Privacy policy

Rentnook has no advertising, no tracking, no analytics software and no third-party code of any kind. That makes this a short policy, and it is easier to write a short one that is true.

Who this is

Rentnook is an iPhone app published by Rick Conner, an individual rather than a company. Anything on this page can be asked about at support@rentnook.app, and a person reads what arrives there.

What Rentnook is for

Rentnook is a private line between an independent landlord and the people who live in their rental: rent records, messages and lease documents in one place. It never touches money — when rent is due it sends you to the payment app the two of you already use, or gives you the details to send it by hand, and the landlord records afterwards what actually arrived.

What Rentnook collects, and why

Everything below exists because some part of the app cannot work without it. There is no category here collected in case it turns out to be useful later.

Your email address

To sign you in. Signing in sends a six-digit code to that address; a password is optional and can be set later if you would rather use one. The address is also how we reach you if something about your account needs saying.

A display name, which the other party sees

So that a message and a rent record have a person's name on them instead of a stranger's. This is worth being plain about: the name you choose is shown to the landlord or tenant on the other side of your rental, on every message you send and every record you make. There is nowhere in Rentnook to be anonymous to the person you rent from, or rent to. If other people live in the same rental, the name is shown to them as well, not only to the landlord. Each record also keeps the name as it read at the moment it was written, so that a receipt from March still says who wrote it after you change your name in April.

Messages between a landlord and their tenants

Because the app is a conversation. Both sides hold the same copy, which is the point: a rental runs on what was agreed, and neither party can quietly revise it afterwards.

A maintenance request

Its title and description, any comment either side adds to it, and each change of its status, with the name of whoever wrote or made it. It is seen only inside that tenancy: its landlord and its current tenants, nobody else. A comment can't be deleted, the same as a message.

A photo on a maintenance request

A tenant or landlord can attach photos to a maintenance request, taken with Rentnook's own camera — there is no photo library access anywhere in the app. Before a photo ever leaves your phone it is checked on-device and re-encoded as a fresh image, which also strips whatever location the camera attached to it. It is seen only by that tenancy's landlord, its current tenants and whoever took it, even after they move out — nobody else. Nobody can delete a photo in the app. A photo goes when whoever added it deletes their account, when the landlord deletes their account, when the tenancy is deleted, or when we remove it after a report. See Keeping and deleting for what a report on a photo keeps.

A report, if you file one about a message, a comment or a photo

Every message can be reported, and so can a comment or a photo on a maintenance request. For a message or a comment, what is kept is the reason you picked, any note you type, the display name on each side of it, and a copy of it exactly as it was sent — the copy is the whole point of a report: without it, deleting the message or comment would destroy the evidence of the thing being reported. For a photo, what is kept is the same reason, note and names, but only where the photo is stored, not a copy of it. No one can delete a single photo in the app, but if the photo is later erased — because whoever added it deletes their account, because the landlord deletes their account, because the tenancy is deleted, or because we remove it after a report — the report is left pointing at nothing. A report goes to a person handling reports: the other party is never shown it, and you can see only the reports you filed yourself. See Keeping and deleting for how long one lasts, because the answer is longer than anything else on this page.

Rent records

The rent amount, the month it covers, the day it is due, the date a payment was received, the method the landlord recorded it under, and any note either of you added. If a tenant says what they have sent, that sits here too, as a claim from the tenant until the landlord records what arrived.

The rental itself

The property address and unit name the landlord enters, the rent, and the dates a tenancy starts and ends. A rent record with no address on it is not a record of anything.

Lease PDFs the landlord uploads

So that both sides can find the lease when they need it. See Lease documents below — these get their own section, because they deserve one.

A payment handle, if the landlord sets one up

The name or number their Venmo, PayPal, Cash App or Zelle account answers to, so a tenant is sent to the right account instead of retyping it every month. It is a handle, not an account: see What Rentnook never collects.

A device token, once the app has asked about notifications

So the server can tell your phone that a message or a rent record is waiting. The token identifies a phone rather than naming you, but it is stored against your account, so it is treated as linked to you. It sits alongside the app version and the phone's language. Once Rentnook has asked you about notifications, your phone registers a token with Apple and sends it here — whether you allowed alerts or turned them down, because a declined prompt still permits a silent push. Turning notifications off afterwards does not remove it. Signing out does: straight away if the phone can reach us, and otherwise the next time the app is opened and can. So does deleting your account.

Your subscription, if you have one

If you subscribe to Landlord Mode, Apple tells us which plan you chose, when the current period ends, and Apple's own identifiers for the purchase, and sends us a notice when it renews, lapses or is refunded. That is how the app knows what you can do. It is tied to your account. It never includes a card number or anything else about how you paid: Apple takes the payment, and Rentnook never sees it.

