Privacy Policy

Last updated: October 13, 2026

This policy explains what information The Unit File collects, how we use it, who we share it with, and the choices you have. It covers www.theunitfile.com (the "site").

The site is run by The Unit File LLC, an Indiana limited liability company ("The Unit File," "we," "us," "our"). Questions or requests: legal@theunitfile.com.

---

The short version

• You don't need an account to file a report or share what you paid.
• Your name is never shown on a report. But what you write is public. We don't store your IP address or device details with your report. Our host and our spam limits see your IP address briefly to deliver the site and block abuse (see Sections 1 and 10).
• We don't currently use advertising pixels or tags on the site. We may advertise the site on other platforms. If we ever add advertising pixels or tags, we'll update this policy first, give you a "Do Not Sell or Share" opt-out, and honor Global Privacy Control (GPC) signals.
• We do not sell personal information.
• Landlords can't pay us to remove or bury reports, and we don't give landlords information about who wrote a report.
• If you manage a property and open a management account, we collect your name, organization, work email and proof of authority to confirm you can respond for a building. Only your organization's name and your responses are public (see Section 14).

---

1. Information we collect

Information you give us

When you file a report. Reports can include:

• the building you're reporting on;
• 1–5 ratings (for example, management, maintenance, noise, safety, value, amenities and pests);
• whether you'd sign again;
• yes/no and multiple-choice answers (for example, whether your deposit was returned, parking cost and garage);
• tags and free-text notes (for example, "What you wish you knew"); and
• one optional photo (JPEG, PNG, WEBP or GIF, up to 5 MB).

When you share what you paid (optional). On the report form or on our Add what you paid page, you can choose to share rent details such as the year or lease start month, lease length, floor plan and the monthly rent you paid.

When you sign in (optional). Sign-in is handled by Clerk. If you sign in, Clerk collects and stores your sign-in details, such as your email address, the sign-in method you choose (for example, Google), and any name or profile photo that comes with it. We store only a Clerk account ID, linked to things you save while signed in (like a shortlist, building watches, preferences and "helpful" votes). We don't link your account to reports you file. If you open a management account, we collect more, as described in Section 14.

When you contact us. If you email us, we get your email address, your message and anything you attach.

When you ask us to add a building. If you use our request form, we get the building details you enter and the email address you give us so we can follow up.

Please don't put personal information in reports or photos. Don't include your name, anyone else's name, unit numbers, phone numbers or similar details. If you do, it may become public.

We don't verify renters. We don't ask for leases, bills or other proof that you lived somewhere. An earlier, optional verification step has been turned off and no longer accepts anything. We don't keep email addresses or verification records from it, and we never kept copies of uploaded documents.

Information we collect automatically

Technical and security data. When you use the site, your browser sends us your IP address, browser and device information (such as browser type, operating system and user agent), and the date and time. When you submit a report or rent, we also check spam signals, such as how long the form took to fill out and whether a hidden "honeypot" field was filled in.

Here's what we do with it:

• We don't store your IP address, device details or spam signals with your report or rent. They aren't saved in the database alongside what you submit.
• Rate limits: to limit how often one IP address can submit, our server holds your IP address in temporary memory for up to 24 hours. It isn't written to our database.
• Our host's logs: our hosting provider, Vercel, processes IP addresses to deliver the site and keeps request logs for a limited time under its own policies.

Our own page-view counts. We count page views ourselves. For this count we record only the page path and a daily total. We don't store your IP address for this count, and we exclude known bots.

Hosting-provider analytics. We use Vercel Web Analytics, a tool from our host, to see overall site traffic. Vercel says this tool doesn't use cookies, identifies visits only by a temporary hash of the request that it discards after 24 hours, and gives us only combined statistics (such as page, referrer, country or region, browser and device type).

Cookies and similar tools. See Cookies and similar technologies below.

Information from others

• Sign-in provider (Clerk): account details if you sign in.
• Advertising platforms: if we advertise on other platforms, they may give us summary reports about how our ads performed (for example, how many people saw or clicked an ad).
• Public data about buildings: our list of buildings comes from public listings and HUD data. This is information about buildings and companies, not about you.

2. What's public

• Public: your report (ratings, answers, tags and text), approved photos, and the date of the report. We don't fact-check reports, and they carry no verification label.
• Public, combined: your ratings and answers also count toward the building's Unit Score and, if public listings show the building under a management company, that company's score.
• Shown only in combined form: rent you share. A year's rent figure appears only after at least 3 renters report it for that year (at least 5 on a unit's page), and we show the middle (median) amount, rounded to the nearest $25, not individual amounts. Below 5 renters we don't show the exact count. Anyone can see these combined figures, whether or not they've shared rent. In a small building, someone who knows the other renters, or what they pay, may be able to estimate what you paid. Leave it out if that worries you.
• Responses from management: the response text, the "Response from management" label, the organization's name and the date are public (see Section 14).
• Never shown: your name, email address, IP address and device details.

