Privacy Policy

AsListed exists so guests can tell the truth without being identified. We collect as little as we can, and we design features so that even we can’t easily connect a review to a real person or a booking.

• Sign-in fingerprint, not your email. When you request a sign-in link, we use your email address once to send it. We store only a keyed hash (HMAC-SHA256) of the address, which lets us recognize you next time but can’t be reversed into your email.
• Your ghost name. A random display name like QuietNomad17 is created for your account and shown on everything you post.
• What you post. Reviews, ratings, photos, receipts, replies, and the optional details you add, such as the month you stayed, cleaning fees, or WiFi speeds.
• Proof of stay, temporarily. If you upload a booking confirmation, it’s stored privately, seen only by moderators, and deleted once it’s been checked.
• Abuse-prevention data. To rate-limit sign-in links and suggestions, we store a keyed hash of your IP address for a short time, not the address itself.
• Suggestions. Whatever you type in the suggestion box, including contact details if you choose to add them.

• We don’t store your email address, name, phone number, or booking reference.
• We don’t show exact stay dates, only the month, so a review can’t be matched to a reservation.
• Photos are resized and re-encoded in your browser before upload, which strips GPS location and camera metadata.
• We don’t run advertising trackers or sell personal data.

• to sign you in and keep you signed in (a secure, httpOnly session cookie);
• to display your content and calculate ratings, the Wall of Shame, and Verified Stays;
• to moderate content and prevent spam and abuse; and
• to respond to legal notices and comply with the law.

Everything you post is public, under your ghost name. Beyond that, we share information only with service providers that run AsListed on our behalf (hosting, database, file storage, and email delivery for sign-in links), and when required by law, such as a valid court order. Because we don’t store emails or exact dates, there is very little that could identify you even then.

We never share information with hosts, and we don’t give hosts a way to contact reviewers.

From Settings & privacy you can change your ghost name, sign out, or delete your account. When you delete your account, you choose whether your reviews are permanently removed or stay up credited to “Former guest”. Either way, your sign-in fingerprint and any proof files are erased.

Depending on where you live, you may have rights to access, correct, or delete personal information. Email legal@aslisted.co and we’ll help. Because we don’t store your email, we may ask you to sign in to confirm a request relates to your account.

We use one essential cookie to keep you signed in. We don’t use advertising or cross-site tracking cookies.

Sign-in links expire after 15 minutes and work once. Content stays up until you or a moderator removes it. We use encryption in transit, keyed hashing for identifiers, and private storage for proof files. No system is perfectly secure, but we limit what we keep so there’s less to protect.

AsListed isn’t for anyone under 18, and we don’t knowingly collect information from children.

We’ll update the date above when this policy changes. Questions or requests: legal@aslisted.co.