Privacy Policy

• Account: your name, email, and a securely hashed password (we never store your password in plain text).
• Sublease details: the address, dates, rent, and terms you enter, plus the name and email of the person you invite.
• Signature record: your typed e-signature, the date and time, your IP address and browser, and a fingerprint of the exact terms you signed, kept as legal evidence that the agreement is authentic.
• Condition photos: the photos you upload, stored as you send them. A photo file can carry embedded metadata (such as a capture timestamp, camera make/model, and, if your device recorded it, location/GPS). We do not read, extract, or use that location data, and the timestamp we rely on is the time our server receives the photo, but the original file you upload is kept intact, so treat the photos you share as containing whatever your camera saved in them.
• Messages to us: emails and support requests you send.
• Usage & security logs: events such as logins, signatures, and invites, with timestamps and IP address, to keep accounts secure and understand the flow.

To provide the service, send you transactional email (confirmations, invites, password resets), keep accounts secure and prevent fraud and abuse, meet legal and tax obligations, and understand and improve how Avouch works. We do not sell your data or use it for third-party advertising.

Service providers that help us run Avouch process data on our behalf, under contract and only as needed: database and file-storage hosting (Supabase), email delivery (Resend), application hosting (Vercel), and payments and bank account connections (Stripe). We also disclose information when required by law or to protect rights and safety, and we may transfer data as part of a merger, acquisition, or sale of the business. We do not sell your personal information.

We use a single secure, http-only cookie to keep you signed in. No third-party advertising or tracking cookies.

Passwords are hashed with scrypt; your session rides in a signed, http-only cookie that scripts cannot read; traffic is encrypted in transit (HTTPS); access to a sublease is limited to its parties; and we rate-limit sensitive actions to slow abuse. No system is perfectly secure, but we take reasonable measures to protect your data.

We keep your data while your account and sublease are active, and for a reasonable period afterward to meet legal, tax, audit, and dispute needs. Signature and agreement records that document a completed agreement may be retained as a legal record even after an account is closed, while your contact details are removed or anonymized.

You can delete your account yourself from your account settings once you have no active subleases; doing so removes or anonymizes your personal contact details. You may also email support@avouchsublease.com to request access to, correction of, or deletion of your data, or to ask a question. Depending on where you live, you may have additional rights over your personal information; we will honor those that apply to you.

Avouch is for adults. It is not directed to anyone under 18, and we do not knowingly collect data from children.

Avouch and its providers operate in the United States, and your data is processed there. If you use Avouch from elsewhere, you consent to that processing.

When automatic rent payments are part of a sublease, bank accounts are connected and verified by Stripe, our payments provider. Stripe collects your bank details directly; Avouch never sees or stores full account or routing numbers. We store only what is needed to run the payment schedule: the bank's name, the account's last four digits, and Stripe's references for the saved account and payment authorization. Rent moves through Stripe directly between the parties and never sits in an Avouch account.

We may update this policy; material changes will be posted here with a new date. For any privacy question or data request, email support@avouchsublease.com.