What Rentnook never collects

There is no advertising, no tracking, no analytics software and no third-party SDK in this app — not a crash reporter, not an attribution kit, not a session recorder. The app is built with zero third-party dependencies, deliberately, and that is the reason the list on this page is as short as it is. Nothing here is sold, and nothing here is shared with anyone for their own purposes. There is no advertising identifier, no profile of you, and no location tracking. Apart from the three companies that run the service, listed under Where the data lives, the only things that could put any of it in someone else's hands are set out under When we would have to hand something over.

We do count how Rentnook is used, from the records it already keeps in order to work: how many requests were filed in a week, say, or how many people finished setting up. Those are totals. Nothing more is collected to make them, and nothing leaves Rentnook for them.

Rentnook never sees a payment credential. No card number, no bank login, no wallet. It does not move money, hold money, or sit in the middle of a payment in any way.

Lease documents

A landlord can upload a lease as a PDF. Rentnook stores it as an opaque file — a run of bytes with a name on it. It is never read for its contents, parsed, OCR'd or indexed. Nothing extracts the text, nothing searches inside it, and no field in it becomes a field here. A lease is a document the app hands back exactly as it was given, and that is the whole of its involvement.

The file lives in a private storage bucket. There is no public link to a lease and no address you could paste into a browser that would open one. When someone opens a lease in the app, it is fetched with their own signed-in credentials, and that request is checked against the same rule as everything else: it is allowed only for the landlord of that tenancy and the people living in it.

Still, be deliberate about this. A lease can contain a Social Security number, a date of birth, a bank account, an employer, the names of children. Uploading one is the landlord's choice, not something the app requires, and a tenancy works perfectly well without a document in it. If you do upload one, you are asking us to keep something sensitive on a tenant's behalf as well as your own.

Who can see what

A tenant sees their own tenancy: their conversation, their rent history, their lease. A landlord sees the rentals they manage and nothing beyond them. Neither can see another landlord's properties or another tenant's home. This is not the app being careful about which screen it draws — the rule is enforced in the database, on every request, against the identity of whoever is asking. Code that asked for someone else's conversation would get nothing back.

Roommates share a tenancy, and everything in it. Where more than one person lives in the same rental, they are occupants of one tenancy: one conversation and one rent record between all of them and the landlord. Each of them sees the others' messages, the whole rent history of that tenancy, and the names on all of it. There is no separate thread with the landlord and no separate balance per person — if that is not what you want, it is worth knowing before you write anything.

Where the data lives

Rentnook is a United States app and its data is kept in the United States. Three companies are involved, and no others, except as set out below:

• Supabase — the database, sign-in and file storage, hosted in the us-east-1 region. This is where almost everything on this page is kept. Like any server, it also keeps ordinary connection logs — the time of a request and the IP address it came from — which are there for security and abuse and are used for nothing else. Nothing builds a profile out of them and nothing in the app reads them.
• Postmark — delivers email. Two kinds: the sign-in code to your address, and, when someone files a report, the alert that tells a person there is a report to read. That alert carries the reason, the display name on each side of the report and the report's id. The reported message itself is never in it — email is the least controlled place a private message could end up, so reading one means signing in to the database instead. Postmark has no access to anything else here.
• Apple — carries notifications to your phone, as it does for every iPhone app. If you subscribe to Landlord Mode, Apple also sells it, takes the payment, and tells us the plan, the period end and its own identifiers for the purchase, as described above.

When we would have to hand something over

Two things could put what is here in front of someone outside your rental. Neither is a business arrangement, and neither is a route around anything else on this page.

• Legal process. A subpoena, a court order, a warrant or another lawful demand. We would give what it actually asks for and no more, and where the law lets us tell you it arrived, we will.
• A genuine emergency. A credible risk of serious harm to someone — which is what a report sometimes turns out to be. That can mean giving what we hold to the police.

Outside those two, and the three companies above that run the service, nothing here goes anywhere. It is not sold, not rented, and not handed to anybody for their own purposes.

