Privacy policy.

Information we process

For accounts, we store your email address, a Google account identifier if you use Google sign-in, account creation and login times, API-key metadata, and credit balances. We also process information you submit to the service, such as hotel search parameters.

Our infrastructure processes connection information such as IP addresses and request times. The application uses hashed identifiers to limit repeated login attempts and help prevent abuse.

Google sign-in

Google sign-in requests only openid, email, and profile. Google may return your name, email address, profile picture, and account identifier. HotelUse retains your verified email and account identifier to create your account and sign you in; it does not retain your Google name or profile picture.

HotelUse does not request access to Gmail, Drive, Calendar, contacts, or other Google account content. We do not sell Google user data, use it for advertising, or use it to train AI models. HotelUse’s use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

How information is used and shared

We use account information to sign you in, manage access and credits, send requested login codes, operate the service, and investigate security or support issues.

Service providers process information needed for their work: Google provides sign-in; Resend delivers login emails and receives the recipient address and code; Porter and Google Cloud host the service and its infrastructure. Authorized operators may access information when needed for support, maintenance, or security. Information may also be disclosed when required by law.

Cookies and storage

Essential cookies keep you signed in and bind login attempts to your browser. Sign-in sessions expire after seven days; login codes expire after ten minutes. The website also uses local browser storage for its optional dashboard simulation. Clearing that storage removes the local simulation, but does not delete your server account.

Public website connections use HTTPS. Session tokens and API keys are stored as hashes on the server. Keep your API keys private.

Retention and your choices

We retain account information while your account remains active. Login challenges, sessions, and rate-limit records are short-lived. You can sign out, revoke API keys from your dashboard, or remove Google access in your Google account settings.

To request access, correction, or deletion of your account information, email leo@hoteluse.dev from your account address. We may need to verify your identity. Limited information may be retained where required for security or legal obligations. Removing Google access alone does not delete your HotelUse account.

Updates

We will update this page when our data practices change and revise the date above.