Privacy Policy

The short version:

• We collect the information we need to verify your identity and report your rent payments to credit bureaus.
• We only share your data with the partners required to deliver this service (credit bureaus, payment processor, identity verification, SMS).
• We do not sell your personal information.
• We only report positive, on-time rent payments — never missed or late ones.
• You can ask us to delete your data at any time after you cancel.
• If you live in California, Virginia, Colorado, or other states with privacy laws, you have specific rights (see Your Privacy Rights).

Who is responsible for your data: JD Network Consulting LLC (dba WeReportYourRent), a Florida limited liability company ("WeReportYourRent," "we," "us"). We are responsible for the personal information described in this policy.

This summary is for convenience. The full policy below is what governs our relationship.

We collect only the information needed to verify your identity, accept payment, and report your rent to credit bureaus.

Identity Information

• First and last name
• Date of birth
• Email address
• Mobile phone number (used for one-time verification codes)
• Current residential address

Social Security Number and full date of birth. Credit bureaus require these to verify who you are. Our rent-reporting partner (Piñata) collects your SSN directly in its own identity-verification step; we do not receive it. We ask for your SSN ourselves only if our credit-data partner (CRS) cannot verify you without it. In that case the values are encrypted in your browser before they leave your device. Our main application only passes the encrypted value along and cannot read it; it is never written to our main database or logs. It is held, encrypted, in a separate identity service that exists only to send it to CRS. It is deleted 90 days after your membership ends.

Lease & Rent Information

• Monthly rent amount, lease start and end dates, rent due day
• Your landlord's name, phone, and email (for verification)

We do not store a copy of your lease agreement. If lease details need to be confirmed, that happens inside our rent-reporting partner Piñata's flow on your dashboard, and any document is provided directly to Piñata.

Payment Information

• We do not see or store your full credit card number. Payments are processed by Stripe, which is PCI DSS Level 1 certified.
• We do receive Stripe-issued identifiers (customer ID, subscription ID, last 4 of card, card brand, billing ZIP) so we can show your billing history.

Technical Information

• IP address, browser type, device type, and approximate location (for security and fraud prevention)
• Pages you visit on our site and timestamps
• Cookies (see Cookies & Tracking)

We use the information above only for the following purposes:

• Identity verification — to confirm you are who you say you are, as required by federal law before reporting credit information.
• Rent reporting — to send your on-time rent payment history to our rent-reporting partner, Piñata, which furnishes it to the credit bureaus.
• Account management — to provide your dashboard, score updates, and customer support.
• Billing — to charge your $1.00 trial fee and recurring subscription via Stripe.
• Security — to detect fraud, prevent abuse, and protect our service and other users.
• Legal compliance — to meet our obligations under the Fair Credit Reporting Act (FCRA), state privacy laws, and lawful requests from authorities.
• Service communications — to send transactional emails and SMS (verification codes, billing receipts, dispute updates). You can opt out of marketing, but not transactional, messages.

We do not use your information for advertising profiling, behavioral targeting, or any kind of "data product."

We share information only with the partners listed below, and only the minimum data needed for each.

We do not sell your personal information. We do not share your data with advertisers, data brokers, or marketing companies.

We may disclose information when legally required — for example, in response to a valid subpoena, court order, or to protect against fraud.

Our service involves two separate permissions under the Fair Credit Reporting Act, described in Section 6 of our Terms of Service:

• Consent to obtain your credit report — your written instruction under FCRA Section 604(a)(2) that lets our credit partner, CRS, obtain your credit report and scores so we can show them to you.
• Authorization to report your rent — your permission for Piñata, our rent-reporting partner, to verify your tenancy and report your on-time rent payments to the credit bureaus. Piñata furnishes this data to the bureaus.

• We report only positive, on-time payments. We never report late or missed payments. This is a core product principle.
• Your consent is logged with a timestamp, IP address, and the consent version you accepted.
• You can revoke your consent at any time by cancelling your subscription. Once cancelled, no new rent data is sent for reporting to the bureaus, though previously-reported data may remain on your credit report per bureau retention policies (typically 7 years for closed tradelines).
• If you believe reported rent data is inaccurate, you may dispute it directly with the credit bureau, or contact Piñata at support@pinata.ai for credit reporting inquiries. Disputes are investigated within the time limits the FCRA sets.

