Privacy Policy

This explains what GRBO collects, why, and what we do and do not share. We have tried to write it in plain language rather than in a way that technically discloses everything while communicating nothing.

What we collect

• Account information: your email address, display name, and a hashed password (or a Google account identifier if you sign in with Google). We never store your password in a readable form.
• Listing information: the exact street address of any space you list, its coordinates, description, photographs, price and features.
• Messages: the full content of messages you send through the platform, and a record of any contact details you explicitly choose to share.
• Letters: the destination address you pin, the interests you select, and the return address you supply.
• Payments: the amount, what it was for, and a Stripe payment reference. We never see or store your card number.
• Usage data: aggregate, privacy-friendly analytics via Vercel Analytics and Speed Insights. These do not use tracking cookies and do not build a cross-site profile of you.

What is shown publicly

Your listing's city, neighbourhood, approximate map marker, price, description and photographs are public. Your display name is shown to people you are in a conversation with.

Your exact street address is never published. The map marker on a public page is deliberately offset from the true location by roughly 150 metres. This matters especially for boat slips, where the stored address may belong to a neighbour who has no involvement with the listing.

Your email address is never shown to another user, ever, under any circumstance. Messaging relays through GRBO. The only way another user learns your email or phone number is if you deliberately share it in a conversation.

The messaging relay

Messages are stored on our servers and delivered to an on-site inbox. We send an email notification saying a message arrived and showing a short preview, but replies happen on the site — we do not accept or parse inbound email. Message content is readable by us and may be reviewed if it is reported, or where we need to investigate abuse or comply with a legal obligation. It is not used for advertising and is not sold.

Letters

To physically produce and mail a letter, we transmit the destination address, your name and return address, and the letter body to our mail production partner. We do not receive or store the recipient's name, and we never disclose it to you.

Who we share data with

We use a small number of processors, and only for the purpose listed:

• Neon — database hosting
• Vercel — application hosting, image storage, analytics
• Stripe — payment processing
• Postmark — transactional email delivery
• Google Maps — maps, geocoding and address verification
• Lob, via our sister service mappymail — physical mail production

We do not sell personal information, and we do not share it with advertisers or data brokers. We may disclose information where legally required.

Cookies

We set a session cookie to keep you signed in, and Stripe sets cookies necessary for fraud prevention during payment. We do not use advertising or cross-site tracking cookies.

Retention

Account and listing data is kept while your account is open. Removed listings are retained in a hidden state so payment and dispute records stay coherent. Payment and letter records are retained as long as required for accounting and fraud purposes.

Your choices

• Edit or remove your listings at any time from your dashboard.
• Update your display name in settings.
• Request a copy of your data, or deletion of your account and its data, by replying to any email from us. We do not hide this behind a form you cannot find.

Depending on where you live you may have additional rights, including under the California Consumer Privacy Act. We apply the choices above to everyone regardless of location.

Children

GRBO is not intended for anyone under 18 and we do not knowingly collect their data.

Changes

Material changes will be posted here with a revised date.