Privacy Policy

Stublet is a subletting platform operated in Israel. We are the controller of the database that stores your information and are responsible for how it is processed.

This policy applies to the Stublet mobile app (iOS and Android) and the website at stublet.app. It explains what we collect, why, with whom we share it, and what rights you have under Israel's Privacy Protection Law, 5741-1981 (including Amendment 13, effective 14 August 2025).

Privacy contact: [email protected].

Information you give us directly:

• Account details: name, phone number, and/or email (depending on the sign-in method you chose)
• Profile: optional profile photo and short bio
• Listings: title, description, photos, property type, city, neighborhood, optional street address you provide, availability dates, price and deposit amount (display only — Stublet does not process payments)
• Chat messages and attachments
• Booking requests and reports you file

Information collected automatically while you use the app:

• Device identifier and push token (FCM) so we can deliver notifications
• Platform, app version, OS version, system language, last-login timestamp
• Aggregate analytics events (e.g. "listing viewed", "search performed") — no phone numbers, emails, names, or text you typed. These events are sent to Firebase Analytics and to PostHog (hosted in the EU), and are identified only by an internal account id, with no IP address
• Masked screen recordings (Session Replay) of your interactions inside the app, used to find bugs and improve the experience. All input fields (names, phone numbers, addresses, prices) and all images are automatically masked and are not visible in the recording, and the recording is keyed only to an internal id. Recording runs on a sample of users and can be turned off remotely
• Crash and error reports, after redacting sensitive fields (passwords, OTPs, tokens, phone numbers and emails never enter the logs)

Client-side storage:

• In the app: AsyncStorage for auth tokens and preferences
• On stublet.app: a single localStorage key called "stublet-theme" that remembers dark/light mode. No advertising cookies, no advertising pixels. Google Analytics loads only on the download page (stublet.app/download) to measure campaigns — the rest of the site loads with no analytics

What we do NOT collect: date of birth, government ID numbers, payment details, or financial information. The sublet itself is arranged directly between the parties, off-platform.

Providing this information is not legally required. Without it we cannot provide the service (e.g. without a phone number you cannot register and publish a listing).

Your information is used only for:

• Operating the service: sign-in, showing relevant listings, messaging, and booking requests
• Showing social context and degrees of separation so you can decide who to engage with
• Ranking the discovery feed by social trust and your preferences (recent searches, saved listings, dismissed listings)
• Understanding product usage, improving the experience, and diagnosing issues — via aggregate analytics and masked, pseudonymous screen recordings
• Identity verification through Firebase Authentication (phone, email, Google, Apple, Facebook)
• Safety and fraud prevention: detecting abuse, suspending abusive accounts, reviewing reports
• Push notifications for new messages, followers, and listing updates
• Responding to support requests

We do NOT use your information for third-party advertising. We do NOT sell your information.

With other users: per each listing's privacy setting (public / followers / friends-of-friends / three degrees) — your name, profile photo, the listing details, and the address if you entered one. Your chat messages are visible only to the other person in the conversation.

With our team when a report is filed: when a user reports a listing, profile, or message, our safety team may review the relevant content to handle the report. We do not routinely monitor messages.

With service providers (subprocessors): we use leading third-party providers that process data on our behalf, under a data processing agreement, for the services we ask of them:

• Google Firebase — Authentication (Auth), product analytics (Analytics), crash reports (Crashlytics), and push notifications (FCM)
• Sentry — backend and mobile error monitoring
• PostHog — product analytics and conversion funnels, user paths, and masked screen recordings (Session Replay). Data is stored on PostHog's EU servers
• Cloudflare R2 — photo storage (profile and listings)
• MongoDB Atlas — primary database
• Neo4j — social-graph database (FOLLOWS, FRIENDS_WITH, BLOCKS edges)
• Apple, Google, Meta — the OAuth identity provider you chose
• Google Maps API and MapLibre — address search and map rendering
• Railway — backend hosting

Some of these providers operate globally, so your data may be processed or stored in the US, in Europe, or in other regions. We rely on approved transfer mechanisms: EU Standard Contractual Clauses (SCCs) or a provider-specific DPA.

For a detailed breakdown of the processing chain for specific data, contact us at [email protected].

With authorities: only as required by law or by an order from a competent authority.

We do not sell your data. Ever.

Under Israel's Privacy Protection Law, 5741-1981 (including Amendment 13, 2025), you have:

• Right of access: receive a description of the information we hold about you
• Right to rectification: update inaccurate or out-of-date information
• Right to deletion: request deletion of your account and the personal data tied to it (full details on the "Account & Data Deletion" page)
• Right to restrict processing: ask us to stop processing your data for specific purposes

How to exercise: email [email protected] with the details of your request. We respond within 30 days, as required by law. We respond in Hebrew, English, or Arabic, per your choice.

Managing push notifications: under Settings > Notifications in the app you can independently toggle: new messages, new followers, listing updates, and marketing (off by default).

If you are not satisfied with how we handled your request, you can contact the Privacy Protection Authority at the Israel Ministry of Justice, 22 Kanfei Nesharim St., Jerusalem.

As long as your account is active we keep your data so you can keep using the service.

After account deletion (full details on the "Account & Data Deletion" page):

• Identifying fields (name, phone, email, profile photo) are nulled immediately
• Your listings move to inactive and the host snapshot on each one is nulled
• Your social-graph relationships, your photos in storage, and your push tokens are deleted
• Active sessions are terminated

What may remain: booking requests you sent or received (without your identifying information), reports filed against you (for safety reasons), aggregate analytics events that don't identify you personally, and data subject to an active legal hold.

Our service providers (Sentry, Firebase, PostHog, Cloudflare) retain their own data per their own policies — typically 45–90 days. PostHog Session Replay recordings are retained for up to 30 days and then automatically deleted.

We apply standard technical and organizational safeguards:

• HTTPS / TLS for all traffic between the app and the servers
• Encryption at rest at every storage provider (MongoDB, Neo4j, Cloudflare R2)
• Access keys scoped to backend servers — no key reaches a client device
• Redaction of sensitive fields (passwords, OTPs, tokens, phone numbers, emails) before they enter the server logs
• Automatic session revocation on account deletion

That said, no system is 100% secure. Keep your sign-in details safe and contact us immediately if you suspect your account has been compromised.

Stublet is for users 18 and over. Subletting requires legal capacity to enter contracts.

We do not collect date of birth. At sign-up you confirm you are 18 or older (Section 1 of the Terms of Service). If we identify a user under 18, we delete the account immediately.

Parents who discover that a child opened an account by mistake: email [email protected] and we will expedite deletion. For the full child-safety policy, including zero tolerance for CSAE, see the "Safety & Moderation" page.

For any privacy question, request, or complaint:

Email: [email protected]

Policy updates: we may update this policy from time to time. A material update (new data categories, a new service provider, expanded uses) is surfaced in the app before you continue using it. A cosmetic update is reflected by the "last updated" date at the top of the page. Change history is on GitHub.

Israeli regulator: Privacy Protection Authority, Ministry of Justice, 22 Kanfei Nesharim St., Jerusalem.