What we collect
You give us: name, email address, password (stored only as a salted hash), profile details, listing content, messages, booking details, and — optionally, and only where we have enabled it — a phone number and identity verification.
We generate: booking and payment records, reviews, moderation records, and audit logs.
We collect automatically: approximate location derived from a place you search for, device and browser information, and a hashed form of your IP address. We do not store raw IP addresses.
What we do not collect
We never store payment card numbers, CVV codes or bank credentials. Those go directly to our payment processor.
Why we use it
| Purpose | What this covers |
|---|---|
| Operating your account and bookings | Signing you in, showing your listings and bookings, messaging your counterparty |
| Taking payment and paying providers | Charging cards, holding deposits, remitting payouts, issuing refunds |
| Preventing fraud and abuse | Rate limiting, moderation, enforcing bans, investigating disputes |
| Meeting tax and accounting obligations | Records our accountants and the IRS require us to keep |
| Product updates and marketing | Only if you opt in, and only until you opt out |
We do not use your personal information for automated decision-making that produces a legal or similarly significant effect on you, and we do not use it to train machine-learning models.
Location privacy
Exact addresses and coordinates are stored separately from listings and are never included in public listing data. What appears on a public map is a deterministically offset point within roughly 3900 feet (about 1200 meters) of the real location. The exact address is released only to the two parties of a booking, and only once that booking is confirmed.
Photographs are re-encoded on upload, which strips EXIF metadata including GPS coordinates.
Sharing
We share data with: our payment processor (to take payment and pay out), our email provider (to send transactional email), our hosting and storage providers, and — where a booking is confirmed — the necessary contact and location details with your counterparty. We may also disclose information where the law requires it, or to protect the rights and safety of members.
We do not sell your personal information, and we do not share it for cross-context behavioral advertising. We have not done so in the preceding twelve months. There are no advertising pixels or third-party trackers on this site, so there is nothing to opt out of — but the request form below is available regardless, and we will honor it.
Retention
- Account and profile: while your account is open.
- Bookings, payments and invoices: 7 years, for tax and accounting.
- Messages: 3 years after the related booking.
- Moderation and audit records: 3 years.
- Login attempt records: 90 days.
- If an account is permanently banned: a one-way cryptographic digest of the email address, kept until the ban is lifted. It cannot be reversed into an address and is used for one purpose only — recognizing the same address if it is used to register again.
Your rights
Borrowly operates in the United States. Several states — California (CCPA/CPRA), Florida (Florida Digital Bill of Rights), Colorado, Connecticut, Virginia, Texas and others — give residents rights over their personal information. We extend the rights below to every member, in every state, rather than asking you to prove where you live.
You have the right to:
- Know what personal information we hold about you and where it came from;
- Access a copy of it in a portable, machine-readable format;
- Correct anything inaccurate;
- Delete it, subject to the records we are legally required to keep (see Retention);
- Opt out of any sale or sharing for advertising — we do neither;
- Not be discriminated against for exercising any of these. Your account, pricing and service are unaffected.
You can access, correct, export or delete your data yourself from Settings → Privacy, with no request form and no waiting period. Because bookings and payments are shared financial records, account deletion anonymises your personal data rather than erasing transaction rows that another member and our accountants rely on.
These rights do not depend on your account being in good standing. If you are suspended, or banned and unable to sign in, request a link at http://localhost:3000/data-request and you can download your data or ask for deletion without signing in.
Where an account was banned, honoring a deletion request still leaves the digest described above. We retain it to enforce our terms and protect other members — without it, deletion would simply undo the ban and let the same person register again the same day. Nothing else about the account is kept, and the digest cannot be reversed into an email address.
Children
Borrowly is for adults. You must be 18 or older to hold an account, and we do not knowingly collect personal information from anyone under 18. If you believe a child has given us information, email legal@borrowly.local and we will delete it.
Contact
Data protection enquiries: legal@borrowly.local