Even without your name, someone who knows you may be able to guess who wrote a report from the details in it. Leave out details you don't want linked to you.

3. How we use information

We use information to:

• run the site, show reports, and calculate Unit Scores and rent figures;
• review photos for privacy and our photo rules before they appear, and moderate reports (photo approval isn't a check that a photo or report is accurate);
• detect and prevent spam, fake reports, abuse and fraud;
• handle disputes, takedown requests and legal claims;
• respond to your messages and requests;
• understand how the site is used and fix problems;
• advertise the site on other platforms and see how those ads perform (see Section 4);
• protect the rights, safety and property of our users, the public and The Unit File; and
• comply with the law.

We don't use your information to make decisions about you that have legal or similarly significant effects, such as housing, credit or job decisions.

4. Advertising and measurement

We may advertise The Unit File on other platforms, such as social media and search sites.

We don't currently use advertising pixels, tags or advertising cookies on our site. That means ad platforms don't collect information about what you do on our site through tools we've added. If you see or click one of our ads on another platform, that platform's own privacy policy covers what it collects there. It may give us summary reports about how our ads performed. You can manage ad settings in your account with each platform.

We never send the contents of your report, your rent amount or your photo to advertisers.

If we ever add advertising pixels or tags to our site, we will first:

• update this policy to say which tools we use and what they collect;
• give you a "Do Not Sell or Share" opt-out; and
• honor Global Privacy Control (GPC) signals as a request to opt out.

Because we don't use these tools today, we don't sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising, as those terms are used in state privacy laws such as the California Consumer Privacy Act.

5. Who we share information with

We do not sell personal information. We share information only as follows:

• Service providers who help us run the site, under contracts that limit how they can use it:
  • Hosting: Vercel
  • Database: Turso
  • Sign-in and email confirmation codes: Clerk
  • Photo storage: Turso (photos are stored in our database)
  • Analytics: Vercel Web Analytics
  • Email: our email provider, which hosts legal@theunitfile.com (the site itself doesn't send email)
• Advertising partners: we don't currently share personal information with advertising partners (see Section 4).
• The public: reports and approved photos are public, as described in Section 2.
• For legal reasons: when we believe in good faith that the law requires it (for example, a valid subpoena, court order or other legal process), or to protect the rights, safety or property of users, the public or The Unit File. We don't store IP addresses with reports, so in most cases we have very little that could identify the person who wrote a report (see Section 10). Because most reports are filed without an account, we usually have no way to contact that person either. Where practical and legally allowed, we may post a notice on a report when we receive legal process about it, so its author has a chance to respond. We can't promise to give notice in every case.
• Business transfers: if The Unit File is sold, merged or reorganized, information may be transferred to the new owner, who must follow this policy or tell you about changes.
• With your direction or consent.

We don't give landlords or property managers information about who wrote a report, unless the law requires it as described above.

6. Cookies and similar technologies

Cookies are small files stored by your browser. Pixels and tags are bits of code that send information to a company when a page loads. "Local storage" is a similar way for a website to save information in your browser. We don't currently use advertising pixels, tags or cookies.

Most browsers let you block or delete cookies. Blocking all cookies may affect sign-in. Our site doesn't currently respond to "Do Not Track" browser signals, because there's no common standard for them. If we ever add advertising pixels or tags, we'll honor Global Privacy Control (GPC) signals (see Section 7).

7. Do Not Sell or Share My Personal Information

We don't currently sell or share personal information, or use it for targeted advertising (see Section 4).

You can still opt out at any time. Email legal@theunitfile.com with the subject line "Do Not Sell or Share." We'll record your request and apply it to any information we can link to you. You don't need an account to opt out.

If we ever add advertising pixels or tags to our site, we'll update this policy first, add a "Do Not Sell or Share" opt-out on the site, and treat a Global Privacy Control (GPC) signal from your browser as a valid request to opt out of sale, sharing and targeted advertising for that browser.

8. Your privacy rights

Depending on where you live, state law may give you the right to:

• Know and access: ask what personal information we have about you and get a copy.
• Delete: ask us to delete personal information we have about you.
• Correct: ask us to fix inaccurate personal information.
• Opt out: of the sale or sharing of personal information and of targeted advertising (we don't currently do these; see Section 7), and of profiling that has legal or similar effects (we don't do this).
• Appeal: ask us to reconsider if we deny your request.
• Not be treated differently for using your rights. We won't deny you service or change the quality of the site because you used a privacy right.

We honor these requests from all U.S. users, whatever state you live in.

How to make a request

Email legal@theunitfile.com with "Privacy Request" in the subject line. Tell us what you want us to do.

