Last updated and effective: 4 August 2026
Borrowed+ ("we", "us") helps people record items they lend or rent and create signed agreements. This policy explains what we collect and why — in the iOS app and on the web app at borrowedplus.com. Borrowed+ is the controller of the personal data described below. We are a documentation tool — we do not process or hold person-to-person payments, and we do not sell personal data or use it for third-party advertising or tracking.
| Data | Why |
|---|---|
| Account and authentication | Email address, account ID, display name, username, and the identifier provided by Apple if you use Sign in with Apple. Passwords are handled by our authentication provider; Borrowed+ does not receive your plaintext password. |
| Profile and contact details | Your display name, @handle, optional bio, shop tag, avatar, and any borrower's name, email address, or phone number you choose to enter. Another user may enter your details when documenting a loan with you. |
| Photos | Item photos, condition photos on return, and your profile picture. We strip location (GPS/EXIF) metadata from photos before upload. |
| Your content | Item details (name, category, value, condition), loans, listings, dates, notes, rent/deposit records, and the content you choose to publish on your shop. |
| Agreements & signatures | The frozen agreement text, typed or drawn signatures, return-condition evidence, and signing evidence such as timestamp, IP address, device/browser information, country inferred from the request, and consent confirmation. |
| Safety information | Reports, the reported target, a standardised reason, moderation status and notes, and accounts you block. This lets us investigate abuse and enforce our Terms. |
| User & device identifiers | Your account ID, and a push-notification token if you allow notifications. |
| Purchase state | Whether you own Borrowed+ Premium (via Apple and RevenueCat). We never see your card details. |
| Diagnostics | Privacy-minimised operational fields such as feature category, operation, fixed error code, app version/build, operating-system version, device family, and aggregate crash, hang, CPU, and disk metrics. We do not intentionally include your content, signatures, contact details, authentication tokens, URLs, or stack traces in app telemetry. |
Most data comes directly from you. We may also receive contact details entered by another party to a loan, authentication information from Apple and Supabase, purchase status from Apple and RevenueCat, delivery status from our email provider, and device or request information generated when you use the service.
We do not use solely automated decision-making that produces legal or similarly significant effects.
Any rent or deposit is paid directly between users, outside the app. We never process, hold, or transmit those payments — we only record the confirmations you mark. The only payment we receive is the optional in-app purchase, handled entirely by Apple.
We share only what is needed for these providers to perform their services. We may also disclose information when required by law, to protect users or the service, or as part of a business reorganisation subject to appropriate safeguards. Agreement links you share are readable by whoever has the link. Your shop page (borrowedplus.com/u/you) is public and shows your public profile and only the items you choose to list. People you connect with may see the information necessary for your shared loan and agreement.
Some providers may process data outside the UK or European Economic Area. Where required, we rely on an adequacy decision or approved contractual safeguards and related protections. Contact us if you would like more information about the safeguards relevant to your data.
You can delete your account in the app (Profile → Delete account) or by emailing us. We delete uploaded avatar and item photos and remove or anonymise operational profile data, items, listings, notification tokens, relationships, and other account-linked data that is no longer needed. Signed agreements, signatures, signed PDFs, return-condition evidence, and related audit records may be retained as legal records because both parties may rely on them and because they may be needed to establish, exercise, or defend legal claims. Your profile is anonymised in retained records.
We otherwise keep account and service data while your account is active and for only as long afterwards as needed for the purposes above, safety and fraud prevention, legal obligations, dispute resolution, or system integrity. Moderation and diagnostic records are kept only while reasonably needed for safety, enforcement, reliability, or claims. Backups expire on a rolling basis and deleted data may remain in protected backups until that cycle completes.
Under UK/EU GDPR you can request access to, correction of, or deletion of your data, and you can object to or restrict processing, request a portable copy where applicable, and withdraw a consent without affecting earlier lawful processing. Contact us at privacy@borrowedplus.com — we respond within one month. You also have the right to complain to your supervisory authority (in the UK, the ICO).
We use access controls, encrypted network connections, row-level database policies, restricted service credentials, and data minimisation. No service can guarantee absolute security. Please use a unique password and contact us promptly if you suspect unauthorised access.
This website sets no advertising or analytics cookies. The web app stores your session locally in your browser so you stay signed in; signing out removes it.
Borrowed+ is not directed at children under 13, and you must be old enough to form a binding agreement in your country to use the signing features.
If we change this policy in a meaningful way, we'll update the date above and note it in the app or by email.
Privacy questions and rights requests:
privacy@borrowedplus.com
General support and safety reports:
support@borrowedplus.com