Your privacy belongs in the plan.
Privacy Policy · Draft, November 13, 2026. This describes the current local prototype and identifies the providers that must be disclosed when enabled.
Local pilot draft · Version 2026-11-13-draft-1. Legal and operational review is required before public transactions.
1. What the local app collects
Account name, email or US phone number, a salted password hash for email accounts, contact-verification status, profile text and preferences, listings and availability, saved Pals, booking details, messages, reviews, reports, category suggestions, signed-agreement evidence, privacy requests, and authentication sessions. The app does not collect payment cards, bank details, government ID images, precise GPS location, or biometric templates. Please do not submit sensitive identity or medical documents in messages.
2. How information is used
To authenticate members, show profiles, match activity interests, coordinate bookings, enforce availability, preserve agreement evidence, enable reviews and reporting, and respond to privacy requests. Only your first profile name, listing text, broad city, approved activities, availability, languages, price, cover image, and published reviews appear publicly. Booking participants can see names, plans, signatures, and messages for their shared booking. Email and phone details are not published in listings.
3. Cookies and third-party requests
Essential HTTP-only cookies maintain your login and protect forms from cross-site requests. Session tokens are hashed in the database; sessions expire after seven days. No advertising cookies, behavioral analytics, third-party fonts, or cross-site tracking are built into this preview. If you open a map, OpenStreetMap tile servers receive network information such as your IP address and requested map area under their privacy policy. No map request occurs until you open the map. The app does not change its behavior in response to browser Do Not Track signals because it does not perform cross-site behavioral tracking.
4. Providers and sharing
Local records are stored in MySQL on this Mac. If explicitly configured for live use, Resend receives email destination and verification content, and Twilio Verify receives phone and verification requests. Stripe Connect, hosted Checkout, and Stripe Identity adapters are prepared for sandbox testing only. Stripe receives payment or identity information directly when those hosted flows are enabled; BorrowAPal stores provider references and status, not raw documents or card details. Live transactions remain locked. Provider purposes, retention, and final disclosures must be approved before launch. Do not store raw ID documents or bank/card information in this application. Information may be disclosed when legally required or necessary to investigate fraud or safety concerns, with appropriate safeguards. No sale or sharing of personal information for advertising is built into the prototype.
5. Retention and security
Passwords use salted scrypt; session tokens are stored as hashes. Forms use CSRF checks, cookie protections, input validation, access controls, and login rate limits. No security system is perfect. Verification codes expire after ten minutes; expired challenge and session rows should be purged by the provided cleanup task. Other local records remain until deletion is reviewed or the development database is removed. Before launch, publish specific retention periods for accounts, financial records, messages, incidents, agreements, and backups; configure access restrictions, encryption, backups, and incident response.
6. Your choices
Use Account & safety to download your information or request account deletion. A request is recorded for review and does not instantly erase legally necessary records or unresolved bookings. You may correct your listing in the Pal workspace; contact support for other corrections. Before public launch, establish a verified process for access, correction, deletion, portability, appeal, and applicable opt-out rights, and meet legal response deadlines. Rights depend on residence and applicable law; this draft does not imply every CCPA provision applies to the operator.
7. Children and geographic scope
The service is for people 18 and older and is not intended for children. Do not create an account for a minor. Report suspected underage accounts for review. The pilot is limited to New York City, the Hamptons, and San Francisco in the United States; international access and data-transfer arrangements are not part of this launch.
8. Updates and contact
This policy must identify the actual legal operator, postal address, privacy contact, and effective production date before public use. Material privacy changes require notice. In this preview, Help & reporting and Account & safety write local records only; there is no live support inbox or response commitment.