Verifying your request. We need to make sure the request is really from you. Because you don't need an account to use the site, we may ask for details that help us match you to our records, such as the building, the approximate date you filed, what your report said, or the network you used. If you're signed in, we may verify you through your account. We'll only use this information to verify and handle your request. If we can't reasonably verify you, we'll tell you why.

Using an agent. You can have an authorized agent make a request for you. We may ask for proof that you gave them permission and may ask you to verify your identity with us directly.

Timing. We'll confirm we got your request within 10 business days and respond within 45 days. If we need more time (up to another 45 days), we'll tell you why.

Deleting reports. If you ask us to delete a report you filed, we'll remove it from public view and delete the personal information linked to it, unless we need to keep some of it for a reason the law allows, such as preventing fraud, handling a dispute or legal claim, or meeting a legal duty. Rent you shared may stay in combined figures that don't identify you.

Appeals. If we deny your request, you can appeal by emailing legal@theunitfile.com with "Privacy Appeal" in the subject line within a reasonable time. We'll respond in writing within 45 days and explain our decision. If you're not satisfied, you may contact your state attorney general.

9. Notice for California residents

This section adds to the rest of this policy for California residents, as required by the California Consumer Privacy Act (CCPA), as amended.

Notice at collection. The table below lists the categories of personal information we collect, why, and who receives it. We collected the same categories in the past 12 months.

Sensitive personal information. We don't ask for sensitive personal information. If you include it in free text, we don't use it to infer things about you, and we use it only as allowed by law.

Sources. You, your browser or device, and Clerk (if you sign in).

Retention. See Section 10.

Minors. We don't sell or share personal information, and we don't knowingly sell or share the personal information of anyone under 16.

10. How long we keep information

We keep information only as long as we need it for the purposes in this policy, unless the law requires or allows longer.

We may keep information longer if needed for a legal claim, investigation or legal hold.

11. How we protect information

We use reasonable safeguards to protect information, including:

• encrypted connections (HTTPS) to the site;
• limiting admin access to the site owner only;
• using established providers for hosting, database and sign-in; and
• admin pages that only open for one owner account with a verified email address through Clerk.

No system is perfectly secure. We can't guarantee the security of information sent to or stored by us. If we learn of a breach that affects your information, we'll notify you as the law requires.

12. Children

The site is for adults 18 and older. It isn't directed to children. We don't knowingly collect personal information from anyone under 13, and we don't knowingly sell or share personal information of anyone under 16. If you believe a child has given us information, email legal@theunitfile.com and we'll delete it.

13. Where information is stored

The Unit File is based in the United States, and the site is meant for people looking at U.S. housing. Our site runs in Vercel's U.S. East (Washington, D.C.) region. Our providers may store and process information in the United States and other countries. If you use the site from outside the U.S., your information will be handled under U.S. law.

14. Management accounts

This section is for property owners and managers who open a free management account to claim a building and post a "Response from management" under renter reports. It adds to the rest of this policy. The rules for these accounts are in our Management Account Terms.

What we collect

Your sign-in. Management accounts use the same sign-in as the rest of the site, handled by Clerk. Clerk keeps your sign-in email address and other sign-in details (see Section 1). We store your Clerk account ID with your management account. We read your sign-in email from Clerk while you're signed in, but we don't copy it into our database unless you also use it as your work email. After your account is approved, we also mark your Clerk account as a manager account so the site can show you a link to your dashboard.

Account details you give us:

• your name. It's kept private and is never shown on the site;
• your organization's name, which is shown on your responses. If you change it after your account is approved, we hold the new name as a pending change until we review it;
• the version of the Management Account Terms you accepted, and when; and
• your account's status, how and when it was approved, and when it must be checked again.

Your work email. For work-email approval, you add your work address to your sign-in account. Clerk emails a one-time code to that address and checks it. We never see or store the code. From Clerk, we get whether the address is confirmed and when it was added, and we use that date for the 90-day rule. We store the work email address and its domain with your request and, once you're approved, with your account. We also record which building website or company domain it matched. The address stays on your sign-in account at Clerk until it's removed.

Manual approval. If you ask for manual approval, we collect:

• the method you choose (leasing-office callback, letter of authorization or business card);
• any note you add, and any contact email you give us, along with whether you confirmed that email with a code;
• proof images you upload (JPEG or PNG, up to 5 MB). Before storing an image, we re-save it to strip hidden data such as location (EXIF/GPS); and
• for a callback: the leasing office's phone number, which we take from the building's official website (never a number you give us); a scrambled (hashed) version of the one-time code we read to you, never the code itself; when the code expires; and how many tries have been used.

