Privacy Policy
Last updated 8 October 2026
Candid shows what people really pay in rent. This page explains what we collect, why, who else handles it, and what you can ask us to do. We wrote it to be read.
The short version
- We ask for your email to log you in, keep your rent connected to you, and turn away throwaway addresses. It never appears on the map.
- Other members see your rent anonymously: no name, no email, and the pin is moved a little.
- There are no ads, and we do not sell your information.
- You can ask us to delete your account and your rents at any time.
Who we are
Candid ("we", "us") is an independent project run from India. You can reach us at hello@candidrent.com.
What we collect
Your email. When you add a rent or log in, we ask for your email and send you a code. We keep the email to run your account. We never show it to other people. If you choose "Continue with Google" instead, Google tells us your email address, and also your name and profile picture; they are kept with your account record, and we do not use or show them. We never see your Google password.
Your rent. The city and area, an optional building name, the pin you place on the map, the home type, the monthly rent, and any details you choose to add (utilities, deposit, furnishing, bathroom, whether the rent is for one room). We also keep when you added it. This is tied to your account so you can see it, so we can check it, and so we can delete it if you ask.
What you send us. Messages you write in the feedback form, along with your account.
On your device. The site keeps a few things in your browser's local storage: that you are logged in, the rents you added, which rents you peeked at today, your last city, and, for up to 30 minutes while you verify your email, the answers you just gave so that a reload does not lose them. We do not use cookies to track you or to show you ads.
Visits. We use Plausible Analytics to count visits and a few actions, such as "Rent added". It uses no cookies, does not follow you across sites and does not keep your IP address. We also use Google Analytics to see how people find the site. Where you are in the EU, the UK or Switzerland, nothing is stored on your device for it. Elsewhere it may set its own first-party cookies to tell visits apart, and it receives your IP address, which Google shortens before storing. Advertising features are switched off. We never put your rent, email or location into an analytics event.
Technical logs. Our hosting and database providers keep standard server logs (for example your IP address and browser type) to keep the service secure and running.
How much a member reads. When a member opens the map, our database keeps, for each account and each day, how many pages of rents were read, how many rents that was, and when the first and last read were. It holds counts and times only, never the rents, and clears them after about a month (on a quiet stretch the clearing can be a little late). It is used to spot someone copying the data and to stop a day's reading far above what a person does. The figures sent to your account may also carry a small mark, different for every account and never visible, and include a few entries that are not on the map (never shown to anyone, never counted in any figure), all worked out from your account, so that a copy can be traced to the account that made it. Nothing extra is stored for them.
Free peeks. When someone who has not added a rent opens one of the free peeks, our database keeps a scrambled form of their network address, together with which rent they opened, for about two days, then it is cleared (on a quiet day the clearing can be a little late). It is scrambled with a secret key and used only to stop the whole list being copied.
Sign-up check. When you first sign up, we check whether your email address belongs to a temporary-email service, and if it does we ask you to use your everyday address. Nothing is kept from that check.
How other people see your rent
An automatic check looks at every rent first. A rent that passes is shown to other members anonymously: no name, no email, and the pin is moved a short distance. The building name is shown only when the listing is not from a women-only household. A rent the check holds for a second look stays private to you. People who have not added a rent can open a few rents a day and see area-level figures such as medians. Nobody can see your email.
Rents that come from other sources
Some rents on the map did not come from members. They come from other sources and are shown anonymously, with no names, contact details or exact addresses. If you think a rent on the map is yours and you want it removed, email us the area and the rent and we will remove it.
Why we use it
- to log you in and keep your rent connected to you;
- to check rents, show them anonymously and work out medians and comparisons;
- to prevent abuse, spam and copying of the data;
- to understand how the site is used and to improve it, from the visit counts and the feedback you send;
- to follow the law when we have to.
If you are in the UK or EU, our legal bases are your agreement to use the service (to run your account and show your rent), our legitimate interest in keeping the service safe and useful, and, where the law requires it, your consent.
Who else handles it
We use these providers to run Candid. They process information to provide their service to us, not for their own use:
- Supabase stores accounts and rents and handles login. The database is hosted in South Korea (Seoul).
- Resend sends the email with your login code.
- Google, only if you choose "Continue with Google", confirms who you are so you can log in. Google then knows you logged in to Candid; it is told nothing about your rent.
- Cloudflare Turnstile checks that a person, not a script, is asking for a login code. When the log in sheet opens, your browser loads it from Cloudflare directly, so Cloudflare sees your IP address and some details of your browser and device. It is told nothing about your rent.
- Vercel hosts the website.
- Plausible Analytics counts visits, without cookies.
- Google Analytics counts visits and a few actions, with the limits described under Visits.
- OpenFreeMap, OpenMapTiles and OpenStreetMap provide the map. Your browser asks them for map tiles directly, so they see your IP address and the part of the map you look at.
- Photon (Komoot) finds places when you search in the add-a-rent flow. The text you type and a nearby point on the map are sent to it.
We do not sell your information or share it for advertising.
How long we keep it
Your account and rents stay until you ask us to delete them. Our providers keep server logs for short periods. Analytics are counted in aggregate.
Your choices
You can ask us to show you what we hold about you, correct it, delete your account and rents, or stop using your information. Email hello@candidrent.com from the address on your account and we will reply within 30 days. You can clear what this browser has saved by logging out, or by opening the site with ?reset at the end of the address. If you are in the UK or EU you can also complain to your data protection authority.
Security
Login is passwordless, by emailed code or with Google. Data travels over HTTPS, and the database itself decides who may read what. No service is perfectly secure, so please do not put anything in your rent that you would not want a neighbour to know.
Children
Candid is for people aged 18 and over. We do not knowingly collect information from anyone younger.
Changes to this page
If we change this policy we will update the date at the top. If a change matters to you, we will say so on the site.