Privacy policy

Version 1.2 · Effective 2026-10-22 · Last updated 2026-10-22 · Contact: pwlhstaffing@gmail.com

1. What this policy covers

RentorBuy is a rent-versus-buy analysis app for iPhone, iPad, and Mac, published by an individual developer. This policy explains what information the app handles, what leaves your device, who receives it and why, how long it is kept, and how to stop it.

It covers the app, its widget and share extension, and the developer's own server at rentorbuy-api.slowturtle.app (the "RentorBuy server"). Apple, public agencies, and the other companies named below have their own policies.

The current version is published at https://rentorbuy.slowturtle.app/privacy. The copy inside the app is identical.

2. Summary

• No accounts, no sign-in. The developer never asks for your name or email, and the RentorBuy server holds neither them nor the homes you enter.
• No advertising, tracking, or analytics. The app contains no advertising, attribution, crash-reporting, or usage-measurement software and no third-party code. The only usage record is the AI allowance ledger in section 4.3.
• AI listing import is optional. It runs only when you select "Read with AI", after a one-time consent screen that names every recipient. The listing passes through the RentorBuy server, which keeps none of it, to one of the AI companies in section 4.2, which may keep what it receives under its own terms.
• Live market data is off until you turn it on. With it on, some public records are fetched directly from your device, and rents (and, where offered, a mortgage rate) come through the RentorBuy server.
• Everything else stays on your device unless you turn on iCloud sync, share a workspace, export a file, send an email, or share a link yourself.

Tax and jurisdiction reference data ships inside the app. The app downloads no updates to it.

3. What you enter and where it is stored

You choose what to enter. The app can hold:

• Property identity and location — name, street address, unit, city and state, property type, building name, square footage.
• Listing material — listing URL, source name, notes you type, and up to ten photos or screenshots per import.
• Your own photos, floor plans, and documents — from the camera, the document scanner, the photo library, or Files (on a Mac, also a nearby iPhone's camera).
• Financial inputs — price, rent, deposits, financing terms, closing and carrying costs, recorded costs, and your assumptions.
• Household profile inputs — the income and debt figures you enter for the affordability view.
• Notes and memos.

The app uses the camera, and sends notifications, only after you allow each in the system prompt.

Where it is stored:

• in the app's local databases on the device;
• photos, floor plans, and documents as files in the app's own storage on that device, exactly as taken, so a library photo can still record where it was taken. They are not synced through iCloud or included in the backups the app exports; your device's own backup includes them, except the small preview copies;
• in a container shared with the widget and the share extension;
• in the system Spotlight index (property name, city and state, type, building, square footage, cost);
• in your own iCloud account, only if you turn on iCloud sync or share a workspace (section 4.4);
• in the system Keychain, for the install identifier and secret used with the RentorBuy server (section 4.3).

The app no longer accepts API keys and, on first launch of this version, deletes any an earlier test build stored in the Keychain.

4. What leaves your device

4.1 Live market data — off until you turn it on

Control: Settings → Data Sources → "Fetch live market data", off on a new install. Turning it off stops every request in this section.

With it on, when the app looks up a home's facts it can send:

Directly from your device to public agencies, each of which also sees your device's network (IP) address, as with any web request:

Through the RentorBuy server (section 4.3):

• Rents. The app sends the county code from the Census result and the year. The server asks the U.S. Department of Housing and Urban Development (HUD User) for that county's Small Area Fair Market Rents with its own credential and returns the answer; your device picks the ZIP row. HUD receives only the county and year, never your address, ZIP code, or network address. The server keeps each county's answer for 400 days and does not record which install asked. It asks HUD again once its copy is 30 days old; if HUD is unavailable then, it may serve the older copy.
• Mortgage rate. The app shows the weekly average 30-year rate from Freddie Mac's Primary Mortgage Market Survey®, exactly as published, labelled "Source: Freddie Mac Primary Mortgage Market Survey®" with the survey date and a text link to freddiemac.com. It fetches that rate from the RentorBuy server at most once a day, in a request that carries nothing about you or your homes. The server collects the published survey from Freddie Mac on its own weekly schedule; Freddie Mac receives nothing from your device. A live rate never replaces a rate you entered.

Before a lookup, the app may ask the server whether the feature is switched on. That request carries nothing about you or your homes.

4.2 AI listing import — only when you ask, after you agree

Controls: the one-time consent screen; the "Read with AI" button on each import; Settings → AI import → "Withdraw agreement" (section 4.3).

AI import never runs on its own. The first time you select "Read with AI", a consent screen names every company that will receive the listing and lists what is sent. Nothing is sent unless you select "Agree". If the recipients or the data sent change, the app asks again before the next import.

