Privacy Policy

When you create an account, we collect your email address and password (handled by our authentication provider, Supabase — we never see or store your password in plain text). Businesses and rental hosts additionally provide a business name, description, city/state, and contact phone number when they set up a profile.

Listing photos, profile photos, and business logos you upload are stored in our file storage and shown publicly on your listing. Businesses may also upload license and insurance documents to verify their listing — these are stored privately and are not shown to other users.

Search results are filtered by the city and state you enter — this is a text search, not device location. If you use "search near me" or a similar feature, we request your device's coarse or precise location (you can decline this) and send those coordinates to OpenStreetMap's Nominatim service to resolve them to a city and state; we don't store your raw coordinates.

When you book a vendor or a rental, message a business, or leave a review, we store that booking, message, and review data so both sides of the transaction can see it. A vendor sees messages and bookings from their own clients; a client sees their own bookings and messages. Database-level access rules prevent any account from reading another account's private booking or message data.

Payments — booking deposits, balances, and invoices — are processed by Stripe. Wormcatch never receives or stores your full card number; Stripe handles that directly and gives us only a confirmation that payment succeeded, and enough transaction detail to show you a receipt and manage refunds.

Rental bookings (vehicles and vacation homes) require identity verification through Stripe Identity before a security deposit is authorized. That process — your government ID and a selfie — is handled entirely by Stripe; Wormcatch receives only a verified/not-verified result, not a copy of your ID or photo from that step.

Separately, some rentals ask you to upload a photo of your driver's license or ID directly as part of the booking form. That file is stored in a private file store — only you and that specific host can access it, and only for that booking.

Businesses that accept payments connect a Stripe Express account to receive payouts. That onboarding (business details, bank account, tax ID) is completed directly with Stripe — Wormcatch stores only your Stripe account reference and its onboarding status.

If you enable notifications, we store a device token (native app) or a browser push subscription (web) so we can deliver booking, message, and payment alerts. You can revoke this at any time in your device or browser notification settings, which invalidates the token on our end.

We share data only as described above: Stripe for payments, payouts, and identity verification; OpenStreetMap's Nominatim for location lookups you initiate; and Supabase, our database and authentication infrastructure provider. We do not sell your data, and we do not use third-party advertising or analytics trackers.

We keep your account data for as long as your account is active. To request deletion of your account and associated data, email us at privacy@wormcatch.com. Some booking and payment records may be retained longer where required for tax, fraud-prevention, or legal-dispute purposes.

Wormcatch is not directed at children, and accounts are not intended for anyone under 18. If you believe a child has provided us information, contact us and we'll remove it.

Questions about this policy or a request about your data can be sent to privacy@wormcatch.com, or through our Support page.