Privacy Policy
Last updated 8 October 2026
Upstay stores your account email, sign-in credentials in protected form, saved places, and the trip details you choose to track. We do not sell your personal information or use advertising analytics.
What is stored, in full
The main account data we store is listed below.
| What | Why |
|---|---|
| Your email address | It identifies your account and receives requested sign-in messages. Watch findings are sent only to a verified email address when delivery is available. |
| Sign-in and session tokens, hashed | To keep you signed in. Only a SHA-256 of each token is stored; the usable value exists solely in your browser's cookie. A copy of the database contains no working credential. |
| Password hash, if you use a password | A salted PBKDF2-SHA256 password hash verifies your sign-in. Your password is never stored as plain text. |
| Saved places | Bookmarks are stored with your account so they are available across your signed-in devices. |
| Billing references, if you purchase an Upstay plan | Stripe customer, checkout, payment and subscription identifiers, payment status and plan dates let us provide the features you paid for and reconcile refunds or cancellations. Full card numbers and security codes are handled by Stripe, not stored by Upstay. |
| Your watches — dates, the listing you booked, what you paid, party size, your confirmed cancellation deadline, and the criteria you set | This is the instruction the service carries out. What you paid is the number an alternative has to beat. |
| Account security and service logs | Session timestamps, sign-in attempts and operational request information help protect accounts, limit abuse and diagnose failures. Passwords and working sign-in tokens are not intentionally logged. |
| Findings — which alternatives were surfaced to you and when | So the same finding is not announced twice, and so you can see what was found while you were away. |
What is not stored
- No plain-text password.
- No name, address, phone number or date of birth is required for an Upstay account. Stripe may collect billing information at checkout if you purchase an Upstay plan.
- No full payment-card number or security code is stored by Upstay.
- No analytics, behavioural tracking, advertising identifiers, session recording or fingerprinting. There is no third-party script on the site.
- No access to your account on Airbnb or any booking platform.
Information about properties, not about people
Most of what Upstay stores is not personal data at all: availability, prices and cancellation policies observed from public listing pages, plus a curated set derived from Inside Airbnb under CC BY 4.0. This describes properties, and is kept indefinitely as a market history. Listing coordinates in that source are deliberately anonymised by up to roughly 150 metres, and Upstay does not attempt to un-anonymise them.
Cookies and local storage
- One cookie,
upstay_session, set only after you sign in. It isHttpOnly(JavaScript cannot read it),Secure,SameSite=Lax, and lasts 60 days. It exists to keep you signed in and does nothing else. There are no advertising or analytics cookies, which is why the site has no cookie banner. - Local storage in your browser may contain legacy saved listings and development connection preferences. Legacy saved listings are added to your account when you sign in. Account bookmarks are stored on our server.
Where the data lives
- The database and the collector run on a virtual server in Frankfurt, Germany (EU), provided by DigitalOcean.
- The website itself is static and served by Vercel.
- Encrypted-in-transit backups are copied to a personal computer in the United States so the data survives losing the server. Backups are kept for 30 days and then deleted.
Who else sees anything
No one is sent your data for their own purposes. The service providers that necessarily process it are:
- DigitalOcean — hosts the server and database.
- Vercel — serves the website; sees ordinary web request metadata such as IP address.
- OpenFreeMap — supplies the map using OpenStreetMap data. When a map is displayed, your browser requests map tiles, fonts and symbols directly from OpenFreeMap and its delivery providers. They receive ordinary request metadata, including your IP address and the requested map area. Upstay does not send your account email, saved places or trip details to the map provider. See OpenFreeMap’s privacy policy.
- Airbnb’s image hosting provider serves listing photos directly to your browser and receives ordinary request metadata, including your IP address.
- Resend, when email delivery is enabled, processes your email address and message content to deliver requested sign-in codes and watch findings. Watch emails require a verified address. Delivery status is shown in your account.
- Stripe, if you purchase an Upstay plan, processes your email and payment information to run checkout, subscriptions, refunds and fraud prevention. Its checkout has separate privacy terms. Upstay receives billing references and status, not your full card number or security code.
Data may be disclosed if required by law. If that ever happens and it is lawful to say so, affected account holders will be told.
How long it is kept
- Your account and watches — until you delete them.
- Sessions — 60 days, or immediately when you sign out.
- Sign-in links — 15 minutes, and single-use.
- Operational job logs — rotated daily, retaining 14 rotated copies. Hosting providers may separately retain request logs under their own policies.
- Billing data — Upstay keeps plan and payment references with your account. Stripe may retain financial records under its own policies and legal obligations after your Upstay account is deleted.
- Backups — 30 days, after which deleted data is gone from those too.
- Property observations — indefinitely; they are not about you.
Your rights
You can ask for a copy of everything held about you, correction of anything wrong, or deletion of your account and its data. Deletion means deletion: the account, its watches and its findings are removed, and the change reaches backups within 30 days.
If you are in the UK or EU, the GDPR applies. The legal basis for holding your email address and watches is performance of a contract — they are what the service you asked for is made of. You may object, restrict processing, or complain to your local supervisory authority.
You can download your account data or delete your account from the Account page. For privacy requests, contact privacy@upstay.app. We aim to respond within 30 days, subject to applicable requirements.
Children
Upstay is not intended for anyone under 16 and accounts are not knowingly created for them. If you believe a child has an account, get in touch and it will be removed.
Security, honestly stated
Sign-in tokens are stored only as hashes; the session cookie cannot be read by JavaScript; the database is reachable only over an authenticated connection; and the browser-facing write path is scoped so it cannot touch collection data. No system is perfectly secure, and none of this is a promise that nothing can go wrong. If a breach affects your data you will be told what happened and when.
Changes
Material changes will be noted here with a new date at the top. We may also notify affected account holders by email.
Who is responsible
Upstay is responsible for the account data described here. Contact privacy@upstay.app about privacy, or support@upstay.app for help with the service.