Privacy policy

In short

• No ads and no tracking cookies. The only cookies keep you signed in, so there is no cookie banner.
• Analytics run without cookies and never receive names, email addresses or contact details.
• Listings found in public posts never show the poster's phone number, email address, handle or name. Anyone can have such a listing removed, without proof.
• If you posted a sublet in a Telegram group we read, we may write to you once with a free draft listing. Drafts you do not claim, and posts we did not act on, are deleted after 14 days.
• Our database and photos are stored in the EU.

Who is responsible

The controller under the GDPR is:

[NAME][ADDRESS]Email: [EMAIL]

Write to this address with any privacy question or request.

Visiting the site

The site runs on Cloudflare Workers. To deliver a page, Cloudflare processes your IP address, the page requested, your browser type and the time. Cloudflare keeps technical logs for a few days, which we use to find errors and abuse.

Map tiles, photos and fonts are served from our own domain, not from third-party servers.

Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in a working, secure and consistently displayed site.

Listings from public posts

Many sublets are offered in public posts, for example in Telegram or Facebook groups. Partner services find these posts and send them to us through our Partner API. We turn each post into a short listing so people can find it on the map.

Shown

Type, price, dates, approximate location, a short summary written by AI, up to 4 photos from the post with their metadata (such as GPS location) removed, the name of the group or site where it was posted, its age, and a link to the original post.

Never shown

Phone numbers, email addresses, usernames or handles, the poster's name, and the text of the post. The text is used once to write the summary and is not stored.

Stored, not shown

The poster's handle, if the post has one: it lets the poster claim the listing after signing in with Telegram, and blocks new imports after a removal request. The location text of the post, used to place it on the map.

These listings disappear 10 days after they were posted, or 3 days after the move-in date if that comes first. Their photos are deleted when the listing is hidden or removed.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest, and that of people looking for a place to live, is to find sublets that were offered publicly in one place. We keep only what is needed to find the offer and leave out all contact details, which protects the poster's interests.

Source of the data: public posts, in the group or on the site named on each listing.

Is it your post? Use "Request removal" on the listing; no account or proof is needed. We handle removal requests by hand within 24 hours: the listing and its photos are removed and your handle is blocked from future imports. You can also write to [EMAIL]. If you sign in with the Telegram account that posted the ad, you can claim the listing and manage it yourself instead.

Posts we read in Telegram groups

Besides partner services, we read a few public Berlin sublet groups on Telegram ourselves, with a Telegram account that belongs to the operator. A program on a server in the EU reads new messages in these groups and keeps only posts that look like a sublet offer (a price or dates, at least a few lines). For such a post we store:

• The group, the message's id and time, and a link to it when the group is public.
• The poster's Telegram user id, username and first name, as Telegram shows them in the group.
• The text of the post and up to 4 of its photos, with their metadata (such as GPS location) removed.
• A draft listing that AI (Anthropic, see below) fills in from the text: type, price, dates, deposit, area.

Only the operator sees these posts, in an admin queue that is not public. The operator may send the poster one Telegram message from the same account with a private link to the draft. The draft is not public: it becomes a listing only if the poster opens the link, signs in with that Telegram account and publishes it. "Not interested" on that page deletes the draft.

Posts nobody acted on

Deleted after 14 days, with their text and photos.

Drafts nobody claimed

Deleted 14 days after the message, with their photos. The record of the message then keeps only ids, times and the wording used, to count how many people answered.

Contacted registry

The Telegram user id and username of everyone we wrote to, so nobody gets a second message. Kept until you ask us to delete it; we then keep only the user id, so you are not written to again.

Legal basis: Art. 6(1)(f) GDPR. Our legitimate interest is to offer people who already advertise a sublet in public a free listing, with one message at most. You can object at any time (Art. 21 GDPR): reply to the message, use "Not interested" or write to [EMAIL]. We then delete the post, the draft and its photos, and block your username from future imports.

Source of the data: the public Telegram group named on the draft.

Listing your sublet

When you list your sublet, we store what you enter: type, price, dates, location, description, photos, the first name shown to renters, and the contact details you choose (phone, email, Telegram or Instagram). The listing is public, including that first name and those contact details, so renters can reach you directly. There is no messaging on the site.

Renters see the nearest station or the street without house number, unless you choose to show the exact address.

Photos are resized in your browser before upload, which also removes their metadata such as GPS location. They are uploaded when you add them, before you publish.

While you fill in the form, a draft is kept in your browser's session storage, so it survives a reload or signing in. It is cleared when you close the tab.

