Security & privacy
We keep very little, and we list it
The rules and tax data we publish is public and ships with the app. The only records here are yours. Here is exactly what we hold, how it is scoped, and what we do not yet offer.
Principles
How LodgeDeck treats your data
Every user record is owner-scoped
Postgres Row Level Security scopes each row to the account that owns it (owner_id = auth.uid()) across profiles, API keys, the request log, saved properties, calendars and watches. There is no world-readable user data, so another account's rows are not reachable through the app, the API, or a shared key.
There is nothing to store, because there is nothing to submit
The rules and tax dataset ships inside the application and is identical for everyone, so a lookup creates no record about you. What we hold is an account, a plan, your saved properties and notes, and the calendar URLs you choose to attach. The calculators run in your browser and send us nothing.
API keys are hashed, shown once, revocable
We store a sha-256 hash of a key plus a short prefix so you can tell one from another. The key value itself is never written down. It is displayed once, at creation, and you can revoke it instantly from your account if it is ever exposed.
An inspectable request log, over HTTPS
Every keyed API and MCP call records its endpoint, method, status, timing and request id, so you can answer what your own integration or agent did, and when. All traffic runs over HTTPS. Payments are handled by Stripe; we never see or store card details.
Treat a calendar URL as a credential
We read the public calendar export URLs you paste and cache the bookings they list. We never write back to Airbnb, Vrbo or Booking.com. Because anyone holding such a URL can read that calendar, treat it as a credential, and remove it from the property whenever you want.
No model provider in the request path
Nothing you enter is sent to a model or AI provider, and nothing is used to train models. Lookups are served from the shipped dataset and the calculations run deterministically in code. Our MCP server lets an agent you control read the same public data; it does not send your account data anywhere.
Not legal or tax advice
LodgeDeck reports publicly available short-term rental rules and lodging tax rates and cites the source of each field. It is not legal or tax advice and it does not replace your own review. Ordinances and tax rates change often and automated collection can lag, so every field shows the source it came from and a confidence flag, and unconfirmed values are marked Unverified. Confirm with the jurisdiction before you rely on a rule or rate.
What we don't yet offer
- No SOC 2 report, or any other third-party security certification.
- No third-party penetration test yet.
- No bug bounty programme. Report anything you find to us by email and we will act on it.
- No team seats and no SSO. An account is one person today.
We'd rather say this plainly than let silence imply a compliance status we haven't earned.
FAQ
Security questions
What do you actually store about me?
An account (name and email), your plan and the Stripe customer and subscription ids for it, your API keys as a hash plus a short prefix, a log of your API and MCP requests, your saved properties (label, city, jurisdiction, use type, notes), any calendar export URLs you attach along with a cached reading of their bookings, and a snapshot of the cited public values for any change watch you create. That is the whole list.
Do you hold any files of mine?
No. There is no file storage on this service and nothing to send us beyond the fields you type in. Supabase Storage is switched off in our configuration.
Can other accounts see my properties or my calendars?
No. Row Level Security scopes every property, calendar, watch, API key and log row to the account that owns it, and there is no world-readable user data.
Is my data sent to an AI model?
No. No model or AI provider sits in the request path, and nothing you enter is used to train a model. Our MCP server lets an AI agent you control read the same public rules and tax dataset that the website serves.
How safe is the calendar URL I paste in?
It is a capability URL: anyone who has it can read that calendar's bookings, so treat it as a credential. We use it to read your bookings and never to write anything back to the channel. You can remove it at any time, which deletes the URL and the cached bookings with it.
Do you offer a SOC 2 report or a penetration test?
Neither, and no bug bounty either. We say so plainly rather than implying a compliance status we have not earned. If one of those is a hard requirement for you, contact us before you build on the service.
Read the full privacy policy
Details on what we collect, why, and how to delete it.