Privacy Policy
Last updated: March 2026TenantTales is built on the principle that your identity stays private. Your reviews are always published anonymously — your name and email are never visible to anyone.
What we collect
- Email address (for authentication only)
- Reviews and ratings you submit
- Photos you attach to reviews (optional)
- Device push token (for review alerts, if enabled)
- Tenancy documents (uploaded for verification only — deleted within 72 hours)
We do not collect your name, phone number, or physical address.
How we use your data
Your email is used solely for login and account communications. Your reviews are published anonymously — no personally identifying information is ever attached to a published review. Device tokens are used only to send push notifications you have explicitly enabled.
Aggregate & anonymised data
We may use anonymised, aggregated data derived from reviews — such as average scores by suburb, rent benchmarks by area, or property condition trends — for internal analytics, research, and commercial purposes including sharing with or licensing to third parties.
This data cannot be used to identify any individual user or link any information back to a specific person. No raw review content, personal information, or account data is ever shared or sold. Only statistical summaries that are fully de-identified are used for these purposes.
Verification documents
Tenancy documents you upload are stored in an encrypted, access-controlled bucket and are permanently deleted within 72 hours of upload — regardless of verification outcome. No staff member can access document contents without a logged audit trail.
Data storage & security
All data is stored on servers in Sydney, Australia (AWS ap-southeast-2). Data is encrypted at rest (AES-256) and in transit (TLS 1.3). Row-level security ensures you can only access your own data.
Your rights
Under the Australian Privacy Act 1988 you have the right to:
- Access the personal data we hold about you
- Correct inaccurate information
- Request deletion of your account and all associated data
- Withdraw consent at any time
To exercise these rights, use "Delete Account" in the app or email privacy@tenanttales.com.
Third-party service providers
We use Supabase (database infrastructure, Sydney), Apple (authentication), Google Places API (address lookup), and Apple StoreKit (payments). These providers process data only as necessary to deliver their services and are bound by their own privacy policies. None have access to the content of your reviews.