Privacy
Last updated October 23, 2026.
Room Pointers is run by one person, as a sole proprietorship doing business as Room Pointers, in Massachusetts, United States. This page says what the site collects, who handles it, and what is public.
What is collected
- Your email address, to send you a sign-in code. No page shows it to anyone but you.
- Your display name and handle. Both are public.
- The stays you log: every answer on the form. Your check-in and check-out dates and your private notes are shown to nobody but you; readers see the month of a stay.
- Your photos, after your browser has resized and re-encoded them. Nothing of a photo's metadata, such as where or when it was taken, leaves your device.
- Whether you ticked the box for news email, and when.
- A cookie that keeps you signed in, with the IP address and browser it was started from. It lasts seven days and is renewed as you use the site. It is the only cookie the site sets.
- A count of requests for a sign-in code and of codes entered, by IP address, which protects the sign-in form from flooding.
- Until you submit a stay, your answers stay in your browser's tab. Nothing is sent or stored before then, with two exceptions you choose: a screenshot or text you upload to fill in the form is sent to be read, as the next section says, and is then discarded; and a confirmation email you forward to the site's address is read the same way, and what it read, the hotel, the dates, the room booked and the points or cash, waits on "Your stays" as a stay to finish until you finish or discard it, 37 days at most, counted from the forward or from check-out, whichever is later: the site emails you about it twice and deletes it on the thirty-seventh day. The site keeps the answers you submit, and a forwarded stay until you finish, discard or delete it; never the upload, and never the email.
- A confirmation forwarded from an address with no account is held for that address alone, with nothing else of the email, until the link in the reply or a sign-in code attaches it to the account made with that address, or until it is deleted on the thirty-seventh day. Five reads a day are the most such an address gets, and a count of them by address is kept for seven days.
- The cards and programs you pick on "Your wallet" stay in the page's address, in your browser. Nothing of them is stored.
- A link you share from a stay's page, with "Share as a data point" or "Copy link", carries a mark saying it was shared from here. The site counts how often each stay is shared and how often it is opened from such a link, and nothing more: not who shared it, and not who opened it.
- Which screens are reached when a stay read from an email, a paste or screenshots is logged, counted by day and by the way the stay came in, and nothing more: no answer, no stay and no person.
Who handles it
- Vercel runs the site's code and receives every request, as any host does.
- Neon holds the database, in Amazon Web Services' us-east-1 region in the United States: everything above but the photos.
- Cloudflare Images holds and serves the photos, each tagged with the ids of its stay and its contributor.
- Resend sends the sign-in code, the reply to a confirmation email you forward and the emails about a forwarded stay you have not finished, so it sees your email address, the code and what they say.
- Mailgun receives a confirmation email you forward to the site's address and hands it to the site. It holds the email only until it is delivered, up to eight hours when the site cannot be reached, and keeps no copy after.
- OpenRouter, and the model provider it routes to, OpenAI, or Google as the fallback, read a screenshot or text you upload, or a confirmation email you forward, to fill in the form, which may show your name and a confirmation number. The request asks for providers that keep nothing of it beyond the request and train on nothing; the site stores and logs none of it.
- TypeSafe, through OpenRouter, decides how a stay was booked when the site's own rules cannot tell it from what the confirmation states, and whose points paid when the program named is one the site does not know. It sees the booking evidence alone, the sender's name and domain, the rate's name, the benefits listed and who collects payment, never the email, your name or a number, and the request asks for an endpoint that keeps nothing of it.
- OpenFreeMap serves the map tiles on "Your wallet" to Pro readers, straight to your browser, so it sees your IP address and the areas of the map you look at. It gets nothing else: not who you are, and not the cards you picked.
Nothing is sold, and no analytics or ad tracker runs.
What is public
A public stay is counted on the hotel and region pages and on "Your wallet", and shown with everything you logged but the dates and the private notes: on the hotel page, on its own page and on your profile, which lists your public stays under your handle. On the region page, a hotel's card shows the cover photo of the latest public stay there that has one, which may be yours. A public stay's link shows a preview drawn for it, with the cover photo, the hotel, the room booked and the room received, how the upgrade happened, the booking method and the verdict, wherever it is shared.
A stay set to "Anyone with the link" is shown only to someone who has its link, which is random, and is in no number and on no other page. A stay set to "Only me" is shown to nobody but you. Your email address is on no page.
The founders page names every Founding Contributor by display name and handle and, until November 27, lists the contributors with the most public stays by handle.
The site emails you a sign-in code when you ask for one, one reply to each confirmation email you forward, saying what it read, and up to two more about a forwarded stay you have not finished: one two days after the forward, or the day after check-out, and one on the thirtieth day naming the day it is deleted. Each carries two links: "Finish this stay", which signs you in on the device you open it on, works for seven days and is used once; and one that deletes the stay and stops them, which needs no sign-in. It may email you about your account, such as where you stand on the ladder, without further consent; today it sends nothing else.
An address with no account that forwarded a confirmation gets the same emails about that stay, with the same two links; the first use of its sign-in link creates the account. Nothing else is sent to it.
News about Room Pointers goes only to people who ticked the box, which you can untick on "Your details" at any time; none has been sent yet.
What you can do
Change who can see a stay at any time, edit it, or delete it; its photos go with it. Change your display name and the news box on "Your details". Your handle is fixed once set.
To delete your account, email hello@roompointers.com; the operator deletes it by hand within 14 days, with your stays and photos.
Backups
The database keeps seven days of history, so that a mistake can be undone. The operator also takes an encrypted copy of the database and of the photos by hand from time to time and keeps it for a limited time, outside the database and the photo store.