What is sent to the RentorBuy server when you select "Read with AI":

• the listing text you supplied or that was recognized from your screenshots (up to 20,000 characters);
• the listing URL and source name;
• the fields the app's own parser already read;
• up to six listing images, each reduced to at most 1,800 pixels and 1.25 MB.

Who receives it. The server adds its own fixed instructions and forwards the request to OpenRouter, which passes it to one AI company chosen by the developer from the list below. That company runs its own model on its own servers, so it is both the host and the model's maker. The consent screen names all of these companies and says that one of them receives your listing. The developer may switch among them without asking you again, and will ask again before sending a listing to any company not on this list.

OpenRouter also receives a code derived from your install identifier and the month. It changes every month and cannot be reversed to your install identifier.

What comes back. The model's answer returns through the server to your device, and you review every field before anything is saved.

What is kept. The RentorBuy server does not store or log the listing text, link, images, parser fields, instructions, or answer; it records only the metering facts in section 4.3. OpenRouter and the AI company may keep what they receive under their own terms and privacy policies, for example for abuse monitoring or legal compliance. The server asks OpenRouter to exclude providers that collect request data, but that is not a promise that nothing is kept. Read the named companies' policies before you agree.

On-device text recognition and the app's own parser work without AI import and contact none of these companies.

4.3 The RentorBuy server and the AI allowance ledger

The developer runs the RentorBuy server on Cloudflare, the developer's hosting provider. Cloudflare terminates the encrypted connection, so it sees your device's network (IP) address and the requests the app makes.

What the server does. It relays AI import (section 4.2), keeps a monthly AI allowance for each install so the developer can pay for the feature, serves rents and, where offered, the mortgage rate (section 4.1), and tells the app whether each feature is switched on.

Registering an install. The first time the app needs the server, it registers this install using Apple's App Attest (iPhone and iPad) or DeviceCheck (Mac, or where App Attest is unavailable) to prove the request comes from a genuine copy of the app, and sends a DeviceCheck token that the server verifies with Apple. Apple keeps two yes-or-no values per device, set by the server: whether a device registered this month, and whether it reached its allowance this month. They hold no identity. The server gives the install a random identifier and secret, kept in the Keychain on that device only.

What the server keeps:

The ledger never holds listing content, images, addresses, ZIP codes, counties, instructions, or answers, and no name, email, Apple Account, or network address. The developer cannot look up your records by name or email; they are reachable only through the install identifier your device holds.

Network addresses and logs. To limit abuse, Cloudflare's rate-limiting service counts registrations per network address over a short window; the server does not store that count. Cloudflare's per-request logs are off. The server writes only short event records (route, status and error codes, duration, model, token counts, cost), never a request body, header, network address, secret, ZIP code, or county. Cloudflare keeps those records for 7 days.

Your allowance. The app shows roughly how many imports remain this month, warns at about 80%, and at the limit shows the reset date (the first of each month, UTC). The developer may pause AI import for everyone, for example when the monthly budget is used, and may block an install that abuses the service. On-device text recognition keeps working in every case.

Withdraw agreement. Settings → AI import → "Withdraw agreement" stops all AI requests from that device, asks the server to delete that install's install, usage, and request records and to remove its identifier from the change history, and removes the identifier and secret from the Keychain. Apple's two DeviceCheck values remain, so if you agree again in the same month the new install starts at its limit and gets a full allowance from the next month.

An install that used only live rents, and never agreed to AI import, has no "Withdraw agreement"; its records are deleted automatically 13 months after it was last seen. If the developer changed its allowance or blocked it, its identifier stays in the change history, because only "Withdraw agreement" removes an identifier from those records.

4.4 iCloud sync and workspace sharing — your own iCloud account

If you turn on iCloud sync, your properties, assumptions, and analysis records sync through Apple CloudKit into the private database of your own iCloud account, which CloudKit's design keeps closed to the developer. Apple delivers silent notifications so your devices learn about changes.

If you invite someone to a shared workspace, they get read and write access to everything in it, including addresses and financial inputs, and Apple receives the email identity you use to send the invitation. You can revoke a share; an invitee can leave one.

Apple's terms and privacy policy govern iCloud, CloudKit, and invitations.

4.5 Files, emails, links, and photos you share

• Exports (backup, CSV, PDF, Markdown) go to the destination you choose and are then outside the app's control. Exported backups include properties, assumptions, the public-data registry, and your AI consent setting; they exclude the install identifier and secret and the photos, floor plans, and documents you added.
• Diagnostic report link. Your mail app opens a pre-filled message to the support address in section 12; nothing is sent until you send it. The report contains issue metadata, not the property address, unit, or your financial inputs.
• Workspace invitation links go to the system share sheet or pasteboard and are then outside the app's control.
• Photos and floor plans shared from the app are copies with the location removed. If the app cannot make such a copy, it does not offer the file.

