Niborz
Privacy Policy
Last updated: 26 August 2026
The short version
- We collect the least we can: your name, email, password (stored hashed), which community you belong to, and what you write.
- We use it to run Niborz — nothing else.
- We do not sell your data. We do not share it for advertising. We do not run third-party ad or tracking code.
- No other resident ever sees your home address. Only your community’s administrators can see it — that is how they confirm you live there. We never look it up, map it, or send it to any address service, and we never ask for, and never store, an address proof, lease, bill, or ID document.
- You can see, correct, or delete your data at any time from your account, or by emailing help@niborz.com.
The detail below is what binds us.
1. Who is responsible for your data
Niborz LLC, a Texas limited liability company is the business (CCPA) responsible for the personal information described here.
Niborz LLC, Texas, USA. Contact for all privacy matters: help@niborz.com.
Your community’s HOA or management committee is not the controller of your data and cannot exercise your rights for you.
2. What we collect
You give us
| Data | Why we need it | Required? |
|---|---|---|
| Full name | So neighbors know who is vouching — trust is the product | Yes |
| Email address | Login, account security, service notices, password reset | Yes |
| Password | Stored only as a hash. We never see or store your actual password | Yes |
| Community membership — which community you belong to, and your resident status | To show you your community’s content and to verify you are a neighbor | Yes |
| Vouches, comments, and recommendation requests you post | This is the service | You choose what to post |
| Business details you add (name, category, published contact details of a business) | To build the community directory | You choose |
| Messages you send us (support, reports, grievances) | To answer you and keep a record of the complaint | Only if you contact us |
Your mobile number, and the text we send
Where your community has switched it on, joining asks for a US mobile number and we text you a single six-digit code to confirm you control it.
- What we keep: the number in standard international form, the date you confirmed it, and the date you agreed to be texted. We also keep a record of verification attempts — the number, whether it succeeded, and how many tries — so we can stop attacks that run up our text bill.
- Who can see it: you. Your confirmed number is not shown to other residents, not to your community’s administrators, and not to businesses.
- It is one message. We will never send you marketing texts, promotional texts, or notifications. We do not have your permission for those and we are not asking for it; we would have to ask you again, separately.
- We never sell, share, rent or trade your number. It is also separate from the optional number you may choose to display to neighbors — two different things, kept in two different places, each turned on and off on its own.
- Confirming your number is not confirming where you live. It proves you control a phone. Only your community’s administrator can confirm you are a resident.
- Removing it: you can remove the number from your account settings, or delete your account. We keep the record that you once agreed to be texted, because that is the evidence that the message we sent was one you asked for.
The number you show neighbors, and your listings
Your community’s board lets you post a listing — something to sell, give away, lend, or ask for — and lets you show a phone number on it so a neighbor can answer. Both are optional, and the number is off until you switch it on. Switching it back off is the same single tap, and it takes effect immediately.
| What | What we store | Who can see it |
|---|---|---|
| The number you show neighbors — optional, off by default | The number exactly as you typed it, whether it is switched on, and the date you last switched it on. It is not the number we text a sign-in code to: two different things, kept in two different places, each switched on and off on its own | Active members of your community, and only when they tap to see it on one of your listings. Never in a list or a feed, never to a business, never to someone whose membership is still pending, never to another community, never on a public page |
| A record of each time your number is shown to someone | Which listing, who looked, and when. Nothing else — not the number itself, and not what was said afterwards | Us only. We use it for two things: to cap how many numbers one person can look up in an hour, and to see when somebody is collecting numbers rather than answering an advert. It is not shown to you, to the person who looked, or to your community’s administrators |
| Your listings — title, description, category, condition, price, photos | What you typed and the photos you uploaded | Members of your community. Never public, never on a share card, never in a search engine |
About listing photos. Every photo you upload is re-encoded on our servers before it is stored — we build a new image out of the pixels. Any location, device or timestamp data your camera attached is dropped in the process, because what we keep is a new file rather than the one your phone made. We never ask you for a photograph of a document, a lease, a bill, or an identity document, and posting someone else’s identity documents is against the Terms.
