Privacy Policy

Only what it takes.
Nothing to sell.

HostBook is built local-first. Your books live on your device, and on Apple devices in your own iCloud. Some features work across people and devices — your HostBook account, Team Access with co-hosts and cleaners, book sync on Android, booking pages and payment links — and those need HostBook's server. This page explains exactly what goes where, who can see it, and how to remove it.

Effective: 4 October 2026  ·  Last updated: 14 October 2026

The short version

Five lines,
no asterisks.

  • Without an account, your books stay on your device, and on Apple devices in your private iCloud. We can't see them.
  • If you sign in and use Team Access, or book sync on Android, a copy of your books is kept on HostBook's server, so your co-hosts see what you allow them to see and your other devices stay up to date. Cleaners you invite see only their cleanings.
  • Guests who book through your booking page give their details to you, the host. HostBook stores them on your behalf.
  • We use a small number of service providers (listed below), and only to deliver HostBook: sign-in, payments, email, notifications and subscriptions.
  • We don't run analytics. We don't show ads. We don't track you across apps. We don't sell or share your data for advertising.

On your device

Your books,
on your device first.

HostBook saves your books on your device:

  • Listings: names, addresses, fee rules, notes, photos, and the guest-message details (directions, Wi-Fi, door codes)
  • Transactions, with any receipt photos you attach
  • Guests: names, contact details, notes, and any photo or ID document you add
  • Co-hosts and your preferences

Some things are processed on your device and never sent to us. Receipt text recognition runs on the device (Apple Vision on Apple devices, Google ML Kit's on-device model on Android). When you add a guest from your contacts or a photo from your library, the system picker gives HostBook only the item you choose. HostBook asks for no access to your contacts, photo library, calendar or location. It uses the camera only when you choose to take a photo, such as a listing or cleaning photo, and on iPhone and iPad it asks you first.

iCloud (iPhone, iPad, Mac). If you're signed in to iCloud, HostBook syncs your books through Apple's CloudKit to your private iCloud database. It is tied to your Apple Account, visible only on your own devices, and we cannot read it. A few preferences (such as theme and currency) sync through iCloud key-value storage. To turn sync off: Settings → [your name] → iCloud → Apps Using iCloud → HostBook.

Android. Your books are stored in the app's private storage. HostBook opts out of Google's automatic cloud backup. When you move to a new phone, Android's device-to-device transfer can still copy your books across. If you turn on book sync, a copy of your books is also kept on HostBook's server (see Book sync).

Backups you make. Settings → Export Backup and the optional weekly automatic backup write a JSON file to a place you choose. These files are not encrypted and contain everything in your books, including guest details, guest photos and ID documents, Wi-Fi passwords and door codes. Keep them somewhere safe.

Calendar links. HostBook fetches your Airbnb, Booking.com or other calendar links directly from your device. Our server can read a link only if you turn on booking alerts for that listing (see Team Access). If you use book sync on Android, your links are copied to your other devices encrypted, so our server can't read them (see Book sync). If you publish a HostBook calendar for a channel to read, it contains only busy dates and the listing name (no guest names or amounts), at a private, hard-to-guess address on hostbook.uk.

Guest photos and ID documents stay on your device, and on Apple devices in your iCloud. They are not sent to HostBook's server.

Your HostBook account

Sign in your way.
We only keep what it takes.

HostBook offers a free HostBook account the first time you open the app. You can skip it (“Continue without an account”) and use HostBook without one. You need an account only for features that work across people or devices, such as Team Access, inviting or working as a cleaner, book sync on Android, booking pages and payment links.

You can sign in with Apple, with Google, or with an email address and password. We keep:

  • Your email address: the one you sign up with, or the private relay address Apple gives you if you choose “Hide My Email”
  • A sign-in identifier from Apple or Google, so the same person always lands on the same account. Google may also include your name and profile picture link in what it sends; we don't use them
  • Your password, if you use one, stored only as a secure hash
  • Sign-in records: when you signed in, the IP address of the request, and a session token so you stay signed in. On your device, the session is kept in the iOS/macOS Keychain or Android's encrypted storage
  • Your account's ID, which also links your subscription (see Subscriptions)

We do not receive your Apple or Google password, your contacts, or anything else from your Apple or Google account. We ask Apple and Google only for your email address.