For more on FCRA compliance, see our Compliance page.

All payment processing is handled by Stripe, a PCI DSS Level 1 certified payment provider. WeReportYourRent never sees or stores your full credit card number, CVV, or expiration date.

Stripe's privacy practices are governed by their own Privacy Policy.

The information we receive from Stripe — to display your billing history and manage your subscription — is limited to:

• Stripe customer and subscription identifiers
• Card brand, last 4 digits, expiration month/year
• Billing ZIP and country
• Invoice amounts, dates, and statuses

• Active accounts: we keep your data for as long as your account is active.
• After cancellation: we keep your account record for 7 years for legal, tax, and FCRA audit-trail reasons.
• Lease records: lease details (dates, rent amount — never the document itself, which we do not store) are retained for 7 years after the lease end date.
• Payment records: retained for 7 years per IRS / tax requirements.
• OTP codes: automatically deleted after 5 minutes.
• Marketing data: deleted upon request or 18 months of no activity, whichever is sooner.

You may request deletion of personally identifying information at any time — see Your Privacy Rights.

Depending on where you live, you have certain rights regarding your personal information.

All Users — Federal Rights

• Right to access: request a copy of the personal data we hold about you.
• Right to correct: ask us to fix data that is inaccurate.
• Right to delete: ask us to delete your data (subject to legal retention requirements).
• Right to FCRA dispute: dispute the accuracy of rent data reported to a credit bureau for you (see Credit Bureaus & FCRA above).

California Residents (CCPA / CPRA)

You have additional rights, including the right to know what personal information we collect, the right to delete, the right to correct, the right to opt out of "sale" or "sharing" of personal information (we don't do either), and the right to non-discrimination for exercising these rights.

Virginia, Colorado, Connecticut, Utah, and other state-privacy-law residents

You have similar rights under your respective state laws (VCDPA, CPA, CTDPA, UCPA, etc.), including access, deletion, correction, and opt-out of targeted advertising.

How to Exercise Your Rights

You have two ways to act on your access + deletion rights:

• Self-serve (recommended; identity is verified by your active session):
  • Right to know / right of access: log in, open your profile, and use the "Download my data" button. We send a JSON file containing every record we hold about you (subscriptions, payments, leases, consent history, every action we've taken on your account, etc.). Programmatic equivalent: GET /api/account/export with your session bearer token.
  • Right to delete: the same profile page has a "Delete my account" flow. Programmatic equivalent: POST /api/account/delete with a typed confirmation phrase. Some data is retained in anonymized form for legally required record-keeping (we tell you which).
• Email request: send a message to privacy@wereportyourrent.com from the email associated with your account. We respond within 45 days. We verify your identity before fulfilling any request.

• Encryption in transit: TLS 1.3 on every connection. HSTS is enforced.
• Encryption at rest: Cloudflare D1 (SQLite) and R2 (object storage) encrypt data at rest by default.
• SSN handling: your Social Security Number is encrypted in your browser before it leaves your device. Our main application cannot read it and never stores or logs it. If we ask for it (only when our credit-data partner cannot verify you without it), it is kept, encrypted, in a separate identity service that has no way to read it back out, and is released only to CRS for identity verification. Our rent-reporting partner collects your SSN directly; we do not receive it.
• Password hashing: PBKDF2 with a per-user salt. We cannot recover your password — only reset it.
• Rate limiting: OTP, login, and signup endpoints have strict rate limits to prevent abuse.
• Audit logging: sensitive actions (consent, data changes, reports) are recorded in an immutable audit log.
• Least-privilege access: only the engineers needed to operate the service can access production data, and every access is logged.

For full technical details, see our Compliance page.

We use a small number of cookies and similar technologies, only as needed:

• wryr_audience — remembers which marketing variant you arrived through (30 days)
• wryr_vid — anonymous visitor identifier used to aggregate site analytics (1 year)
• sessionStorage: wryr_sid — per-tab session identifier used to group page views into a single visit
• localStorage: wryr_token, wryr_user, wryr_signup_data, wryr_utm, wryr_exit_dismissed_at, wryr_exit_submitted — keeps you signed in (token + user record), preserves signup progress, remembers the marketing source you arrived from, and tracks whether you've already seen our exit-intent offer. Note: wryr_token is stored in localStorage (not as an HttpOnly cookie) so it is readable by JavaScript on our domain — we plan to migrate to an HttpOnly cookie post-launch.