Residency verification and your home address
We confirm you live in your community in one of two ways, and we store as little as each one needs:
| What | What we store | Who can see it |
|---|---|---|
| Your home address — required to ask to join a community | The address exactly as you typed it, plus a tidied-up version of it (spaces, dashes and slashes removed, letters capitalised) used only for matching. Maximum 120 characters. We store no separate city, state or ZIP field, and the address is never geocoded or sent to a mapping or address-validation service | Your community’s administrators only — never other residents, never businesses, never the public |
| Administrator approval | The outcome (approved or not), who approved it, and when | You and your community’s administrators |
| Your committee’s address list (“roster”) | A list of home addresses only — pasted by your administrator from the list the committee already keeps. It contains no names, no phone numbers, no people. If the address you give matches a free entry on that list, you are admitted and marked as a verified resident automatically | Administrators |
Why we ask. Trust is the whole product: a recommendation is only worth reading if it comes from someone who genuinely lives in your community. Your home address is the cheapest way to check that, and it is the reason we never have to ask you for a lease, a utility bill, a maintenance receipt, or an identity document.
We do not store, and will never ask you for, address-proof documents, leases, utility bills, identity documents, or GPS/precise location. This is a deliberate design rule, not a current limitation.
What you type is your home address, and we treat it as one. It is visible only to your community’s administrators, it is never geocoded and never sent to a mapping or address-validation service, never published, never shown to a business, never included in anything you share outside the app, and it is deleted with your membership (see section 7).
How you joined, and who invited you
Invite links. Your community’s administrators can create invite links and give them to particular neighbors to share. When you join through one, we record which link you used and when. This lets an administrator see how many people a link brought in and switch off a link that has leaked — the same way a building changes a gate code.
- Administrators can see which link brought you in; other residents cannot.
- We never store the link’s secret — only a one-way cryptographic fingerprint of it, so a copy of our database does not let anyone into your community.
- Links expire (maximum 30 days) and can be switched off at any time.
- Anyone holding a valid link can see the community’s name and city before joining, and nothing else — no member names, no counts, no content.
If your community requires approval. Some communities review new joiners. While you are waiting:
- We hold your name, email, the home address you typed, when you applied, and which link you used.
- Your community’s administrators see those details in their approval queue only — you do not appear in any member list, in any count, or anywhere else in the app.
- You cannot see any of the community’s content while you wait — no directory, no reviews, no neighbors. Until you are approved, the app treats you exactly like someone who is not a member.
- If you withdraw your application, the record is deleted outright, home address included.
Information about businesses and their owners
Vouches name local businesses, and for a small business that can mean naming a person. If you are a business owner and information about you appears here, see section 9.
We do not collect: payment details from residents (residents never pay), precise location/GPS, biometrics, contacts, health data, or any special-category / sensitive personal data. Please do not put such data into a vouch.
3. Why we use it
| Purpose | What we use |
|---|---|
| Create and run your account | Name, email, password hash |
| Verify you are a resident, and show you your community | Membership, verification outcome |
| Decide whether to admit you to a community, and let administrators manage who is in it | Name, email, home address, invite link used, application time |
| Match your home address against your committee’s address list, so you are not stuck in a queue | Home address (normalized), roster entries |
| Publish your vouches to your community | Your content, your name |
| Keep vouches honest (anti-fraud, duplicate and fake-vouch detection) | Membership, vouch activity |
| Show your listings to your community, and let a neighbor who answers one reach you | Your listings and their photos, and the number you chose to show neighbors |
| Cap how many numbers one person can look up in an hour, and spot somebody collecting numbers | The record of a number being shown — which listing, who looked, when |
| Security, abuse prevention, incident investigation | Account and membership records |
| Service emails (password reset, security, policy changes, complaint outcomes) | |
| Product and marketing emails (tips, new features) — separate, opt-in, unsubscribe in every message | |
| Handle complaints, takedowns, and legal requests | Relevant records |
| Improve the product | Aggregated, non-identifying usage data |
We do not use your data for: profiling with legal or significant effects, automated decision-making about you, behavioral or targeted advertising, credit scoring, or resale.
We will not use your data for a new purpose without telling you first and, where the law requires it, getting your consent.
