Privacy Policy

What we collect

• Email — stored for sign-in only, never shared or sold.
• Display handle — random-generated, not based on personal data.
• Review content — user-generated content, intentionally public, kept indefinitely.
• Anonymous pageview pings via Vercel Analytics — no cookies.

Cookies & sessions

• An HTTP-only JWT session cookie is set by Auth.js on sign-in.
• No cross-site tracking; no third-party analytics cookies.
• The session cookie is removed on sign-out.

Data retention

• Reviews are kept indefinitely — the public-records value compounds over time.
• Takedown requests are retained 1 year for compliance audit.
• Lease uploads (introduced in v0.3.1+) are auto-deleted within 30 days of submission.
• User accounts can be deleted on request — see below.

Public records caveat

DistrictTenant aggregates DC public records (parcels, business licenses, code violations) sourced from DC government feeds. These are not personal data of end users.

Account deletion

Email privacy@districttenant.com to request account and review deletion. We process requests within 30 days. Reviews already aggregated into public records (e.g., counts on owner pages) may persist as anonymized aggregate counts even after deletion.