What is stored on your phone

• Your sign-in session, in the iOS Keychain, so you are not asked for a code every time you open the app.
• A copy of your conversations, inside the app's own storage, so a thread opens instantly and reads on a bad connection. It goes when you delete your account, when someone else signs in on this phone, and when the app is deleted.
• Four small settings. Whether the app lock is turned on. Which side of the app you were last using. And two lists: the identifiers of the rentals you live in, and of the rentals you manage. The lists are there so that a launch with no signal opens the right side of the app with the right conversations in it, rather than asking you to start over. They are identifiers — not an address, not a name, and nothing a stranger could read anything out of. The last three are cleared when you sign out, and all four go when the app is deleted.
• A lease you are looking at, for as long as you are looking at it. Opening one writes the PDF into the app's temporary folder so that the iOS previewer can display it — the only moment lease bytes touch the disk. That copy is kept out of every backup, written with full file protection so it cannot be read while the phone is locked, and deleted when you close the preview. The folder is also emptied each time the lease screen opens, so a crash mid-preview leaves nothing behind for long.
• Anything you have written but not sent. A message or a comment typed with no signal waits in a small file in the app's own storage, so that tapping Send in a basement is not something you lose. It leaves that file once it sends. If it can't be sent — whether the server refuses it or the app gives up after trying — what you typed stays on your phone so you can see why, until you discard it or, for a message, send it again. Signing out leaves it where it is, so it is still there when you sign back in.
• Which account your conversations and anything unsent belong to: its identifier, a random code — not your email, not your name — kept after you sign out so the next sign-in can be checked against it. If the next person is you, your conversations and anything unsent are where you left them. If it is someone else, or the app cannot tell, they are deleted before that person can see them, and nothing you wrote is sent from their account. Deleting your account deletes all three at once; otherwise the identifier goes when the app is deleted.
• Which notification token this phone was given, and which account it was registered to: the token and the account's identifier, in a small file that is kept out of backups. It is there for one thing. If you sign out while the phone cannot reach us, your notifications would otherwise go on arriving on it, and this is how the app has them stopped the next time it is opened and can. It goes once that is done, when a sign-out gets through in the ordinary way, and when the app is deleted.

Keeping and deleting

You can delete your account from inside the app, under Account → Delete account. It is real deletion, not deactivation, it takes effect immediately, and it cannot be undone. On the phone you delete it from, the copy of your conversations and anything you left unsent go at the same moment. What it does not do is reach into the other person's records, and it is better to say so here than to let you discover it afterwards.

If you are a tenant

Your profile, your sign-in and your personal details are removed, and your access to the tenancy ends at once. What stays is the other side's record of the rental: the rent records your landlord entered, any lease document they uploaded, and their copy of the conversation, including the messages you sent and the name that was on them when you sent them. The name you were using when you joined the tenancy stays on the tenancy record too. Those are your landlord's own records of their property, and a receipt that erases itself is not a receipt.

The same is true of a maintenance request: it stays, with any comment you added to it, as part of your landlord's record. A photo you added does not. There is no delete button for a photo in the app. A photo goes when whoever added it deletes their account, when the landlord deletes their account, when the tenancy is deleted, or when we remove it after a report.

If you are a landlord

Deleting your account permanently deletes every property, unit and tenancy you manage, along with their rent history, conversations, lease documents, and maintenance requests and photos. Your tenants lose access to all of it straight away. If anyone renting from you may need a copy of their lease or their rent history, send it to them before you delete, because afterwards nobody can.

If you subscribe to Landlord Mode, the subscription record described above — the plan, the period end, and Apple's identifiers for it — is deleted with your account. Deleting your account does not cancel the subscription: Apple keeps billing it until you cancel it in your Apple Account settings.

If something was reported

A report outlives everything else here, and it is better to say so plainly. For a report about a message or a comment, the copy of what was said, the reason, any note, and the display name on each side of it stay in the report after the message or comment is deleted, and after either account is deleted. Deleting an account unlinks it from the report; it does not remove the report. This is deliberate: a report is evidence about someone else's conduct, and evidence the person it is about can erase by tapping Delete account is not evidence at all.

A report about a photo is different: it keeps only where the photo is stored, not a second copy of it. That path does not keep the photo itself alive: if whoever added it deletes their account, if the landlord deletes their account, if the tenancy is deleted, or if we remove the photo after a report, it is gone, and the report is left pointing at a photo that is no longer there.

Short of deleting an account, information stays for as long as the rental does. A landlord can end a tenancy and delete its documents from inside the app. If you would rather ask a person, write to support@rentnook.app.

Security

• Isolation is enforced by the database, not by the app's screens, so a bug in the app cannot hand one person another person's rental. Every table carries a policy, and a new one is not allowed to ship without tests proving it holds.
• Everything in transit is encrypted. The app talks to the server over HTTPS and nothing else.
• Files are in private buckets. No lease is reachable by a link; every read is authorized against the person asking for it.
• An optional Face ID or Touch ID lock. Turn it on in the app and Rentnook asks for whichever your iPhone has before showing your conversations, rent history or leases once it has been in the background for a few minutes. It is protection against someone picking up your unlocked phone. It is not a second password, and nothing about your face or your fingerprint is sent anywhere — iOS answers yes or no, and Rentnook never sees anything more than that.

Children

Rentnook is not intended for anyone under 18, and it is not directed at children. It is an app for the two sides of a tenancy agreement, which is a contract adults sign. If you believe a child has created an account, write to support@rentnook.app and we will remove it.

Changes to this policy

If this policy changes, the date at the top of this page changes with it. If a change matters — if it alters what is collected, who can see it, or what leaves your phone — we will say so in the app before it takes effect, rather than editing this page quietly and counting on you to check.

Contact