HostMaster Privacy Policy

Effective date: 2 June 2026

Last updated: 2 June 2026

This Privacy Policy explains how Ethan Brown ("we", "us", "our", "HostMaster") collects, uses, shares, and protects your personal information when you use the HostMaster mobile application on iOS or Android (the "App") and the related website (the "Site"), together the "Service".

By creating a HostMaster account or otherwise using the Service, you agree to this Privacy Policy. If you do not agree, do not use the Service.

1. Who we are

The Service is operated by Ethan Brown, based in Auckland, New Zealand. We are the data controller of the personal information processed under this Policy.

If you have any privacy questions, contact us:

• Email: ethanbrown7619@gmail.com
• Country of operation: New Zealand
• App identifier: com.ethanbrown.hostmasterapp

2. Information we collect

We only collect what we need to run the Service. We do not buy or sell your data, and we do not use it for advertising.

2.1 Information you provide directly

• Account information — email address, password (stored as a salted hash by Firebase Authentication, never visible to us in plaintext), display name, optional profile photo, and an account role (host, cleaner, or co-host).
• Property information — names, addresses, default check-in / check-out times, color labels, and iCal feed URLs for Airbnb, Booking.com or other supported booking platforms.
• Reservation and booking information — guest first names, stay dates, and source platform, imported from the iCal URLs you provide.
• Cleaning records — scheduled date, assigned cleaner, payment status, optional notes, photos of completed work, and chat messages between hosts and cleaners.
• Team information — references to other HostMaster users you invite as cleaners or co-hosts, and the 6-character invite codes used.
• Preferences and settings — auto-sync time, notification preferences, archive retention window, occupancy display toggle, and similar app settings.
• Customer support communications — anything you write to us when you ask for help.

2.2 Information collected automatically

• Push-notification token — a Firebase Cloud Messaging (FCM) device token used to deliver notifications. It is removed from your account record when you sign out.
• Diagnostic and crash information — anonymous logs (no chat content, no guest data) used to debug errors and improve stability.
• Approximate location — only when you opt in to the "Find work near me" feature for cleaners or "Find a cleaner near me" feature for hosts. Used live in your session to filter results; not stored on our servers.
• Device and technical information — device model, OS version, app version, and IP address.

2.3 Information from third parties

• iCal feeds (Airbnb, Booking.com, etc.) — when you save an iCal URL in HostMaster, our backend fetches that calendar on your behalf. We do not access your Airbnb or Booking.com account or credentials — only what the public iCal URL exposes.

3. How we use your information

1. Operate the Service — display your calendar, manage cleanings, send team invites, calculate occupancy, run other features you use.
2. Send transactional notifications — push notifications about reservations, cancellations, cleaning jobs, team invites, and daily summaries. Each category is toggleable in Settings.
3. Provide customer support — respond to your requests and troubleshoot issues.
4. Improve the Service — analyze anonymous, aggregated usage and crash data.
5. Comply with legal obligations — respond to lawful requests, enforce our terms, protect our rights.

We do not sell or rent your data, use it for behavioral advertising, or share guest information beyond what is necessary to operate the Service.

Legal bases (EU / UK users) — contractual necessity, legitimate interests, consent (for opt-in features), and legal obligation, depending on the processing activity.

4. How we share your information

• Other HostMaster users you authorize — cleaners see only the cleanings and chats assigned to them. Co-hosts see the same calendar and cleanings as the property owner for the properties they're invited to.
• Google Firebase / Google Cloud Platform — our hosting, authentication, database, push, and storage backend. Google acts as a data processor under our instructions. policies.google.com/privacy.
• Apple App Store and Google Play — for app distribution and (once enabled) in-app purchases. apple.com/legal/privacy and policies.google.com/privacy.
• Law enforcement and authorities — only when legally required, and only the minimum information necessary.
• Business successors — if HostMaster is acquired or merges, your information may transfer under the same privacy protections.

We do not share with advertisers, data brokers, or marketing-profile companies.

