental notifications

Performance of our contract. These are not marketing and cannot be opted out of while you hold an account.

To comply with law and respond to lawful requests

Legal obligation.

Where we rely on legitimate interests, we have weighed them against your rights and you may object — see Your rights.

Other users

Anyone, including signed-out visitors and search engines

Your display name, avatar, bio, area label, rating, completed-rental count, and your active listings with their photos, descriptions and prices.

The other party to a rental

Everything above, plus the messages in that thread, the rental's history, and — once a request is accepted — the private pickup instructions.

Nobody but you

Your email address, your password hash, your exact coordinates, your saved searches, your favourites, your session list, your payment tokens, and the content of your reports.

Reports are not shown to the person reported, and we do not tell them who reported them.

Service providers

We share data with a small number of processors, each only with what they need:

Database and file hosting

Stores the application database and uploaded listing photos. Currently Supabase.

Payment processing

Stripe, where card payments or payouts are enabled. Stripe receives what it needs to process a payment and to verify a payee, and is an independent controller for its own compliance purposes. See Stripe's own privacy policy.

Transactional email

Delivers password-reset and notification emails. Currently Resend. It receives your email address and the message content.

Error monitoring

Where configured, receives error reports which may incidentally include a user id and a request path. Configured to avoid message bodies and credentials.

Language model provider

This deployment has an external model configured. Text you type into search, and text you ask the listing helper to draft, is sent to that provider to be interpreted. Your name, email and coordinates are not sent with it.

Everyone else

We do not sell your personal data, and we never have. We do not share it for cross-context behavioural advertising. We disclose it otherwise only where we must: to comply with a valid legal process, to enforce our terms, to protect someone's safety, or to a successor in a merger or acquisition — in which case this policy continues to apply until you are told otherwise.

This Service uses no advertising, analytics or tracking cookies. What it does use:

localrent_session — strictly necessary

Keeps you signed in. Set only after you sign in, expires after 30 days, and is marked HttpOnly (so page scripts cannot read it), SameSite=Lax (so another site cannot use it) and Secure in production. Signing out revokes it on the server, not just in your browser.

Theme preference — local storage, not a cookie

Whether you chose light or dark. Stored in your browser, never sent to us.

Because the only cookie is strictly necessary to deliver a service you asked for, no consent banner is required under the ePrivacy rules. Clearing it simply signs you out.

Your account and profile

Until you delete your account.

Listings

Until you delete them. Archived listings stay visible to you and drop out of search and the sitemap.

Rental records, including the price breakdown and status history

Kept after account deletion where we need them for tax, accounting or dispute-defence reasons, in a form disconnected from your profile. Typically seven years.

Messages

For the life of the rental thread. Deleted with the rental record, subject to the retention above and to any safety investigation under way.

Reviews

Reviews you wrote about other people remain, attributed to a deleted account, because removing them would silently rewrite someone else's public history.

Sessions and password-reset tokens

Until they expire or are revoked; reset tokens are single-use.

Server logs

Typically 30 days, longer where an incident is being investigated.

Reports and safety records

Kept while relevant to protecting other users, including after the reported account closes.

Wherever you live, you can ask us to:

• tell you what we hold about you, and why;
• give you a copy in a portable, machine-readable format;
• correct anything inaccurate — most of it you can edit yourself in your profile and listings;
• delete your account and the data tied to it, subject to the retention above;
• restrict or object to processing we base on legitimate interests;
• withdraw consent where we relied on it, without affecting what came before.

We will not discriminate against you for exercising any of these — no degraded service, no different pricing.

Some limits are honest ones. We cannot delete your side of a rental another person is relying on, cannot remove reviews you wrote about other people, and cannot delete records we are legally required to keep. Where we refuse part of a request we will tell you which part and why.

If you are in the UK or the EU

You have the rights above under the UK GDPR and GDPR, plus the right to lodge a complaint with your national supervisory authority — in the UK, the Information Commissioner's Office. We would rather you came to us first.

If you are in California or another US state with a privacy law

You have the rights to know, delete, correct and obtain a portable copy, and to opt out of sale or sharing for cross-context behavioural advertising — we do neither, so there is nothing to opt out of. We do not use or disclose sensitive personal information for purposes requiring a limitation right. You may use an authorised agent, and we may ask you both to verify the authority.

To exercise any right, email privacy@[YOURDOMAIN.COM] from the address on your account, or write to us at the postal address above. We may need to verify your identity before acting on a request, which usually means confirming control of the account email.

• Passwords are stored as bcrypt hashes, never as recoverable text.
• Sessions are signed tokens tied to a server-side record, so signing out invalidates every copy rather than just the one in your browser.
• Access to another user's data is blocked at the query level — ownership is checked on every read and write, not only in the interface.
• Traffic is served over HTTPS, with a content security policy limiting what a page may load and execute.
• Sign-in attempts are rate-limited against both email address and IP.
• Uploads are validated, re-encoded, and stripped of metadata.

No system is perfectly secure. If we discover a breach affecting your personal data we will notify you and the relevant regulator where the law requires, and tell you what happened and what to do.

We are based in United States, and our service providers may process data in other countries. Where data moves out of the UK or the European Economic Area, we rely on an adequacy decision where one exists, and otherwise on the UK International Data Transfer Addendum or the European Commission's Standard Contractual Clauses, together with additional safeguards where needed. Ask privacy@[YOURDOMAIN.COM] for details of the mechanism used for a particular provider.

The Service is not for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us personal data, tell us at privacy@[YOURDOMAIN.COM] and we will delete the account and its data.

We will post any change here with a new effective date. If a change materially affects how we use data you have already given us, we will tell you by email or in the Service before it takes effect — not merely by editing this page.