Last updated: March 24, 2026
We collect information you provide directly: account credentials (email, password), property details (address, rent amount, lease terms), tenant information (name, email, phone), and financial data you enter. We also collect usage data (pages visited, features used) and technical data (browser type, IP address, device) through standard web analytics.
We use your information to: provide and improve the Service; send transactional emails (rent reminders, invites, notifications) when configured; generate documents (leases, financial reports); calculate analytics (cash flow, equity, market comparisons); and respond to support requests. We do not sell your personal information to third parties.
Landlords may enter tenant personal information (name, email, phone) into the Service. Landlords are responsible for ensuring they have the legal right to share and process their tenants' data and for obtaining any required consents. Tenants who create accounts control their own account data and can request deletion at any time.
Your data is stored on Supabase (PostgreSQL database with row-level security) hosted on AWS infrastructure. We implement industry-standard security measures including encryption in transit (TLS) and at rest. Access to your data is restricted by authenticated row-level security policies. However, no system is 100% secure — use a strong, unique password.
We use the following third-party services that may process your data: Supabase (database hosting, authentication), Vercel (hosting and edge functions), Stripe (subscription billing and rent payment processing — receives email, payment method, and transaction amount), Resend (transactional email delivery), Firebase/Google Cloud (push notification delivery — receives device tokens), Sentry (error monitoring — receives anonymized error data), GoatCounter (privacy-friendly web analytics — no personal data collected), FRED Federal Reserve Bank of St. Louis (public mortgage rate data — no personal data sent), HUD (public rent data — only ZIP code sent). Each provider has its own privacy policy.
PropertyNinja does not process or store payment card information. For Stripe-powered rent collection, Stripe receives and processes tenant payment data (card/bank details, email, payment amount) according to Stripe's Privacy Policy. PropertyNinja receives only transaction confirmations (amount, date, status) — never card numbers or bank account details. Payment links (Venmo, Zelle, PayPal, CashApp URLs) stored in the Service are plain URLs — all payment processing occurs on those third-party platforms. We record payment confirmation records (month, amount, date) for record-keeping only.
We use essential cookies for authentication (Supabase session management). We use GoatCounter for privacy-friendly web analytics, which does not use cookies or collect personal data. We use Sentry for error monitoring, which may collect technical data about errors encountered during use. We do not use advertising trackers. You can disable cookies in your browser settings, though this may affect Service functionality.
We retain your data as long as your account is active. When you delete your account, we delete your personal data within 30 days, except where retention is required by law. Property and lease records may be retained in anonymized form for product analytics.
Depending on your location, you may have rights to: access the data we hold about you; correct inaccurate data; delete your account and data; export your data in a portable format; opt out of certain data processing. To exercise these rights, contact us through the app or via the email on your account. We will respond within 30 days.
California residents have additional rights under the CCPA, including the right to know what personal information we collect, the right to delete personal information, and the right to non-discrimination for exercising privacy rights. We do not sell personal information as defined by the CCPA.
If you opt in to push notifications, we store a device token provided by your device's push notification service (Firebase Cloud Messaging). This token is associated with your account and used solely to deliver notifications you have configured (rent reminders, maintenance updates). You can revoke push notification consent at any time through your device settings. Device tokens are deleted when you unsubscribe or delete your account.
The Service is not directed to individuals under 18. We do not knowingly collect personal information from children. If you believe we have inadvertently collected such information, contact us immediately.
We may update this Privacy Policy periodically. For material changes, we will notify users via email or in-app notice at least 14 days before changes take effect. Continued use of the Service constitutes acceptance of the updated policy.
For privacy questions, requests, or complaints, email us at help.propertyninja@gmail.com.