You can edit, hide or remove your listing at any time in My sublets. Removing a listing deletes its photos.

Legal basis: Art. 6(1)(b) GDPR, publishing the listing you asked for. You make your contact details public with your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time by editing or removing the listing.

Profiles

A profile is optional. If you make one, we store what you enter: a photo, your first name, "About me" and, in the renter part, what you do in Berlin, why you need a sublet, what you are looking for, tags you pick and the languages you speak. The profile also shows which accounts you signed in with (Telegram, Google) and since when you are a member.

Your profile has a random, unlisted link. It is not shown in search engines, sitemaps or on the map. People see it only when you send them the link, or as "About the host" on your own listings. You can get a new link (the old one stops working) or delete the profile at any time; deleting it deletes its photo.

Legal basis: Art. 6(1)(b) GDPR, providing the profile you asked for.

Intros between renters and posters

Posters can choose to receive intros through the site instead of showing their contact details. When you send an intro, we store it with the listing:

Stored

Your message (up to 600 characters, links other than your profile link removed), the name and the one contact you give (Telegram username, phone number or email address), your profile link if you have one, your account if you are signed in, and when it was sent, delivered and answered.

Delivered

To the poster's own Telegram chat with our bot, together with your profile card. The poster sees your contact so they can reply. Their contact details are never shown to you.

Posters can mark an intro as not a fit or report it. A reported intro is hidden from the poster and sent to us by email for review. When you delete your account, the text, name and contact of every intro you sent or received are deleted; the row stays, so that later both sides can be asked whether the stay happened.

An intro you have not sent yet is kept in your browser (session storage) while you sign in. Your browser also remembers on which listings you reached out, in local storage.

Legal basis: Art. 6(1)(b) GDPR, delivering the intro you send, and Art. 6(1)(f) GDPR for the safety measures, our and the posters' interest in protection from spam and abuse.

Spam protection (Cloudflare Turnstile)

When you send an intro without signing in, the form runs Cloudflare Turnstile, which checks in the background that a person is sending it. Turnstile is loaded from challenges.cloudflare.com and processes your IP address, information about your browser and device and how the page is used; it does not show ads or build profiles for marketing. We send the resulting token to Cloudflare to verify it and store nothing from it. Turnstile runs only on that form; signed-in senders and other pages do not load it.

Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in keeping automated spam from posters. Cloudflare's privacy policy applies to its processing.

AI processing

We use Claude, an AI model by Anthropic, in two places:

• Paste-to-fill: when you paste an ad into the listing form, the text is sent to Anthropic to fill in the form. We do not store the pasted text; we only record how many tokens were used and which fields stayed empty.
• Summaries: the text of a public post is sent to Anthropic once to write the summary of a listing. We do not store it.
• Drafts from Telegram groups: the text of a post we read is sent to Anthropic to fill in the draft listing. The post and the draft are deleted as described above.

Anthropic processes the text on our behalf. Legal basis: Art. 6(1)(b) GDPR for paste-to-fill, which you start yourself, and Art. 6(1)(f) GDPR for summaries. No decisions with legal effect are made automatically.

Signing in and your account

You need an account only to publish, save listings, set up search alerts or claim a listing. Browsing and contacting posters work without one.

Google

Your name, email address, profile picture, Google account id, and the sign-in tokens Google returns.

Telegram

Your Telegram id, first and last name, username and profile photo link, if set. No email address unless you add one for notifications.

Sessions

Your IP address and browser with each session, to keep sessions secure. A session ends when you sign out or 30 days after your last visit.

The Telegram login button is loaded from telegram.org when the sign-in dialog shows it, so Telegram receives your IP address.

Legal basis: Art. 6(1)(b) GDPR, providing the account you asked for.

Deleting your account: use "Delete account" at the end of My sublets. Deletion is immediate. Your saved listings, alerts, notification settings and sessions are deleted; your listings are hidden and their contact details and photos deleted; feedback you sent is kept without your account, name or email. Your profile and its photo are deleted, and the text, name and contact of your intros are removed.

Saved listings, search alerts and messages

• Saved: the listings you saved.
• Search alerts: the filters you saved, instant or daily, and when we last sent.
• Channels: your email address or Telegram chat id, and whether it is verified.
• Messages: we log which message went to whom, about which listing, and whether its link was opened, to avoid repeats. The log is deleted after 60 days.

Posters also get messages about their own listings: availability checks every 10 days, and notices when a listing goes live, is hidden or can be claimed.

Emails are sent through Resend from its EU region. Telegram messages are sent by our bot through Telegram. Every message has a one-tap link to pause it, and you manage everything under Notifications.

