Privacy Policy
Effective August 16, 2026 · Last updated August 16, 2026
1.Who this is
NearStays is operated by Bald Cactus, LLC, a Delaware limited liability company (“we”, “us”). This policy covers www.nearstays.com and the services reached from it. Questions, requests and complaints all go to hello@nearstays.com, which is read by a person.
2.This is a beta
NearStays is an early service under active development. Features appear and disappear, data sources change, and anything you save here should be treated as convenient rather than durable. We will tell you before we do something materially different with information you have already given us.
3.What we collect, and when
Most of NearStays works without an account and without you telling us anything about yourself. What follows is organized by what you were doing, because that is what determines whether we collect anything at all.
| When | What | Why |
|---|---|---|
| Searching No account needed | The sentence you type, and the filters we parse out of it (bedrooms, price, places you want to be near, city). Your IP address, read from the request. | To run the search. The sentence and its filters are also recorded as an analytics event — see section 8. The IP address is used only to rate-limit abuse and is held in memory, not written to a database by us. |
| Signing in | Your email address, a display name if you choose to set one, and the timestamps of the account. | To email you a sign-in code and to keep the things you save attached to you. We do not use a password, so there is none to store. |
| Saving a listing | A copy of the listing as it was when you saved it — title, price, address, coordinates, a photo, the outbound link — stored against your account. | So a saved listing still shows something after the source takes it down, which they routinely do. |
| Sending feedback | Your message, the search that was on screen when you opened the form, and an email address if you give one. | It is emailed to us so we can read it and, if you left an address, reply. The message text is not sent to our analytics. |
| Asking for a city | The city you asked for, and an email address if you give one. Your account id if you happen to be signed in. | The request itself is the vote, and it decides which city we cover next. The address is optional and means only one thing: tell me when this city works. |
| Using voice search | The audio you record, and the text transcribed from it. | To turn what you said into a search. See section 9 — we do not keep either one. |
| Any page load | Standard server log data: IP address, browser user agent, the URL requested, and the time. | Written by our hosting provider, kept briefly, and used to keep the service running and secure. |
4.What we do not collect
Worth stating plainly, because each of these is something you might reasonably fear:
- No precise location. NearStays never asks your browser or device for your location. The city a search runs in comes from the words you typed, and nothing else.
- No payment information. Nothing on NearStays costs money, so there is no card to store and none is ever requested. Treat any page that asks you for one in our name as fraudulent, and tell us.
- No contacts, photos, files or background microphone access. The microphone is opened only while you hold the voice button, by your browser, after you have granted permission.
- No advertising identifiers, and no ad networks. There are no ads on NearStays and no third-party advertising trackers in it.
- No sale of personal information. We do not sell it and we do not share it for cross-context behavioral advertising, as those terms are defined under California law.
5.Why we are allowed to use it
We use what section 3 describes to operate the service you asked for, to keep it working and secure, to understand which parts of it people actually use, and to answer you when you write to us. In jurisdictions that require a legal basis, ours are: performing the service you requested (search, sign-in, saved listings), our legitimate interest in a working and un-abused product (rate limiting, security logs, product analytics), and your consent where you have given it (using your microphone, leaving an address to be notified).
6.Who else sees it
We use other companies to run NearStays. They process information on our behalf and under contract; none of them is permitted to use it for their own purposes. We do not otherwise share your information, except where the law compels us or to protect the rights and safety of people using the service.
| Provider | What reaches them | Where |
|---|---|---|
| Vercel Hosting | Every request to the site, and the server logs that result. | United States |
| Supabase Accounts and database | Your email address, sign-in codes, display name, saved listings and city requests. | United States |
| PostHog Product analytics | The events in section 8. When you are signed in, your account id and email address. | United States |
| Resend Email delivery | Feedback you send us, and the address you asked us to reply to. | United States |
| Cloudflare Listing photos | Your IP address and which photos your browser requested, since listing images are served from photos.nearstays.com. | United States |
| Vercel AI Gateway Voice search | Your recording and its transcript, passed to the speech and language models behind the gateway. Only when you use the microphone. | United States |
| CARTO Map tiles | Your IP address and which map tiles you loaded, which indicates the area you are looking at. Requested by your browser, directly. | United States |
Two things we rely on that your browser never contacts: OpenStreetMap — which supplies the stations, stores, parks and city boundaries — is queried by our servers, not by you, so it does not see your address. And the fonts on this site are served from our own domain rather than fetched from Google at page load.