5. Third-party services

6. Data retention

7. Your rights

Wherever you are, you have:

• Access — request a copy of your information.
• Rectification — ask us to correct inaccurate information (most fields are also editable in the App).
• Erasure — request deletion of your account and data; or use Settings → Account → Delete account.
• Restriction — ask us to pause processing for specific purposes.
• Portability — request a machine-readable export.
• Withdraw consent — disable iCal sync, location, or notification categories in Settings; or uninstall.
• Object — object to specific uses of your information based on legitimate interests.
• Complain — lodge a complaint with your data-protection authority:
  • New Zealand — Office of the Privacy Commissioner (privacy.org.nz)
  • EU — your national supervisory authority
  • UK — Information Commissioner's Office (ico.org.uk)

Email ethanbrown7619@gmail.com to exercise any of these. We respond within 30 days. No fee.

8. California users (CCPA / CPRA)

California residents also have the right to:

• Know what personal information we collect, use, disclose, and (if applicable) sell.
• Delete personal information.
• Correct inaccurate information.
• Limit the use of sensitive personal information.
• Not be discriminated against for exercising privacy rights.

We do not sell or share personal information in the sense defined by the CCPA. We do not knowingly collect personal information from minors under 16. To exercise California rights, email ethanbrown7619@gmail.com with subject "California Privacy Request".

9. Children's privacy

HostMaster is intended for adults running short-term rental businesses. It is not directed at children under 13 (or 16 in the EU/UK), and we do not knowingly collect personal information from children. If you believe a child has provided us with information, contact us and we will delete it.

10. Security

• All traffic between the App and our backend is encrypted using HTTPS / TLS.
• Data at rest in Firestore, Cloud Storage, and Firebase Authentication is encrypted by Google Cloud.
• Access is enforced by Firestore security rules — each user can only read and write records that belong to them (or to properties they have been invited to).
• Passwords are stored only as salted hashes by Firebase Authentication.
• We use access controls and audit logging on the Google Cloud project.

No method is 100% secure. We will notify affected users without undue delay if a breach affects their personal information, in line with applicable law.

11. International data transfers

The Service is operated from New Zealand. Your data is stored on Google Cloud servers, currently in the us-central1 region (United States). By using the Service you consent to your data being transferred to and processed in the United States and other countries where Google Cloud operates.

For EEA/UK users, transfers outside the EEA or UK are protected by Standard Contractual Clauses with Google.

12. Push notifications

We send push notifications for:

• New reservations and cancellations
• New cleaning jobs and job updates
• Team activity (invites, accepts)
• A daily summary at a time you choose
• Auto-sync anomaly alerts

Disable any category in Settings → Notifications, or disable HostMaster notifications globally in your device's system settings. We never send marketing notifications.

13. Cookies and similar technologies

The HostMaster App does not use cookies. The website uses only essential cookies set by Firebase Hosting to keep the site working. No analytics, advertising, or third-party trackers on the website.

14. Account deletion

1. Open the App
2. Go to Settings → Account → Delete account
3. Confirm the deletion

Within 30 days we permanently delete your profile, properties, reservations, cleanings, chat history, and uploaded photos. We may retain anonymized, aggregated information that no longer identifies you.

If you cannot access the App, email ethanbrown7619@gmail.com from your account address and we will process the deletion manually.

15. In-app purchases and subscriptions

When subscriptions are enabled, purchases are processed by Apple App Store or Google Play. We never see or store your full payment information. Apple and Google share with us only a subscription status, the product identifier, and an anonymous transaction identifier. Refund requests must be made directly through Apple or Google.

16. Changes to this policy

When we make material changes we will:

• Update the "Last updated" date at the top.
• Post an in-App notice before the change takes effect.
• Ask EU/UK users to acknowledge material changes.

Continued use after a change means you accept the updated Policy.

17. Contact

• Email: ethanbrown7619@gmail.com
• Subject line: "HostMaster Privacy"
• Country: New Zealand

We respond within 30 days and usually much sooner.