First-Party Visitor Analytics

We collect aggregated, privacy-preserving analytics about who visits our site, what pages they view, and which calls-to-action they click. This includes:

• Pages viewed, time on page, scroll depth, and call-to-action button clicks
• UTM campaign parameters from links you clicked to arrive here
• A daily-rotating, salted SHA-256 hash of your IP address and user-agent string (we do not store your raw IP)
• Coarse device/browser information (mobile vs. desktop, browser family) derived from the user-agent

If you later create an account, we link your prior anonymous visitor identifier to your user record so we can understand the path that led you to sign up. You can request deletion of this linkage at any time (see "How to Exercise Your Rights" above).

Product Analytics & Session Replay (PostHog)

We use PostHog to understand how people use our site and to find problems. PostHog records page views, clicks and masked session replays. In replays, everything you type into a form and the text on the page are masked before they leave your browser, and we strip tokens, email addresses and phone numbers from page addresses. PostHog does not load on admin pages, our API, or the unsubscribe and password-reset pages. Once you create an account, your PostHog activity is linked to your account ID (not your name or email).

Affiliate Referral Tracking (TrackDesk)

If you arrive through a link from one of our affiliates, a TrackDesk script reads the referral code in that link so we can credit the affiliate. When you complete certain sign-up steps (verifying your contact details, and later completing identity verification), we send TrackDesk a one-time event ID so the referral can be counted. We do not send TrackDesk your name, email, phone number or credit information.

Exit-Intent Email Capture

If you appear to be leaving our site without signing up (for example, you move your mouse toward the browser tab bar, or switch away from the tab on mobile), we may show a modal offering a free credit-building guide in exchange for your email address. Submitting this form is entirely optional. If you submit, we:

• Store your email, the page you were on, and the marketing source you arrived from in our email_captures table
• May send you occasional educational emails about rent reporting and credit building (you confirmed marketing consent at submission)
• Honor unsubscribe requests immediately via the one-click link in every email (/api/captures/unsubscribe)

If you dismiss the modal without submitting, we remember that decision for 7 days so we don't show it again immediately.

Third-Party Marketing Pixels & Analytics (Conditional)

When configured by us, our marketing pages (the home page and pricing page only — never logged-in or checkout pages) may load the following third-party tags so we can measure ad effectiveness, understand aggregate visitor demographics, and reach people who visited us before:

• Meta Pixel (Facebook/Instagram advertising) — when enabled, sends Meta a page-view signal and, only if you submit an email through our exit-intent modal or sign up, a SHA-256 hash of your email for ad-conversion matching (Meta Cookie Policy)
• Google Ads remarketing tag (gtag.js with anonymize_ip: true) — when enabled, sends Google a page-view signal and a SHA-256 hash of your email (only after submission/signup) for ad-conversion matching (Google Ads Policy)

These tags are never loaded on dashboard, admin, profile, checkout, signup, or landlord-portal pages. We honor the browser's Do Not Track header — if your browser sends DNT, we will not load these pixels for you. You can also block them at the browser or extension level (uBlock Origin, Privacy Badger, etc.) without affecting site functionality.

We do not sell your personal information to advertisers, and we do not use behavioral advertising trackers beyond the conditional Meta/Google tags described above. PostHog and TrackDesk, described above, are used for analytics and referral attribution, not for advertising.

Our service is intended for adults aged 18 and over. We do not knowingly collect personal information from anyone under the age of 18. If you believe a child has provided us with personal information, please contact us and we will delete it.

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of the page. For material changes, we will tell active users at least 30 days before the change takes effect, unless the law requires a different notice period, by email and by a notice in your account. If a change expands how we use or share your personal information, we will ask for your consent in your account before it applies to you, and we keep a record of that consent.

If you have any questions about this Privacy Policy or how we handle your data, please contact us:

• Privacy inquiries: privacy@wereportyourrent.com
• General support: support@wereportyourrent.com
• Mailing address: 1242 State Ave, Ste I PMB 4005, Marysville, WA 98270-3672

For credit-report disputes specifically, you may also contact the bureau directly: Experian, Equifax, or TransUnion.