Legal basis: Art. 6(1)(b) GDPR.

Reports and feedback

When you report a listing (already taken, wrong info, request removal), the listing, the kind of report, your reason and note, and your email address if you give it are emailed to us; we do not store the report on the site and handle it by hand.

The feedback form stores your message, the page you were on, and your name and email address if you give them.

Both reach us by email through Resend so we can act on them; the email stays in our inbox as long as we need it to handle the request. Legal basis: Art. 6(1)(f) GDPR, handling your report and keeping listings accurate.

Cookies and browser storage

We only use cookies that are strictly necessary for a service you asked for, so no consent is needed (§ 25(2) no. 2 TDDDG). They are set only when you sign in.

better-auth.session_token

Keeps you signed in, for up to 30 days. On HTTPS its name starts with __Secure-.

better-auth.session_data

A signed copy of your session, valid for 5 minutes, so pages load without a database lookup.

Sign-in cookies

Short-lived cookies that protect the round trip to Google while you sign in.

Some state stays in your browser and is not sent to us automatically:

• Session storage: your listing draft, an intro you are writing, and a save or search alert you started while signed out, so it can finish after signing in. Cleared when you close the tab.
• Local storage: after a Telegram sign-in, the ids of listings you can claim; the listings you reached out on, with the date.

Analytics and error monitoring

We use PostHog (EU cloud) to count page views and a few actions, such as map loaded, filter changed, listing opened, contact clicked and listing published. PostHog runs without cookies and stores nothing on your device. To count visits, it computes a daily changing value from your IP address and browser on its servers. Session recording and automatic click tracking are off. We never send names, email addresses or contact details; a few events, such as a new sign-up, carry your account id, a random string.

We use Sentry to find and fix errors. When something breaks in your browser or on our server, Sentry receives a technical report: error message, page, browser and operating system. Sentry may also process your IP address.

Legal basis: Art. 6(1)(f) GDPR, our legitimate interest in understanding how the site is used and keeping it working. You can object at any time by writing to [EMAIL].

Service providers and where data is stored

These providers process data on our behalf, under data processing agreements:

Cloudflare

Hosting, edge cache and KV storage; photos in R2 with EU jurisdiction; Turnstile spam protection.

Neon

Database, hosted in Frankfurt (AWS eu-central-1).

PostHog

Analytics, EU cloud.

Resend

Email delivery, EU region.

Sentry

Error monitoring.

Anthropic

AI processing (paste-to-fill, summaries and drafts from Telegram posts), USA.

[VPS PROVIDER]

The server in the EU that reads the Telegram groups.

Google and Telegram are separate providers when you sign in with them, when we send you Telegram messages, and for the groups we read. Their own privacy policies apply to what they process.

Transfers outside the EU

Some providers are based in the USA or may process data there: Anthropic, Cloudflare, Sentry, Google, and the US parent companies of PostHog and Resend. Such transfers rely on the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

How long we keep data

Account

Until you delete it. Deletion is immediate.

Your listings

Until you remove them or delete your account. Photos are deleted on removal.

Listings from public posts

Shown for at most 10 days. Photos are deleted when the listing is hidden or removed; the rest is kept so a repost of the same ad is recognized.

Removal blocklist

Handles stay blocked from import. Write to us to lift a block.

Profile

Until you delete it or your account.

Intros

Until either account is deleted; then text, name and contact are removed and only the keyed hash stays, for blocks.

Telegram posts nobody acted on

14 days.

Unclaimed drafts from Telegram posts

14 days after our message.

Contacted registry

Until you ask us to delete it; the Telegram user id stays so you are not written to again.

Search alerts

Until you delete them.

Message log

60 days.

Reports and feedback

Reports are not stored on the site; their email is kept as long as needed to handle it. Feedback as long as needed to handle it; anonymized when you delete your account.

Rate limit counters

An hour, a day for intro limits.

Pasted text and post text

Not stored.

Your rights

You have the right to:

• access your data (Art. 15 GDPR)
• have it corrected (Art. 16) or deleted (Art. 17)
• restrict its processing (Art. 18)
• receive it in a portable format (Art. 20)
• object to processing based on legitimate interest (Art. 21), including listings from public posts, posts we read in Telegram groups and analytics
• withdraw consent at any time, without affecting what happened before (Art. 7(3))

Write to [EMAIL]. You can also complain to a data protection authority, for example the Berlin Commissioner for Data Protection and Freedom of Information (datenschutz-berlin.de).

Changes

We update this policy when the site changes. The date at the top shows the current version.