If you sign in with Apple or Google using the same email address as an existing HostBook account, the two are joined into one account, so your workspaces, co-hosts and subscription stay in one place.

Hide My Email. If you choose Apple's “Hide My Email”, we only ever see the relay address. Emails we send you go through Apple's relay to your real inbox. A co-host who invites you to Team Access must invite that relay address.

Team Access

Shared with your team.
Only what you allow.

When you sign in and set up Team Access, HostBook keeps a copy of your books on its server. That is how co-hosts see bookings and statements, and how your books reach your other devices. The copy includes:

  • Listings: name, location label, notes, cover photo, address, directions, Wi-Fi name and password, and door codes
  • Bookings: guest name, dates and times, status, channel and reference, amounts, notes, guest count and stay door code
  • Guests: name, email, phone and notes. Guest photos and ID documents are not included
  • Transactions and expenses, co-host agreements and statements, and your books' change history
  • Co-hosts' names, emails and phone numbers

Receipt photos are not included, except receipts a co-host attaches to an expense they submit. Your calendar links are not included either, unless you turn on booking alerts (below).

Who sees it. You decide, per co-host and per listing, whether they see guest names, contact details and notes, and whether they see the money. The server enforces these choices on every request. Co-hosts see the address, Wi-Fi and door code only if you've allowed them to see guest contact details. Guests' details from your booking page are visible to you only, not to co-hosts.

When you invite a co-host, we store their email address and send them an invitation. When they join, their name and email are visible to the team.

Check-in messages. When you or a co-host marks a booking's check-in message as sent, or not sent, the server records who marked it, when, and how it was sent (for example WhatsApp, text message, email or copied), so the whole team sees it on the booking. Your app also shares your reminder settings and, for bookings checking in within the next 10 days, whether the booking came through a channel and whether you have a phone number or email for the guest. The message itself, door codes and the guest's contact details are never sent to our server for this. If the message is still unsent, co-hosts assigned to that listing get a reminder. It names the guest only if they're allowed to see guest names, and it never includes a door code. Without Team Access, the sent mark stays on your device.

Booking alerts. With HostBook Pro or a Team plan, you can turn on booking alerts for a listing to hear about new, changed and cancelled Airbnb and Vrbo bookings within minutes. Your device then sends that listing's Airbnb and Vrbo calendar links to HostBook's server, once. The server stores them encrypted, with a key that only the alert service holds, and never logs them. No app or co-host can read them back, and our backups hold them only in encrypted form. About every five minutes, our server fetches the calendar from Airbnb or Vrbo, as your device does. For each booking it keeps only the dates, the channel, whether it was cancelled, and a scrambled reference. Guest names, phone digits and everything else in the calendar are dropped.

Alerts go to you and to the co-hosts assigned to that listing. They name the listing, the channel and the dates, never a guest's name or an amount. Co-hosts can turn them off for themselves. Turning booking alerts off, deleting the listing or deleting your account deletes the links straight away. Signing out on one device doesn't delete them, so alerts keep working on your other devices. If your Pro or Team plan ends, alerts pause and the links are deleted 30 days later. The booking dates kept for alerts are deleted 30 days after check-out.

Notifications. If you turn on team notifications, your device gives us a push token from Apple or Google. We store it encrypted, together with a random installation ID, your language and your time zone. Notifications are delivered by Apple Push Notification service or Firebase Cloud Messaging. An alert can include a guest's name (only if that person is allowed to see guest names) and an amount. Turning notifications off removes the token.

Cleaners

Cleaners see the cleaning.
Nothing more.

On a Team plan, you can invite cleaners. A cleaner isn't a co-host: they don't get a copy of your books, only the cleanings on the listings you assign to them.

