Privacy Policy

PropDesk ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

By accessing or using PropDesk, you agree to the collection and use of information in accordance with this policy.

Account information

Name, email address, and hashed password. Profile photo if you choose to upload one.

Property and operational data

Property addresses and details, tenant contact information, lease terms, rent records, maintenance orders, inspection notes, tasks, and documents you upload.

Device and security information

A server-generated device identifier (stored as an httpOnly cookie) used for security and fraud prevention. Biometric authentication data (Face ID / Touch ID) is processed locally on your device only and is never transmitted to our servers.

Usage information

Login timestamps, session data, security events, and authentication attempts used for security monitoring and service improvement.

• Provide, maintain, and improve the Service
• Authenticate users and secure access
• Send verification codes for two-factor authentication
• Enforce security measures and detect suspicious activity
• Comply with legal obligations and respond to legal requests
• Provide customer support and respond to inquiries
• Send important service updates and notifications

• All data encrypted in transit (HTTPS/TLS) and at rest
• Passwords hashed; never stored in plain text
• Two-factor authentication (TOTP, SMS, or email) available
• Passkey / biometric lock available on supported devices
• Rate limiting, input sanitization, and regular security assessments
• Session management with per-device revocation

No method of transmission over the internet is 100% secure. While we implement commercially reasonable measures to protect your information, we cannot guarantee absolute security.

All data is stored securely on our backend servers (hosted on Railway) using PostgreSQL. Files and media are stored in Cloudflare R2 object storage.

No sensitive information (passwords, financial data) is stored locally on your device. Biometric data is stored locally on-device only and never transmitted to our servers.

Upon account deletion, we delete or anonymize your personal information within 90 days, except where retention is required by law.

We do not sell, trade, or rent your personal information to third parties.

We may share information only:

• With authorized team members based on their access level within your workspace
• When required by law, court order, or government request
• With trusted service providers (hosting, email delivery, payment processing) who are contractually bound to protect your data
• In connection with a merger, acquisition, or sale of assets

We use the following key third-party services:

• Railway — backend infrastructure hosting
• Cloudflare R2 — file and media storage
• Stripe — subscription billing and payment processing
• Twilio / Resend — SMS and email delivery for verification and notifications
• Expo — push notifications on mobile

Each provider is bound by their own privacy policies and our data processing agreements.

You have the right to:

• Access — request a copy of your personal information
• Correction — correct inaccurate or incomplete information
• Deletion — request deletion of your account and associated data
• Portability — request your data in a portable format
• Objection — object to certain processing of your information
• Withdrawal of Consent — withdraw consent where processing is consent-based

To exercise these rights, contact us at [email protected]. We will respond within 30 days.

We retain your information for as long as your account is active or as needed to provide services. Certain information may be retained longer for legal compliance, dispute resolution, or security purposes.

PropDesk is not intended for users under the age of 18. We do not knowingly collect information from children under 18. If you believe we have collected such information, please contact us immediately and we will delete it.

In the event of a data breach that may affect your personal information, we will notify affected users within 72 hours of becoming aware (where required by law), describe the nature of the breach, and advise on protective steps.

We may update this Privacy Policy from time to time. We will update the "Last Updated" date and notify you of material changes via email or in-app notification. Continued use of the Service after changes become effective constitutes acceptance of the updated policy.

To the maximum extent permitted by applicable law, PropDesk, its developers, affiliates, and service providers shall not be liable for any indirect, incidental, special, consequential, or punitive damages, or loss of profits, revenue, or data. Our total liability shall not exceed the amount you paid for the Service in the 12 months preceding the claim, or $100, whichever is greater.

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, contact:

[email protected] — subject line: "Privacy Policy Inquiry"