Last updated: September 16, 2026

Privacy Policy

This policy explains what information Could I Borrow collects and how it is used when neighbors share and borrow items.

Could I Borrow is operated by Rodolfo Inostroza, an individual based in Redmond, Washington, United States. Membership is free.

Information we collect

We collect your email, display name, authentication details and language preference; optional profile photo and location; inventory descriptions and photos; circle memberships and invitations; requests, agreed dates, pickup instructions, handoff and return records, reviews and reports. We record the versions of the terms and privacy notice you acknowledge, your eligibility confirmation, and the acceptance time. Push subscriptions are stored only if you enable them. Technical logs can include IP addresses, device/browser details, timestamps and error information. Please keep sensitive personal information out of item descriptions, photos, pickup notes and reports.

Contact requests

Our public contact form collects the reply email, topic, message and language you submit so the operator can respond, handle your request and prevent abuse. Do not send passwords, full payment details, identity documents or sensitive information that is not needed for the request.

Cloudflare Turnstile checks the form for automated abuse. Resend delivers the message to a service contact address, which forwards it to the operator’s Gmail mailbox provided by Google. The operator can see your reply address and message. Submitting the form does not subscribe you to marketing.

The contact form uses an essential security cookie with a random session identifier that expires after 24 hours. The application database stores request counters and a keyed hash of that identifier, not the raw cookie, contact message or reply email. The identifier is pseudonymous, not anonymous. Counters limit each contact session to 3 submissions and the service to 200 submissions per 24-hour window. Session limits depend on the cookie; CAPTCHA and the service-wide limit also protect the form. Cookie expiry does not automatically delete database counters. The cookie is not used for analytics or advertising. Messages are retained by the delivery provider and operator’s mailbox according to their settings and as needed to respond, address disputes, prevent abuse or meet legal obligations. Contact us to request access or deletion; applicable retention exceptions may remain.

How we use information

If you allow analytics, we keep predefined campaign labels for this session and attach them to a new waitlist registration to count signups by source without duplicates. We do not send your email, invitation codes, or private content to Google Analytics. You can turn analytics off through its preferences and ask us to delete your registration. We also calculate internal totals for accounts, circles, and loans from service records; those reports contain no names or private content.

We use this information to authenticate you, operate circle sharing features, coordinate reservations and returns, display reputation information, prevent abuse, provide support, and improve reliability.

Who can see information

Items shared with a circle are visible to its members. Your profile name, photo and optional location are visible to you, people in a shared circle, your loan counterparties, and circle administrators reviewing your join request. Pickup instructions and loan details are restricted to the participants. Inventory that you have not shared stays private to your account. The operator may access records to provide support, investigate abuse and fulfill verified account requests. Do not share information you do not want other authorized participants to retain.

Service providers

Supabase provides authentication, database and private photo storage. DigitalOcean hosts the application. Cloudflare provides network protection and Turnstile abuse checks. Resend sends service emails when email delivery is enabled; contact form messages are delivered by Resend and forwarded to the operator’s Gmail mailbox provided by Google. Google processes sign-in if you choose Google, and Google Analytics processes usage information only if you allow analytics. When configured, Sentry and Better Stack process technical error and operational logs. Browser push services process delivery information when you enable notifications. Optional external contribution links open a separate provider governed by its own notice. Providers may process data in the United States and other locations where they operate. We do not sell member data or use private lending records to target advertising.

Analytics

We use Google Analytics and Microsoft Clarity, only if you allow them, to measure visits and see how people use the site so we can improve it. Clarity records anonymized clicks, scrolls and screens; text inside the app is masked, and your email address is never sent. You can change your choice at any time with the analytics preferences button.

Contribution information

If you contribute through Ko-fi, Ko-fi and its connected payment processor handle the payment under their own notices. The operator can receive your display name, email, message and transaction information. We use those records to manage contributions, answer payment or refund requests and meet accounting or legal obligations. They are not added to your borrowing reputation or used to enroll you in marketing. Provider and accounting records may need to be retained after an app account is deleted.

Retention and security

We keep account and service records while needed to operate your account and loans. After a verified deletion request, we remove account access, uploaded photos and identifying account content through a reviewed process. Unresolved loans, disputes, another member’s transaction records, fraud prevention or legal obligations may require limited retention. Minimum shared transaction records may remain with a pseudonymous participant label; that does not make them anonymous to people who took part. Backup copies are not edited individually and expire under the applicable backup schedule. We explain any retention exception when handling your request. No storage or transmission method is completely secure.

Your choices

You can update your profile and choose which circles receive your items. Use the contact form linked from our data request page, entering your registered email, to request access, a copy, correction, deactivation or deletion, or to question a decision. We verify control of the account before acting and explain any reason we cannot fulfill part of a request. You may disable browser push in your device settings and withdraw analytics permission using Analytics preferences. Essential session and security cookies remain necessary for sign-in. Optional analytics starts only after permission; we do not use cross-site advertising cookies. We also disable optional analytics and campaign attribution when your browser sends Global Privacy Control or Do Not Track. See our data deletion page.

Children

Membership is for people aged 18 or older who live in the United States and can enter an agreement. We do not knowingly collect information from children. If you believe a child has provided personal information, contact us so we can review and remove it.

Contact

We date changes to this notice on this page. Material changes affecting account use require a renewed acknowledgment before you continue in the app. Use the privacy contact form for questions, privacy requests or concerns about this notice.