Privacy Policy

Two people, one record

Rooftree keeps a shared record of a tenancy: rent paid, repairs raised, certificate dates and messages between a landlord and a tenant. Both sides can hold an account, and when they both do they see exactly the same entries.

A landlord can also start a tenancy and record against it before any tenant has joined, or when no tenant ever joins. In that case Rooftree holds the property address, the rent, the deposit, the payment history, repair photographs and free-text notes about a person who has no account, has not been told, and cannot see any of it. That is the situation this policy has to be honest about.

What we collect

Your account: name, email address, a hashed password, and whether you described yourself as a landlord or a tenant. That description is a copy switch for wording, not a permission.

The tenancy: the property address, the monthly rent, the rent due day and the deposit amount.

Ledger entries: rent payments with amount, date, method and note; repairs with a title, details and urgency; messages of up to four thousand characters; certificate and compliance dates such as a gas safety check, an electrical report or an energy rating, with the provider, reference and dates; and the deposit scheme and its reference.

Photographs attached to a repair, taken with the camera or picked from the gallery.

Confirmations and disputes, which record that one party agreed with an entry or disagreed with it and by how much.

The free-text fields are not restricted by us. Whatever either party types into a note, a message or a repair description is stored as written.

The record is append-only, and that is permanent

Rooftree is built so an edit never rewrites history. A correction is a new entry, not a replacement, and a dispute becomes a permanent row rather than a deletion.

This is enforced by the database, not by convention: the ledger tables reject any attempt to change or remove a row, including from us. That is the point of the product, and it is also the honest limit on what we can do if you ask us to delete something. We can add to the record. We cannot take an entry out of it.

Where it is held

On our server, over HTTPS, at deplyra.com/rooftree-api. The server is in the European Union.

The app currently tells you in one place that data is stored in the UK. That is wrong, and the European Union is the accurate answer. We are correcting the app.

Nothing is encrypted at rest. Passwords and verification codes are stored as hashes; everything else, including messages and repair photographs, is stored as ordinary data on ordinary disk.

Repair photographs are stored as files named after their content. They are served only through a route that requires your sign-in and checks you belong to that tenancy, so the file addresses are neither public nor guessable. We do not strip location or other metadata from a photograph before storing it.

What Rooftree never does

It processes no money. There is no payment provider, no card details, no bank account number and no sort code anywhere in it. A payment marked as a bank transfer is a label you chose, not a transaction we saw.

It sends nothing to anyone. There is no push notification, no email and no text message. Rooftree never contacts the other party on your behalf, so nothing about your tenancy is disclosed by us to anybody. When you share an invite or an exported PDF, you send it yourself with your own phone.

Notification preferences exist in settings, and nothing currently acts on them.

Ads

Rooftree carries Google AdMob. In the current build no banner loads, because the banner slots have no unit assigned, but the ad code starts up on nearly every screen and one full-screen ad can appear when you leave the export screen. Requests are marked non-personalised, and AdMob still receives your device's advertising identifier, its IP address and app information.

Google's consent form runs first. If it fails or times out, the app proceeds with a non-personalised ad rather than holding it back.

Invite links

An invite code lets the other party join. Anyone holding a valid code can read the property address, the rent, the due day, the deposit amount and the name of whoever created the tenancy, without signing in. The code is short. Share it directly with the person it is for, and nobody else.

Deleting your account, stated exactly

Settings has a Delete account control. It blanks your name, email address and credentials on your account row and signs you out everywhere.

It does not delete the tenancy record, and it cannot. Every entry, confirmation, repair, photograph and certificate date stays exactly where it is and stays readable by the other party, attributed to a departed account. Closing a tenancy stops new entries and deletes nothing.

There is no retention period. Nothing is removed on a timer, because nothing can be removed at all.

If you need something considered that this page does not cover, email [email protected] and a person will read it. We would rather tell you what is not possible than promise an erasure the database will refuse.

If you are a tenant who never joined

A landlord may be keeping a record about your home and your rent inside Rooftree. If they have not sent you an invite, you cannot see it, and Rooftree will not tell you it exists.

Ask the landlord for an invite, which gives you the identical view and the ability to dispute any entry. You can also email [email protected] and we will tell you what is held.

Children

Rooftree is for adults in a tenancy. It is not directed at children and it has no age check.