Inviting a cleaner. You share the invitation link yourself, for example by WhatsApp or text message. HostBook doesn't email it. The link works once and expires after 14 days. To accept it, the cleaner signs in to a HostBook account or creates one (see Your HostBook account). You then see the email address of the account that accepted your link, so you can check the right person joined, along with the name you gave them and the listings they clean.

What a cleaner sees. Only cleanings on the listings you assign to them, for checkouts from yesterday to two weeks ahead:

  • The listing's name and address, and the notes you write for cleaners
  • Your checklist for that listing
  • The checkout date and time, the next check-in date and time, and how many guests arrive next
  • The listing's door code, only if you turn on “Share the door code with cleaners” for that listing. It's off by default

Cleaners never see guest names or contact details, amounts, Wi-Fi details, directions, booking notes, a stay's own door code, or your other listings. Of other cleaners, they see only the name of whoever marked a cleaning done.

Photos and problem reports. Cleaners can tick the checklist, mark a cleaning done, add photos (up to 12 per cleaning) and report a problem with a note. Photos are stored on HostBook's server. You, the co-hosts assigned to that listing and the listing's cleaners can see them. A cleaner can delete a photo they took until the cleaning is marked done. Photos are deleted 30 days after the checkout. Checklist ticks, done times and problem notes are deleted 180 days after the checkout.

Co-hosts. Co-hosts see the cleaning status and photos for the listings they're assigned to. Only you can invite, change or remove cleaners and edit checklists.

Notifications. You and your co-hosts can be told when a cleaning is done or a problem is reported. The notification names the listing and the cleaner, not the problem itself. Cleaners get a list of the next day's cleanings each evening, and a notification when a cleaning is added, moved or cancelled. These name a listing, dates and times only: never a guest's name or contact details, an amount or a door code. To send them, we store the cleaner's push token encrypted, with a random installation ID, their language and their time zone, as for team notifications. A cleaner can turn these notifications off in their account menu, and signing out removes the token.

Removing a cleaner. When you remove a cleaner, they lose access at once. Photos they already took stay with the cleaning until they're deleted on the schedule above. If a cleaner deletes their HostBook account, they leave every team they clean for, and the photos they took are deleted.

Book sync (Android)

One book,
on every phone.

On Android, you can sync your books between your own devices. Sync is off until you turn it on, and it needs a HostBook account. When it's on, HostBook keeps a copy of your books on its server, so every Android device signed in to your account has the same books, and a new or replacement phone gets them back.

What is copied:

  • Listings, including address, directions, Wi-Fi name and password, door codes, rates and message templates
  • Bookings, expenses, payouts and other transactions, fee and recurring-charge rules, and closed months
  • Guests (name, email, phone and notes), and co-hosts and their listings
  • Connected listings, calendar blocks you add, imported channel statements, payout corrections and your books' change history
  • Your HostBook settings, such as owner name, theme, currency and notification choices
  • With HostBook Pro, your receipt photos and listing photos

Calendar links stay locked. Your Airbnb, Booking.com and other calendar links, and the private address and key of any HostBook calendar you publish, are encrypted on your device before they're copied. The key that opens them passes only between your own devices, sealed so that our server never has it. Our server stores the links but can't read them. If you lose your only device, you may need to type those links again on the new one.

What never leaves your device: guest photos and ID documents (our server refuses them), sample data, and your language and time format. Without HostBook Pro, receipt and listing photos stay on the device too.

How it's protected. Everything travels encrypted (TLS), and only your signed-in account can read or change your copy. Photos are kept in a private store that only your account can open. Apart from calendar links, the copy is not end-to-end encrypted: HostBook's operators could technically read it, as with Team Access. We look at it only to keep the service running, or when you ask us to. To tell your other devices to fetch changes, we store each device's random installation ID and an encrypted push token. These wake-up notifications carry no names, amounts or other content.