Claim records. For each building you claim, we record the building, the claim's status (for example pending, active, released, denied or revoked), how it was approved, and when it was requested, approved and ends. If a claim is released, denied or revoked, we also record when and why. When we revoke a claim, we keep a separate record of the account, Clerk account ID, confirmed work email and domain involved, so the same person or organization can't automatically claim that building again.

Responses. For each response: its text, the account and organization that posted it, its status (published, held for review or removed), any hold or removal reason, how many times it was edited, and its dates. We privately keep every version of each response, including earlier edits.

Flags on responses. When a signed-in user flags a response, we store the reason they pick, any short note they add (up to 300 characters), their internal account ID (so each account can flag a response only once), and the flag's status and dates.

Moderation and security records. We keep a log of our decisions about accounts, claims, responses and flags: what happened, when and why. We also keep counters in our database that limit how often a management account can submit claims or post responses, and how often a signed-in user can flag responses. Each counter is tied to that account, not to an IP address, and is deleted by our daily cleanup, usually within a day after its time window (24 hours or less) ends. If our database is briefly unavailable, the same counts are kept in temporary server memory instead.

Messages you send to legal@theunitfile.com (see Section 1).

What we don't store. We don't store your IP address or device details with your management account, claims, responses or flags. Separately, to limit repeat submissions from one connection, our server holds the IP address behind a manual-approval request or a flag in temporary memory for up to 24 hours to count recent attempts, the same way it does for reports (Section 1). It isn't written to our database. Our host, Vercel, processes IP addresses and keeps request logs as described in Section 1.

How we use it

We use management account information to:

• confirm that you have authority to manage each building you claim;
• prevent impersonation, fake claims and abuse, including blocking a revoked person or organization from automatically claiming a building again and catching two organizations using the same name on one building;
• show your responses on the site with your organization's name;
• keep approvals current. Work-email approvals end 90 days after the email was confirmed unless you confirm it again with a new code. Manual approvals last 12 months, and your account must be checked again every 12 months;
• review responses and handle flags. A response flagged by 3 different accounts is hidden until we review it;
• handle appeals, disputes and legal claims;
• keep the site and accounts secure; and
• comply with the law.

What's public

• Public: the text of each published response, the label "Response from management," your organization's name as it was when the response was posted, the date, and "edited" if the response was changed.
• Never public: your name, sign-in email, work email, the phone number we called, your notes, proof images, claim records, earlier versions of a response, held or removed responses, flags and moderation records. Only the site owner can see these, through admin pages that require a second sign-in step.

Managers never get renters' identities

• Reports aren't tied to accounts. We don't store a renter's name, email address, account or IP address with a report. The only report-related thing linked to signed-in accounts is "helpful" votes, and managers never see who voted.
• Your dashboard shows only what's already public about reports, plus the status of your own organization's responses. It never shows who wrote a report.
• Managers can't see who flagged a response. Our own review screens show a flag's reason and note, not the account that sent it.
• We disclose information about who wrote a report only when the law requires it, as described in Section 5.

Who we share it with

• We don't sell management account information, and we don't share it for targeted advertising.
• Service providers (Section 5): Vercel (hosting), Turso (our database, including proof images) and Clerk (sign-in, email confirmation codes, and the work email on your sign-in account).
• The public: only what's listed under "What's public" above.
• For legal reasons and business transfers, as described in Section 5.
• We don't give your name, work email or approval details to renters or to other managers.

How long we keep it

As Section 10 says, we may keep information longer if needed for a legal claim, investigation or legal hold.

Your choices

• Correct your information. Update your name and organization name in your dashboard's Settings. Once your account has been approved, an organization name change waits for our review. To use a different work email, confirm the new address with a code. For anything else, email legal@theunitfile.com.
• Release a building at any time from the Claims tab in your dashboard.
• Remove a work email from your sign-in account under "Manage account" in the account menu. After that, work-email approvals that rely on it can't be renewed.
• Close your account by emailing legal@theunitfile.com from the email on your account. When we close it, your claims end, any open requests are closed, and you can't claim buildings or post responses. Proof images from your requests are then deleted on the schedule above. Responses you already posted may stay up with your organization's name, as the Management Account Terms explain, unless you ask us to remove them.
• Access or delete your information by emailing legal@theunitfile.com with "Privacy Request" in the subject line (see Section 8). We'll delete what we don't need to keep. We may keep revocation records, records about responses, flags and moderation that we need for disputes, repeat abuse or legal claims, and anything we must keep by law. Information already in database backups expires on our database provider's schedule.

15. Changes to this policy

We may update this policy. When we do, we'll post the new version here and change the "Last updated" date. If we make a significant change, we'll give more notice, such as a notice on the site. If the law requires your consent to a change, we'll ask for it.

16. Contact us

The Unit File LLC
3250A West 86th Street #1037
Indianapolis, IN 46268
Email: legal@theunitfile.com