Privacy policy
ReLease is operated from Berkeley, California. This page says what the site collects, what it keeps, and who else can see it. It covers joinrelease.com and nothing else.
If you are only reading
Reading takes no account and no email. We record usage events so we can tell which buildings people are looking for, including the text typed into the search box. Those events carry no name, no email address, no IP address, and no identifier that links one visit to the next. They go into our own database, not to any analytics vendor. We use no third-party analytics, no advertising pixels, and no session recording.
We read your IP address to apply rate limits. Reading the site never writes it to our database. Applying the limit does hold a scrambled form of it in the server’s memory for the length of the limit window, which is between ten seconds and an hour depending on what you did, and it is discarded after that. The one place we store an IP address is a notify list signup, described below. Our hosting provider records it in its own request logs, as any host does. Two other companies see it while you are only reading, both listed below: Cloudflare, whose anti-bot check loads in your browser on any page carrying the notify form (a search that finds nothing is one) whether or not you use it, and the map tile provider, when a map is on your screen.
If you post a review
You verify an email address first. Some reviews, including every campus dorm review, require a berkeley.edu address. We store a SHA-256 hash of your address, the domain it came from, and the page you were headed to when you verified. We never store the address itself. We also store the review, the years of your tenancy, the unit you tell us you were in if you tell us, when you filed it, and which version of the terms of service you agreed to when you did. The month and year you filed appear publicly alongside the review. The unit does not: it is there so two stays in one building can be told apart, and only a moderator sees it.
If you ask to be notified
The notify list is the one place we keep an email address as you typed it, because we have to be able to send you the message. We store it with what you asked about, and, when you signed up from a search that found nothing, the text you searched for. We also record the IP address and browser the signup arrived from, so that a burst of fake signups can be seen for what it is. Unsubscribing stops the email. It does not delete the row.
Cookies
We set two, and only after you act. A sign-in cookie keeps you signed in for seven days. An admin cookie is for the site operator and lasts twelve hours. Neither is used for advertising, and neither follows you off this site. We set no third-party cookies of our own, and our own code stores nothing else on your device. The one thing on the site that is not ours is the Cloudflare anti-bot check described below. It runs in your browser on the pages that carry the notify form, and Cloudflare may store data on your device in order to run it.
Who else sees it
- Resend sends our email, so it receives your address and the contents of the message.
- Vercel hosts the site and handles the requests that reach it.
- Our database provider stores the records described above.
- Cloudflare runs the anti-bot check on the notify form. Its code loads in your browser from Cloudflare on any page that carries that form, so Cloudflare receives your IP address and details about your browser whether or not you use the form. When you submit the form, we send Cloudflare the result of the check together with your IP address so that it can tell us whether the check was genuine.
- The map background comes from OpenFreeMap. Your browser fetches it directly, so OpenFreeMap receives your IP address, your browser type, and the coordinates of the tiles you are looking at, which show which part of Berkeley you are viewing. It loads only when a map is at or near your screen.
That is the list as the site is built today. We do not sell personal information and we do not share it for advertising.
Do Not Track
Some browsers send a Do Not Track or Global Privacy Control signal. We do not respond to them, because we do not follow you across other sites in the first place. No third party collects information about your activity across other sites through ReLease. Two of them see your IP address in the course of doing their job: the tile provider when it serves you a map, and Cloudflare when it runs the anti-bot check. Neither is given anything that says who you are, and that is the extent of it.
Reviews are not editable, by you or by us
Once you file a review you cannot edit it or take it down, and we do not edit the text of a review either. A record a reviewer can pull down is a record a landlord can pressure them into pulling down. We may still decline or remove a review under the terms, at our discretion.
If you want your account separated from what you wrote, email disputes@joinrelease.com and we will replace the stored hash of your address with a random value. Your reviews stay published, and nothing in our database points from them to your email address again. They remain grouped as coming from one account. That grouping is never shown publicly, and it appears only in the moderation queue while a review is waiting for a decision.
A hash is not anonymity
The hash we store is a plain SHA-256 of your address. University email addresses are guessable, so someone holding our database and a name could test a guess and confirm it. Treat it as a lock on a filing cabinet, not as anonymity. Write reviews you would be willing to stand behind.
Legal process
We do not hand over identifying information in response to a demand letter, an email, or a phone call. Only valid legal process. When one arrives we make reasonable efforts to notify you first, with a copy and time to object, unless we are ordered not to.
If your home address is on a record page
Building pages carry the public record of the building, including the mailing address the county assessor publishes for the parcel. Sometimes that address is somebody’s home.
If you want an address taken off this site, email disputes@joinrelease.com and say so. Include the address as it appears on the page, and the address of the page it appears on, so we can find the right record. You do not have to say why. We act on a demand within 48 hours of receiving it, and we do not put the address back.
California Government Code sections 7928.205 and 7928.215 cover demands of this kind from judges, peace officers, elected and appointed officials, and their families. We answer a demand from anyone whose home address is on a record page, on the same 48 hours, as a matter of our own policy. Nothing here is legal advice, and nothing here says what any other site has to do.
Two things this does not do. It does not remove anything from the county’s own records, which are public and are published by the county, not by us. And it does not remove or change a review: reviews are covered by the paragraphs above.
If you are under 18
California law lets a registered user under 18 request removal of content they posted themselves. Email disputes@joinrelease.com from the address you verified and we will remove it.
How long we keep things
Reviews stay up indefinitely, because the record is the point of the site. Verification records and confirmed notify list entries are kept indefinitely too.
The exception is a notify list signup that is never confirmed. If nobody clicks the link in the confirmation email, the address is deleted thirty days after it arrived, along with the IP address and browser recorded with it. That runs on a daily schedule, not by hand. It is the one thing on the site that is deleted for you, and it exists so that an address someone typed into the form without asking you does not sit here forever.
Changes
When what we do changes, this page changes with it and the date at the top moves. Continued use of the site means you accept the current version.
Contact
Questions about any of this go to disputes@joinrelease.com.