Privacy Policy

SuperHost connects travelers with local hosts. This policy explains what we collect, why we collect it, who else sees it, and what you can make us delete. It covers the SuperHost mobile app and this website.

SuperHost is operated by Muse Interactive, Houston, Texas. You can reach us at toyeonikoyi@gmail.com about anything on this page.

What we collect

Your account

Your name and email address, from the account you create or from Google or Apple if you sign in that way. If you sign in with Google or Apple we also receive your profile picture, which becomes your avatar.

What you tell us about your trip

The city and dates you are travelling, which of those days you want a local for, how many people are with you, your budget, the kinds of places you like, the occasion, and any dietary needs. Hosts you send a request to can see this. That is the point of collecting it: it is what stops you having to explain the same facts to every host by hand.

Messages and bookings

Conversations between you and a host, the requests you send, and the bookings, itineraries and reviews that result. Messages are kept as a record. If something goes wrong between two people, the conversation is the only thing either side can point back to.

Identity documents, if you host

Hosts may upload a government ID for verification. These are write-only: once submitted, nobody using the app can read them back, including the person who uploaded them. Only our backend can access them, and only for verification.

Photos, if you host

Pictures you add to your profile or your services. Every one is reviewed before it is visible to anyone else. A photo that is rejected is deleted from storage, not merely hidden.

Payment information

We never see your card number. Card details are entered on Stripe's own hosted page and stored by Stripe. We keep only an identifier that lets us ask Stripe to charge the card you saved, plus the brand and last four digits so you can recognise which card it is.

Notifications

If you allow notifications, a push token for each device. It is removed when you sign out or when the device stops accepting notifications.

What we do not collect

We do not track your location. We do not use advertising identifiers, we run no third-party analytics or ad SDKs, and we do not sell or share personal information with anyone for advertising.

How we use it

• To match you with hosts and let the two of you arrange a booking.
• To take payment when a host accepts, and to pay hosts.
• To send notifications about requests, messages, reminders and account matters. Each of those is a switch you control in Settings.
• To review photos and investigate reports, so the marketplace stays usable.
• To meet legal and tax obligations, such as filing US tax forms for hosts.

We do not use your data to train machine learning models, and we do not sell it.

Where AI is used

One feature uses a language model. If you write a free-text note about what you are looking for, that text is sent to Anthropic's API to be read into tags from a fixed list, which the matcher then uses. Only the note itself is sent. Your name, email, and account are not. The model does not choose hosts, write itineraries, or make any decision about your booking, and Anthropic does not use API inputs to train its models.

Who else sees your data

• Hosts you contact see your first name, the trip details you entered, and your messages. They never see your email address, phone number, or home address.
• Other travelers see only reviews you write, under your first name.
• Google (Firebase) hosts our database, file storage, authentication and backend functions.
• Stripe handles all payments and host payouts, and holds card and bank details directly.
• Expo delivers push notifications to your device.
• Anthropic receives free-text trip notes, as described above.

We will disclose information if we are legally required to, or where it is necessary to investigate a credible safety risk.

How long we keep it

Account data is kept while your account exists. Bookings, reviews and messages are kept after deletion in anonymized form, with your name removed, because they are also the other person's record: a host's rating is built from what guests wrote, and letting a review be erased by closing an account would make every rating on the platform meaningless. Payment records are kept as long as tax and accounting law requires.

Your rights

You can delete your account from inside the app, under Profile → Privacy & safety → Delete my account. It removes your profile, sign-in, photos, saved trips and verification documents for good. Full instructions are here.

You can access, correct, or export your data, or object to how we use it, by emailing toyeonikoyi@gmail.com. We respond within 30 days. If you are in California, the EEA or the UK, you have these rights under the CCPA and the GDPR respectively; we do not sell personal information, so there is nothing to opt out of.

Children

SuperHost is not for anyone under 18. We do not knowingly collect data from children. If you believe a child has an account, email us and we will remove it.

Security

Data is encrypted in transit and at rest. Access is enforced by database security rules rather than by application code alone: anything that decides money, trust or account status is written only by our backend and can never be set by a phone. No system is perfect, and we will tell affected users promptly if a breach occurs.

Changes

If we change this policy in a way that matters, we will say so in the app before it takes effect. The date at the top always reflects the current version.