4. What other people can see
| Data | Who sees it |
|---|---|
| Your name | Members of your community; on a business’s profile page alongside your vouch |
| Your community name | Members of your community; shown as e.g. “a verified resident of [Community]” where a vouch appears outside your community |
| Your vouch text | Members of your community, and — where you choose to make it visible beyond your community — other users and visitors of that business’s profile |
| Your email address | Never shown to other users. Not to neighbors, not to businesses, not to community administrators |
| Your home address | Your community’s administrators only. Never other residents, never businesses, never the public, never on a review, never on anything you share outside the app |
| Your address proof, lease, bill, or ID document | Never collected — we do not ask for these at all |
| Which invite link you joined through | Your community’s administrators only |
| Your pending application (name, email, home address) | Your community’s administrators only, in their approval queue. You are not in any member list or count until you are approved |
| The number you show neighbors | Nobody, until you switch it on. Then: active members of your community, one at a time, when they tap to see it on one of your listings. Never in a list or a feed, never to a business, never to a pending member, never to another community, never on a public page. Switching it off removes it from view immediately |
| A record of your number being shown to someone | Us only. Not you, not the person who looked, not your community’s administrators |
| Your listings and their photos | Members of your community. Never public — not on a business’s profile page, not on a share card, not in a search engine, and not carried to another community |
Businesses you vouch for can see the vouch and your display name — the same as your neighbors see. They cannot see your email or contact you through us unless you choose to contact them.
5. Who we share it with
We do not sell your personal information. We have not sold or shared personal information in the preceding 12 months, and we do not intend to.
We share personal data only with:
| Recipient | What for | Safeguard |
|---|---|---|
| Hosting and infrastructure provider | Running the service | Data-processing agreement |
| Transactional email provider | Sending service emails | Data-processing agreement |
| Error monitoring | Diagnosing crashes | Data-processing agreement; personal data scrubbed where possible |
| Professional advisers (lawyers, accountants) | When genuinely needed | Confidentiality obligations |
| Authorities and courts | Where we are legally required to, or to protect someone’s safety | We check that a request is valid, disclose the minimum, and tell you unless legally prohibited |
| An acquirer, in a merger or sale of the business | Business continuity | Notice to you; this policy continues to apply until you are told otherwise |
Every processor is contractually bound to use your data only on our instructions, to keep it secure, and to delete it when we say so.
6. How long we keep it
| Data | Retention |
|---|---|
| Account data (name, email, password hash, membership) | While your account is open |
| Account data after you close your account | Deleted within 30 days |
| Your reviews after you close your account | Kept, but anonymised. Your name is removed from them and from everywhere else in the service; they are shown as written by “A former member”, with no link to any account and no verified badge. We keep the anonymised text because your neighbors relied on it when choosing a plumber or a tutor, and removing it silently would make the directory less trustworthy for everyone. You can instead choose “delete everything, including my reviews and asks” in the deletion screen, and we will remove them |
| Your reviews if you leave a community | Kept, with your name on them. Leaving a community is not a deletion request: your reviews stay readable and attributed, they lose the verified-resident badge and are marked “Former resident”, and they stop counting toward that community’s totals. If you want your name off them, delete your account |
| Content we removed after a report or legal order | 180 days (or longer if a legal proceeding requires it) |
| Your home address | For as long as you are a member of that community. It is deleted when your membership ends — if you leave the community, or when your account is deleted. It is not kept, not archived, and not carried to another community: if you move, you give the new address to the new community |
| Your committee’s address list (roster) | For as long as the community uses Niborz. It is a list of home addresses with no names attached; when a resident’s membership ends, the link between them and their address entry is removed and the entry simply becomes free again |
| A withdrawn application | Deleted immediately, home address included |
| Which invite link you joined through | For as long as you are a member. Kept even after the link itself is switched off, so administrators keep an accurate picture of how their community grew |
| The number you show neighbors | For as long as you leave it switched on. Switching it off takes it out of view immediately and keeps the number on your account so you can switch it back on; you can also clear the number outright from your settings, and it is cleared when your account is deleted |
| A record of a number being shown to someone | For as long as your community uses Niborz. It is a short record — which listing, who looked, when — and it is what lets us cap look-ups and spot somebody collecting numbers, neither of which works on a record we have already thrown away |
| Your listings | While a listing is live, and for 14 days after it runs out so you can renew it. After that — and immediately, if you withdraw it or mark it sold — it comes off your community’s board and only you can still see it, in your own listing history |
| Complaint and grievance records | 3 years, to show we handled complaints properly |
| Backups | Rolling 35 days; deleted data disappears from backups as they roll over |
When a retention period ends, we delete or irreversibly anonymise the data.