How long we keep it. Your synced books are kept while your account exists. Earlier versions of each record are kept for 180 days, so a mistake can be undone. A deleted record leaves only a marker (its ID and “deleted”) so your other devices delete it too. A photo that none of your records uses any more is deleted after 30 days. If your Pro subscription ends, photos already copied stay available to your devices, and new photos stay on the device that took them.

Turning it off and deleting. Turning sync off on a device stops that device syncing. Its books stay on it, and the copy on our server stays for your other devices. “Erase the books on all devices” (Settings → Sync) deletes your books on every device and in the server copy. Earlier versions then go within 180 days, and photos 30 days after nothing uses them. Deleting your HostBook account deletes the synced books, every earlier version and every registered device at once, and the photos within minutes.

Booking pages and payments

Your guests.
Your Stripe account.

If you publish a booking page or send a payment link, HostBook runs it on book.hostbook.uk for you. Here, you are responsible for your guests' data (the “controller”), and HostBook processes it on your behalf.

What the page shows. What you publish: listing title, description, photos, rules, prices, availability, and your contact details if you add them. Photos on a booking page are public.

What guests give us. A guest who books or asks for dates gives their name, email address, and optionally a phone number and a message, plus their dates and number of guests. We store this and show it to you, the host. We email the guest a booking confirmation, and a refund notice if you refund them. The booking page sets no cookies, runs no analytics and loads nothing from third parties.

Payments. Guests pay through the host's own Stripe account:

  • HostBook never sees or stores card details
  • You connect Stripe by pasting a restricted key from your Stripe dashboard. We store it encrypted on our server and use it only to create checkouts, links and refunds for you
  • To create a checkout we send Stripe the amount, the guest's email address, the listing title and photo, and the dates
  • We keep Stripe's payment references, amounts, fees and refunds so your books match

Stripe's privacy policy: stripe.com/privacy.

Website form. If you put HostBook's booking-request form on your own website, the same applies to what guests type into it. Guests can ask the host, or us at [email protected], to access or delete their details.

Subscriptions

The store handles billing.
We never see your card.

HostBook Pro and Team are sold through the App Store on Apple devices and Google Play on Android. Apple and Google process the payment under their own policies: apple.com/legal/privacy and policies.google.com/privacy.

We use RevenueCat to manage subscriptions:

  • When you're not signed in, RevenueCat knows you only by a random, anonymous ID
  • When you're signed in, we give RevenueCat your HostBook account ID (never your email), so your subscription follows your account across devices
  • RevenueCat receives the purchase details from the store, such as product, price, currency, country, dates and store transaction IDs. It sends them to our server, which keeps them to apply your subscription
  • We don't send RevenueCat names, contact details or anything from your books

RevenueCat's privacy policy: revenuecat.com/privacy.

Service providers

A short list.
Each with one job.

  • Contabo: hosts HostBook's server, in France (EU). We run the server ourselves
  • Google Drive: stores our encrypted server backups. Google receives only encrypted data it cannot read
  • Apple: iCloud sync, Sign in with Apple, push notifications, App Store billing
  • Google: Sign in with Google, push notifications (Firebase Cloud Messaging), Google Play billing
  • RevenueCat: subscription management
  • Stripe: guest payments, on the host's own Stripe account
  • Resend: delivers HostBook's emails, such as account confirmations, password resets, team invitations and notices, and guest booking confirmations. We don't use open or click tracking
  • Cloudflare: DNS for hostbook.uk only. Our app traffic does not pass through it

We don't use analytics, crash-reporting, advertising or attribution SDKs. Diagnostic logs stay on your device.

Some of these providers process data outside the UK and the EU, including in the United States. Where that happens, we rely on the safeguards the law provides, such as UK and EU adequacy decisions or standard contractual clauses.

Keeping and deleting

Delete it in the app.
Or just ask.

On your device. Deleting the app removes its data from that device. To remove your iCloud copy: Settings → [your name] → iCloud → Manage Account Storage → HostBook → Delete Data from iCloud.