5. What stays on your device

• Text recognition on listing images uses Apple's Vision framework on the device; the images are not sent anywhere for this step.
• All rent-versus-buy calculations run on the device.
• Reference data (tax rules, rates, locality assumptions) ships inside the app; no updates are downloaded.
• Notifications are created on the device. If you allow them, the app can tell you when a comparison you follow changes or, where a live rate is offered, when the rate changes enough to matter. A notification names the two homes compared and can appear on your lock screen under your system settings.
• Diagnostic logging goes to Apple's on-device unified log. Entries can include internal and iCloud record identifiers, error text, and file paths, with URL paths and query values redacted. They stay on the device under the system's own retention.

6. Who receives information

• Cloudflare, which hosts the RentorBuy server (section 4.3).
• OpenRouter and one of the AI companies listed in section 4.2, only for an AI import you start after agreeing.
• Public agencies, directly from your device, only with live market data on (section 4.1).
• HUD, which receives a county and year from the RentorBuy server (section 4.1).
• Apple, for iCloud, CloudKit sharing, App Attest, DeviceCheck, notifications, and other system services.
• The person you invite to a shared workspace (section 4.4).

Freddie Mac receives nothing from your device or about you. There are no other recipients. Your information is never sold, shared for anything of value, given to data brokers or advertisers, or used to build a profile of you. Neither the app nor the developer's website tracks you across other apps or sites or responds to browser "Do Not Track" signals, because there is no tracking for them to apply to.

7. How information is protected

• The install identifier and secret live in the system Keychain, available only after first unlock and only on that device, and are excluded from exported backups. The server stores only a keyed one-way hash of the secret.
• An install registered with App Attest signs each AI request with its App Attest key, and the server checks the signature. An install registered with DeviceCheck (on a Mac, or on an iPhone or iPad where App Attest is unavailable) authenticates each request with its secret alone.
• All requests use HTTPS. Locations and listing content travel only in the encrypted request body, never in the web address.
• Your entries are protected by the device's own passcode and encryption and, for iCloud, your Apple Account security.

No storage or transmission is perfectly secure, and this policy claims no certification or independent security assessment.

8. Retention and deletion

• Your records, notes, photos, floor plans, and documents stay until you delete them. Deleting a property writes a deletion marker so the deletion reaches your other devices and any shared copy.
• To support sync and recovery, the app also keeps revision history, audit records, deletion markers, and recovery files. No control erases that history separately from the records it describes, and no separate retention period is set for it, for caches, or for widget, Spotlight, or shared-workspace copies.
• Removing the app removes its local containers from that device. Records already in iCloud are removed through your Apple Account's iCloud storage management. The Keychain install identifier may survive removal.
• The RentorBuy server keeps ledger records for the periods in section 4.3 and deletes an install's records when you withdraw consent, or, for an install that used only live rents, 13 months after it was last seen. It keeps no listing content.
• Files, emails, and links you sent are outside the app's control. Information already received by OpenRouter, an AI company, Cloudflare, a public agency, or Apple is kept under that party's own policy; ask that party to delete it.

These bullets describe what the app does today, not a fixed schedule. If that changes, this policy changes with it (section 11).

9. Your controls

1. AI import — select "Not now" on the consent screen; use "Read with AI" only on the imports you choose; Settings → AI import → "Withdraw agreement" stops AI import and deletes the install's server records.
2. Live market data — turn off Settings → Data Sources → "Fetch live market data".
3. iCloud — turn sync off, revoke a share, or leave a workspace in the app's settings.
4. Camera and notifications — change in the system Settings app.

Local analysis, text recognition, and the parser keep working whatever you choose. To ask about information the app or the server holds, or to exercise any privacy right your state's law gives you, write to the address in section 12.

10. Children

RentorBuy is for adults making housing decisions. It is not directed to children under 13, has no accounts, and does not knowingly collect information from a child. A parent can use "Withdraw agreement" (section 9) to delete the server records of an install that agreed to AI import; those of an install that used only live rents are deleted 13 months after it was last seen.

11. Changes to this policy

If the app's data handling changes, this policy, the in-app copy, and the public page are updated before the change takes effect, and the version and dates at the top change. A new use of information you have already entered applies only after you are asked and agree; a change to this text alone is not agreement. A change in who receives an AI import, or in what is sent, is always put to you on the consent screen before the next import.

12. Contact

RentorBuy is published by an individual developer. Questions, requests about information the app or the RentorBuy server holds, and complaints all go to:

Email: pwlhstaffing@gmail.com · Support page: https://rentorbuy.slowturtle.app/support