Privacy Policy

Last updated: 2026-11-05

Wythaste is operated by Mynd Grid Inc., Toronto, Ontario, Canada ("we", "us"). Wythaste is a Mynd Grid product. This policy explains what we collect when you use Wythaste, why, who we share it with and the choices you have. We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

1. What we collect

Your account. Your email address, a handle (your public name, which is also your referral code) and a password, which we store only as a one-way hash. Optionally, a display name and a profile photo. When you sign up we record the date and the IP address from which you accepted these terms and this policy.

What you do on Wythaste. The listings you post (title, description, photos, price, deposit, what you would trade for and a place label you choose), your bookings (dates, prices and any reason you give for a cancellation or dispute), the messages and photos you send in chat, the reviews you write, the people and listings you report or block, the listings you save, feedback you send us and your email notification settings.

Location. If you tap "Use my location", your browser shares your device's location with us once. We turn it into a neighbourhood or postal-area label and keep the label, not your exact position. A listing is shown on the map at the position of its label.

Phone number. Optional. It is needed to post a rent or hire listing only while phone verification is switched on, and we use it to text you a verification code.

Identity check. Optional. If you choose to get the "Verified" badge, Stripe Identity collects and checks your government ID. We receive only whether the check passed.

Payments. If you pay or get paid, Stripe holds your card and bank details. We keep the account IDs Stripe gives us and whether your payouts are set up. We never see or store your full card number.

Security. For each signed-in session, the IP address and the type of browser; for each sign-in attempt, the email entered, the IP address and whether it worked. If you turn on two-step sign-in, an encrypted secret for your authenticator app.

2. Why we use it

To run your account and sign you in; to show your listings and let neighbours find, book, pay and message each other; to hold a payment until a booking is done and then pay the owner; to email you about bookings, messages and your account (you can turn some of these emails off in Settings); to keep Wythaste safe with rate limits, a CAPTCHA, verification, reports, blocks and moderation; to resolve disputes; to run the referral programme; and to find and fix errors.

We do not sell your personal information, and we do not use it for advertising.

3. Who we share it with

Other people on Wythaste see your public profile (handle, display name, photo, reviews and badge), your listings with their place label, and what you send them in chat or in a booking.

Service providers process information for us, under their own privacy terms:

• Stripe: payments, payouts and the optional identity check (your email, payment and payout details, ID documents).
• Twilio: sends phone verification codes (your phone number).
• Resend: sends our emails (your email address and the email itself, which can include a preview of a message sent to you).
• Cloudflare: stores and serves photos, and runs the CAPTCHA on sign-in and feedback pages (which receives your IP address).
• Mapbox: turns place names and locations into map positions, and serves map images to your browser.
• OpenAI: if you use AI autofill when you create a listing, the listing's photos and the text you entered are sent to OpenAI to suggest a title and description. Nothing is sent if you don't use it.
• Sentry: receives error reports so we can fix bugs. We set it not to collect cookies, passwords or sign-in headers.
• Backblaze: stores encrypted nightly backups of our database.
• Hostinger: hosts our servers.

We may also disclose information when the law requires it, or to protect the safety of people on Wythaste or others.

4. Where your information is stored

Our servers are in the United States, and our service providers may process information in the United States and other countries. Information held outside Canada is subject to the laws of the country it is in, which may allow authorities there to access it.

5. Cookies and local storage

One sign-in cookie keeps you signed in for up to 30 days. Cloudflare's CAPTCHA may set its own cookie on sign-in and feedback pages. Your browser's local storage keeps your light or dark theme and the last neighbourhood you chose. We do not use analytics or advertising cookies.

6. How long we keep it

When you delete your account (Settings, then Account; not possible while you have an open booking, a dispute or a Stripe balance), it is deleted 30 days later, and signing back in before then cancels the deletion. We then remove your name, email address, handle, photo, phone number and password, delete your customer record at Stripe, archive your listings and end your sessions.

Some records stay after that, without your name or contact details: bookings, payments, reviews and disputes, which we and the other person need for accounting, tax and their own records, and the record that you accepted these terms (without the IP address).

Messages and photos. Chat messages and the photos sent in them stay in the conversation, because the other person is part of it. Photos uploaded to listings or chat are not deleted from our storage when a listing is archived or an account is deleted.

Security and moderation records (sign-in attempts, reports and feedback) are kept to protect Wythaste. Backups are kept for 30 days.

7. Your choices and rights

You can see and change your profile and notification settings in Settings. You can download a copy of your data in Settings, under Privacy and data: your profile, listings, bookings, reviews, disputes, consent records and sessions (chat messages are not included). You can deactivate or delete your account in Settings, under Account.

You can ask us for access to, or correction of, the personal information we hold about you, or withdraw your consent, by writing to the address below. If you are not satisfied with our answer, you can complain to the Office of the Privacy Commissioner of Canada.

8. Security

Passwords are stored as one-way hashes; hidden location data (EXIF) is removed from photos when you upload them; connections are encrypted; two-step sign-in is available to you and required for our staff; backups are encrypted. No system is perfectly secure. If a breach creates a real risk of significant harm to you, we will tell you and the Privacy Commissioner, as the law requires.

9. Age

Wythaste is for people 18 and over.

10. Changes to this policy

When we change this policy we post the new version here with a new date, and if a change is significant we tell you by email or in Wythaste.

11. Contact

Mynd Grid Inc., for Wythaste: support@wythaste.com