Privacy

Privacy policy

Last updated: April 29, 2026

This is a plain English summary of how AllRoost handles your data. We try to collect as little as possible and tell you exactly what happens with what we do collect. If you have questions, email privacy at our domain.

What we collect

When you search, we record the search terms you type and the dates you select so we can show relevant results. When you click Book Direct, we record that click with a random session id so we can show hosts how many guests we sent them.

When you submit a host lead at /for-hosts or a property at /submit-property, we save the email address and any URL you enter so a human can follow up.

We do not collect your name, address, payment information, or government identifiers. Bookings happen on the host's own site, not on AllRoost. We never see your card or booking confirmation.

Cookies

We set one cookie containing a random session id so we can group your search activity without identifying you personally. We do not use third party advertising cookies. We may add a privacy friendly analytics tool such as Plausible later. If we do, this page will be updated and analytics will run without cross site tracking.

What we share

When you click through to a host's booking site, your browser sends standard information to that site (the page you came from, your IP address, your user agent). That is how the web works. Hosts may have their own analytics. We have no control over their handling of your information once you arrive there.

We do not sell your data to anyone. We do not buy data about you from anyone.

Data we keep about hosts

We maintain a directory of vacation rental properties. Property records contain public information (name, location, photos hot linked from the host's own site, amenities, base rate). We also keep contact records when a host opts in by emailing us, submitting through /for-hosts, or being listed in a public government short term rental registration database we ingest.

Hosts can request removal at any time by emailing us. We will remove the listing within 5 business days. Email contact records associated with the listing are deleted on the same timeline unless a legal obligation requires us to retain them.

Children

AllRoost is not directed at children under 13. We do not knowingly collect data from children under 13. If you believe we have, contact us and we will delete it.

Where data lives

AllRoost runs on Vercel (hosting) and Supabase (database). These vendors are based in the United States. By using AllRoost you consent to your data being processed in the United States.

Your rights

Depending on where you live, you may have rights under laws like CCPA (California), CPRA, GDPR (EU), or PIPEDA (Canada) to access, correct, or delete data we hold about you. To exercise those rights, email privacy at our domain. We aim to respond within 30 days.

Changes

We may update this policy. Material changes will be posted here and the date at the top updated. Continued use of AllRoost after changes means you accept the updated policy.

This document is a starting point and not legal advice. If you operate AllRoost, have a lawyer review it before launch.