7. Your rights
Wherever you live, we give you the following rights. They are free, and using them will never get you worse service.
| Right | What it means | How |
|---|---|---|
| Access | Get a copy of the personal data we hold about you | Email help@niborz.com |
| Correction | Fix data that is wrong or out of date | Account settings, or email us |
| Deletion / erasure | Have your account and data deleted | Account settings → Delete my account |
| Portability | Get your data in a machine-readable format | Email help@niborz.com |
| Withdraw consent | Withdraw consent at any time, as easily as you gave it — e.g. unsubscribe from marketing email in one click | In-product, or the unsubscribe link |
| Object / restrict | Object to processing, or ask us to pause processing while a dispute is resolved | Email help@niborz.com |
| Opt out of sale or sharing | We do not sell or share personal information, so there is nothing to opt out of. If that ever changes we will provide a “Do Not Sell or Share My Personal Information” control before it does | — |
| Non-discrimination | We will not deny service, charge you more, or give you a lower quality of service because you exercised a right | — |
| Complain | Raise a complaint with us first — then, if unresolved, with a regulator | See section 10 |
How we respond. We acknowledge requests within 72 hours and answer within 30 days (extendable once by 30 days for complex requests, with an explanation). We may ask you to confirm your identity — usually by responding from your registered email — so we do not hand your data to someone else. Authorized agents may make requests on your behalf with written proof.
What we cannot delete. Some records survive a deletion request: records of content removed under a legal order, complaint records needed to defend a legal claim, and the anonymised text of reviews, which is no longer personal data once anonymised. We will tell you exactly what we kept and why.
8. If you are a business owner
Residents may name your business and describe their experience with it. If your business is small, that information may also be about you personally.
- We did not get this information from you — it came from a resident who used your business.
- You can: see everything published about your business, correct factual errors (name, category, contact details), object to processing, and report content that is false, defamatory, or unlawful (see Terms section 9 — we acknowledge within 24 hours and resolve within 15 days).
- None of these rights costs money. You never have to buy anything from us to correct, respond to, or challenge what is said about your business.
- Contact: moderation@niborz.com.
9. Children
Niborz is for adults — you must be 18 or older. We do not knowingly collect data from anyone under 18, we do not offer a children’s experience, and we do not do behavioral advertising or tracking of any user, let alone a child. If you believe a minor has an account, tell us at help@niborz.com and we will close it and delete the data.
10. How we protect your data, and what happens if something goes wrong
Security measures: encryption in transit (TLS) and at rest; passwords stored using a modern memory-hard hashing algorithm — never in plain text and never reversible; least-privilege access to production data with a named owner; processor agreements with every vendor; and regular review of who has access.
No system is perfectly secure, and we do not claim to be.
If a breach happens, we have a documented incident-response plan and we will notify the relevant US state authorities within the time the law requires, and tell you directly, in plain language: what happened, what data was involved, what we are doing, and what you should do.
11. Complaints
Contact help@niborz.com first — we would rather fix it than have you escalate.
If you are not satisfied, you can complain to the California Privacy Protection Agency or the California Attorney General. In other US states: your state Attorney General.
12. Changes to this policy
If we make a material change we will tell you in-product or by email before it takes effect, and we will not apply a materially different use to data we already hold without a new lawful basis. We remind you of this policy at least once a year. Older versions are available on request.
13. Contact
| Purpose | Address |
|---|---|
| Privacy, data requests, complaints, security disclosure | help@niborz.com |
| Content reports, takedowns, business owners | moderation@niborz.com |
See also our Terms of Service.