Your account. On iPhone, iPad and Mac: Settings → HostBook account → Delete account. On Android, the same option is on the HostBook account screen. Deletion takes effect immediately and removes your sign-in, email and password, your Apple or Google link, your devices and push tokens, your notifications and preferences, and your pending invitations. It also deletes your synced books (their photos follow within minutes) and, if you clean for a host, takes you off their team and deletes the photos you took. If you signed in with Apple, HostBook also asks Apple to disconnect it; from an Android device, remove it yourself in your Apple Account settings under Sign in with Apple. Deleting your account doesn't delete the books on your device.

Teams. If you're a co-host and delete your account, the host's books keep the work you recorded, without your name or email. If you're a host and delete your account, your team is closed: co-hosts and cleaners lose access, booking alerts stop and their calendar links are deleted, and your booking page stops taking bookings. The team's records are kept so the books stay complete, until you ask us to erase them. If in-app deletion tells you to contact support, email us and we'll do it.

How long we keep things.

  • Account and team data, including email and notification records: while your account or team exists
  • Synced books (Android): while your account exists. Earlier versions of a record: 180 days. Markers for deleted records: while your account exists. Photos no record uses any more: 30 days
  • Cleaning photos: 30 days after the checkout. Checklist ticks, done times and problem notes: 180 days after the checkout
  • Check-in message marks: as long as the booking is in your team's records
  • Booking alerts: calendar links until you turn alerts off or delete the listing or your account, or 30 days after your Pro or Team plan ends. The booking dates kept for alerts: 30 days after check-out
  • Dates a guest held but never booked: 30 days
  • Stripe event records: 60 days
  • Server system logs: 30 days. Web access logs, which include IP addresses, are overwritten automatically as new traffic arrives
  • Encrypted backups roll off over up to 12 months, so deleted data can remain in a backup until then. We restore backups only to recover the service

To ask us to delete anything, email [email protected] from the address on your account.

Your rights

GDPR. UK GDPR. CCPA.
Ask, and we'll answer.

Depending on where you live, you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or move it elsewhere.

On the device, you can do most of this yourself: edit your books, export a JSON backup, or delete the app. For anything on our server, email [email protected]. We may need to confirm the request comes from your account's email address.

Why we process it (UK/EU GDPR).

  • To provide the service you asked for (contract): your account, Team Access, cleaners, book sync, booking alerts, booking pages, payment links, subscriptions
  • Our legitimate interest in keeping HostBook secure and working: sign-in records, logs, backups
  • Your consent: push notifications, which you can turn off at any time
  • Legal obligations, where they apply

For guests' data in a host's books or booking page, the host is the controller and HostBook is their processor.

California (CCPA/CPRA). We don't sell your personal information or share it for cross-context behavioral advertising, and we don't use sensitive information to infer things about you.

You can also complain to your data protection authority. In the UK, that is the Information Commissioner's Office (ico.org.uk).

The rest of it

Children, security,
and updates.

Children's privacy

HostBook is a business tool for property hosts. It is not designed for or directed at children, and we don't knowingly collect data from anyone under 16. On Android, where the law requires it, HostBook may ask Google Play for an age signal. It is used only to apply that rule and is not stored.

Data security

  • Traffic between the apps and our server is encrypted (TLS)
  • Passwords are stored as hashes, and push tokens, Stripe keys and the calendar links you share for booking alerts are encrypted
  • Calendar links in book sync are encrypted on your device, with a key our server never has
  • Every request is checked against your team's permissions by the database itself
  • Administrator access to the server is by key only, and our backups are encrypted before they leave the server
  • On your device, data is protected by the operating system's app sandbox and your passcode

No system is perfect. If we learn of a breach that affects your data, we will tell you and the authorities as the law requires.

Changes to this policy

If we change this policy in a way that affects your data, we'll update the date at the top of this page and tell you in the app before the change takes effect.

Privacy questions?
We respond.

HostBook is responsible for this app and this policy. For privacy questions, or to access or delete your data:

[email protected]  ·  We aim to respond within 5 business days, and always within one month.