7.Cookies
NearStays uses two kinds of cookie and no others. There is no advertising cookie on this site.
- Sign-in cookies, set only once you sign in. They are what keeps you signed in between page loads, and the service cannot offer an account without them. Signing out clears them.
- Analytics cookies, set by PostHog to tell one browser from another across visits. Section 8 says what they record and how to switch them off.
Analytics requests are served from our own domain, under /ingest, rather than from an analytics vendor’s domain. That is a technical choice about reliability, not an attempt to hide the collection — which is why the switch below exists.
8.Analytics, and turning them off
We use PostHog to understand how NearStays is used. What it records, in full: which pages you view; automatic capture of clicks and interactions with the interface; each search you run, including the sentence you typed and the filters parsed from it; searches that failed; listings you opened; listings you saved; cities you requested; whether you used voice, and whether it worked; and errors thrown by the page, with their stack traces. When you are signed in, these are associated with your account id and email address. When you are not, they are associated with a random identifier stored in your browser.
You can turn all of it off, here and now:
Product analytics
Checking this browser…
The choice is remembered in this browser only. Clearing site data, or using a different browser or device, starts over.
9.Voice search
Holding the microphone button records up to fifteen seconds of audio in your browser and sends it to our server, which passes it to a speech-to-text model and then to a language model that rewrites what you said into a search. The result lands in the search box for you to check and edit.
We do not store the audio or the transcript. Both exist only for the length of that one request, in memory, and are gone when it answers. Your browser will ask permission before the microphone opens, and it opens only while you are pressing the button.
10.How long we keep things
- Your account and saved listings — until you ask us to delete them.
- City requests — until we cover that city and have told the people who asked, or until you ask us to remove yours.
- Feedback — it arrives as email and stays in our mailbox, like any other correspondence, unless you ask us to delete it.
- Analytics events — held by PostHog under our project’s retention setting. Ask and we will tell you what it currently is.
- Server logs — kept by our host for a short period, on the order of days, and then discarded.
- Rate-limiting counters — held in memory for a minute to an hour, and lost whenever the server restarts.
11.Your choices and your rights
Wherever you live, you may ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Write to hello@nearstays.com and we will answer within 30 days. We may need to confirm you control the email address the request concerns, since that address is the whole of the identity we hold.
Deleting your account is not self-serve yet. It is a button we have not built. Until it exists, email us and we will delete the account, the profile and every listing saved against it — the same outcome, done by hand.
If you are in California, you have the rights to know, delete, correct and to non-discrimination for exercising them, under the CCPA as amended. We do not sell personal information and do not share it for cross-context behavioral advertising, so there is no opt-out of those to offer. In the last twelve months we collected the categories described in section 3 — identifiers, internet activity, audio when you use voice search, and geolocation only in the coarse sense that a request has an IP address — for the purposes in section 5, and disclosed them to the providers in section 6.
If you are in the EEA or the UK, you may additionally object to or restrict processing we base on legitimate interests, withdraw consent you have given, and complain to your local supervisory authority. Note that NearStays covers United States cities only and is operated from the United States; information you give us is processed there.
12.Security
Sign-in uses a one-time code emailed to you, so there is no password of yours for us to lose. Traffic runs over HTTPS. Access to your saved listings and profile is enforced by the database itself, row by row, and not merely by the interface. Secrets are held as deployment configuration and never reach your browser.
None of that is a guarantee. No service can promise that a determined attacker will never succeed, and we do not. If we ever learn that information about you has been exposed, we will tell you.
13.Children
NearStays is not intended for anyone under 18 and we do not knowingly collect information from children. If you believe a child has given us information, write to hello@nearstays.com and we will delete it.
14.Changes to this policy
When this policy changes we will move the “last updated” date at the top. If a change materially affects information we have already collected from you, we will do more than that — notice on the site, or an email if we have your address.
15.Contact
Bald Cactus, LLC, a Delaware limited liability company
hello@nearstays.com
A postal address is available on request. Terms of use are at nearstays.com/terms.