TRUST
Safety
Two strangers, one door, a few hours. Most of the risk in that sentence is handled before anyone arrives — and most of it is handled by withholding information rather than collecting more.
An address is released, not published
Search results and the map show a space fuzzed by about 150 metres. The exact address is released only once a booking is confirmed, to the person who booked it.
This is not a detail. A host letting a stranger into a flat should not have that flat pinpointed by anyone idly browsing, and a map that answers “which door” before anyone has committed to anything is a directory of empty properties.
Photographs are stripped before they are published
Every uploaded image is re-encoded to remove its EXIF metadata, so a host cannot accidentally publish the coordinates of their own home in a photograph of their living room. That happens automatically, on upload, without the host having to know what EXIF is.
What software cannot judge is content — a neighbour in frame, a door number, a company sign on a building a listing describes as unmarked. Those go to a moderation queue and a person looks at them.
Discretion is not anonymity
The platform always knows who booked. That is the whole basis on which the other party never needs to. Every guest is identity-checked before they can book, and a real name sits behind every stay even when nobody in the building ever learns it.
If you are looking for a service where nobody knows who you are, including us, this is not it — and we would rather say so here than have you find out during an investigation.
Personal data is encrypted where it would hurt
Host addresses, guest phone numbers and two-factor secrets are encrypted at rest with a key held outside the database. Someone who obtained a copy of the database would not have them.
Every privileged action is written down permanently
Suspending an account, approving a listing, moderating a photograph, using a recovery code — each writes to an audit trail that is append-only at the database level. Not by policy: the database physically rewrites attempts to edit or delete those rows into no-ops. An audit trail that can be tidied is not one.
Staff cannot browse customer records either. There is no “list everyone” screen — the admin console requires a search, because browsing personal data is precisely what an audit trail exists to catch.
Reporting something
Every booking and every message thread has a report action. Reports go to Trust & Safety, and a status change on any account requires a written reason that is recorded against the person who made it.
Accounts can be restricted as well as suspended. Restricted keeps existing bookings usable while stopping new ones — because using the harsher tool for a case that needed the softer one strands a guest at a door at 9pm.
Two things we will not do
We will not sell or share your booking history with advertisers. And we will not let a host see who booked before they have accepted — a filter applied to a name is discrimination with an audit trail.