Privacy Policy

The short version

• We store your email address, the Airbnb listings you choose to watch, and the availability history we collect for them.
• We never ask for, receive or store your Airbnb login. StaySonar reads only what Airbnb already shows to anyone with the listing link.
• There are no analytics, advertising or tracking cookies on this site. One cookie exists, and it is the one that keeps you signed in.
• We do not sell your data, and we do not share it for marketing.

Who is responsible

StaySonar is operated by [ENTITY — TO BE COMPLETED][ADDRESS — TO BE COMPLETED]. For anything in this policy, or to exercise any of the rights below, write to [email protected].

What we collect

Your account

• Email address — your login, and where booking alerts are sent.
• Name, if you give one or it comes from your Google profile.
• Password, stored only as a bcrypt hash. We cannot read it, and we cannot recover it for you — only reset it.
• Google account identifier, if you sign in with Google. We receive your email address, name and a stable account id. We do not receive your Google password and we ask for no access to any other Google service.
• Your plan, trial end date, and whether you want alert emails.

The listings you track

For each listing you add, we store its Airbnb link and identifier, and the public details Airbnb shows for it: title, city, rating, review count and cover photo. We then record that listing's night-by-night availability each time we check it, so we can tell you what changed between checks.

This is information Airbnb publishes to anyone with the link. It is not personal data about you, and it usually is not personal data about the host either — but it is data you chose to collect, and it is deleted along with the listing when you remove it.

Technical records

• Error logs — when something breaks, we record what failed, on which page, and the request that caused it. These are kept for 90 days and then deleted automatically.
• IP address — recorded against failed sign-in attempts and administrator actions, and used to rate-limit sign-ins, password resets and sign-ups. Rate-limit records are deleted after one hour.
• Email delivery records — the address, subject and delivery status of each message we send you, so we can tell whether an alert actually arrived.

What we deliberately do not collect

• No Airbnb credentials, ever.
• No payment card details. Card data, when card payments exist, will be handled entirely by the payment processor and never reach our servers.
• No analytics, no advertising identifiers, no behavioural profiling, no session recording.
• No competitor prices — Airbnb's availability data returns no price, and we do not guess.

Cookies

StaySonar sets one cookie, SSAPPSESSID. It keeps you signed in and nothing else. It is scoped to .staysonar.com so that a sign-in on the main site carries over to the app, it is marked HttpOnly, Secure and SameSite=Lax, and it expires when you close your browser.

Because we run no analytics or advertising cookies, there is no consent banner to click through. That is a deliberate choice, not an omission.

Who else processes your data

We use a small number of providers, each for one job:

• Brevo (Sendinblue, France) — sends your booking alerts and account emails. Receives your email address and the contents of those messages.
• ScrapingBee (France) — fetches the public Airbnb pages we read. Receives the listing URLs, never anything about you.
• Google — only if you choose "Continue with Google", and only to confirm your identity at sign-in.
• Cloudflare — sits in front of the site to serve it and filter abuse. Processes connection data including your IP address.
• Our hosting provider — stores the database and the application.

We do not sell personal data, and none of these providers is permitted to use your data for their own purposes.

Sending you email

We send two kinds of email: account messages (confirming your address, resetting your password) and booking alerts for the listings you track. There is no marketing mail.

You can turn booking alerts off at any time — from the toggle in your account settings, or from the unsubscribe link at the foot of every alert. Turning them off stops the email; alerts still appear in the app.

We hold alerts back for accounts whose email address has not been confirmed, rather than sending them. That protects both the wrong recipient of a mistyped address and our ability to deliver mail at all.

How long we keep things

• Account and listings — for as long as your account exists.
• Availability history and alerts — deleted with the listing they belong to, immediately, when you stop tracking it.
• Error logs — 90 days.
• Background job records — 7 days after completion.
• Rate-limit records — 1 hour.

Your rights

You can ask us to give you a copy of your data, correct it, or delete it. Deleting a listing removes its entire history straight away. To delete your whole account, email [email protected] and we will remove it and everything attached to it.

If you are in the UK, EU or another region with comparable law, you also have the right to object to or restrict processing, the right to data portability, and the right to complain to your data protection authority.

Security

Passwords are hashed with bcrypt. The site is served over HTTPS. Administrative actions are recorded in an audit log. Sign-ins, password resets and sign-ups are rate-limited against brute force.

No system is perfectly secure, and we would rather say so than imply otherwise. If you find a vulnerability, please tell us at [email protected] before disclosing it publicly.

A note about the data you collect

StaySonar helps you gather publicly visible information about other people's listings. What you then do with it is your responsibility — see the Terms of Service. In particular, do not republish another host's availability data as if it were your own, and do not use it to harass anyone.

Changes

If we change what we collect or who processes it, we will update this page and change the date at the top. Material changes affecting existing accounts will be emailed to you.