1. Introduction
Zoink is a peer-to-peer rental marketplace operated as a sole proprietorship by Vansh Parikh in Ontario, Canada.
This policy explains what personal information we collect, why we collect it, who we share it with, how long we keep it, and what you can do about it. It applies to the Zoink mobile app, the Zoink website, and everything connected to them.
We follow Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). Zoink currently operates only in Ontario and only for users aged 18 and over.
Privacy contact: zoinksupport@gmail.com. That address reaches the person accountable for privacy at Zoink: Vansh Parikh, 2 Goderich Drive, Brampton, Ontario L7A5A7.
2. What we collect
2.1 Information you give us
| What | Examples | Why we need it |
|---|---|---|
| Account details | First and last name, student email address, phone number, password (stored only as a salted hash) | To create and secure your account, and to let the other party to a rental know who they are dealing with |
| Profile | Profile photo, short bio | So other users can recognise you |
| Student verification | Your post-secondary student email address, and the one-time code we send to it | To confirm you are a real student at an Ontario institution before you can list or book |
| Listings | Item title, description, category, photos, daily price, item value, deposit amount, pickup city and address | To publish your listing and let Renters find it |
| Bookings | Dates, prices, deposit amount, commission, payout amount, tax | To run the rental and pay you |
| Handoff evidence | Photos taken at pickup and at return | To establish the item's condition, and to resolve disputes |
| Messages | The content of messages you send other users through the app | To let you arrange rentals, and to investigate reports and disputes |
| Reviews and ratings | Scores and written notes about the other party and the item | To build the reputation system |
| Disputes and reports | Your description of the problem, evidence you upload, the outcome | To investigate and resolve it |
| Support correspondence | Whatever you send us | To help you |
2.2 Information we collect automatically
| What | Detail |
|---|---|
| Approximate and precise location | Only with your permission, and only while the app is in use. We use it to show you listings near you and to set a pickup point on a listing you create. We do not track your location in the background. You can withdraw the permission at any time in your device settings; the app still works, you just have to enter a location manually. |
| Device and push token | An Expo push notification token, so we can send you notifications you have turned on |
| Technical and error data | IP address, device type, OS version, app version, and diagnostic data when the app or server hits an error |
| Usage | Which listings you view and book, timestamps of key actions in a booking |
2.3 Information from others
- Stripe tells us the status of your payments, deposits, and payouts, and whether your Stripe Connect account is in good standing. Stripe does not give us your full card number.
- Other users may name you in a report or a dispute.
2.4 What we do not collect
- We do not collect government ID or selfies. Verification is by student email only. If we introduce ID verification later, we will update this policy and give you notice before it applies to you.
- We do not collect your full payment card number — Stripe handles that.
- We do not track your location in the background.
- We do not sell your personal information to anyone, and we do not use it for advertising or ad targeting.
3. Why we use it
We use personal information to:
- create, verify, and secure your account;
- publish listings and let people find and book them;
- process payments, hold and release security deposits, calculate commission, and send payouts;
- enable messaging between the two parties to a rental;
- send you transactional notifications you have not switched off — booking activity, payments and payouts, deposit updates, messages, and reviews;
- investigate reports, resolve disputes, and allocate security deposits;
- detect and prevent fraud, abuse, and unlawful use;
- fix bugs, monitor errors, and improve the product;
- meet our legal, tax, and accounting obligations.
We do not use your personal information for any new purpose without telling you and, where the law requires it, getting your consent.
4. Your consent
By creating an account you consent to our collecting and using your personal information as described here.
Some collection is required to provide the service at all — you cannot rent on Zoink without an account, a verified student email, and a payment method. Other collection is optional, and you control it:
- Location — grant or revoke in your device settings.
- Camera and photo library — grant or revoke in your device settings.
- Push notifications by category — toggle in the app's notification settings. Account-critical notices (for example, the outcome of your student email verification) are always sent.
You may withdraw consent to non-essential processing at any time by writing to zoinksupport@gmail.com. Withdrawing consent to essential processing means closing your account.
5. Who we share it with
We share personal information with the service providers below, only as needed to run the Platform, and only under contracts that require them to protect it.
| Provider | What they get | What for |
|---|---|---|
| Stripe | Name, email, payment details, booking amounts; for Owners, the identity and banking details Stripe requires for a Connect account | Payment processing, deposit holds, payouts |
| Cloudinary | Profile photos, listing photos, handoff photos | Image hosting and delivery |
| Amazon Web Services (SES) | Email address and message content | Sending transactional email |
| Expo | Push token, notification title and body | Delivering push notifications |
| Sentry | Error reports, which may include your user ID, IP address, and app state at the moment of a crash. Passwords, tokens, and secrets are stripped before the report is sent. | Crash and error monitoring |
| Railway | Everything stored in the database | Running the servers and the database |
We also share:
- With the other party to your rental — the information you would expect: your name, profile photo, rating, and the messages you send them. Owners see the Renter's name and booking details; Renters see the Owner's name, listing, and pickup location.
- Publicly on the Platform — your first name, profile photo, bio, ratings, and reviews you have received. Your listings, including the photos and the pickup city, are visible to other users.
- When the law requires it — in response to a valid court order, subpoena, or legal obligation, or where we believe in good faith it is necessary to prevent serious harm, investigate fraud, or protect someone's safety. This includes reporting an unreturned item to police.
- In a business transfer — if Zoink is incorporated, merged, or its assets are sold, your information may transfer to the successor, which will remain bound by this policy or give you notice of a new one.
We do not sell your personal information.
6. Where your information goes
Zoink uses service providers located outside Canada, primarily in the United States (Stripe, Cloudinary, AWS, Expo, Sentry, and Railway all process data in the US).
This means your personal information may be stored or processed in the United States, and while it is there it may be accessible to US courts, law enforcement, and national security authorities under US law, regardless of the protections we have in place. We use providers who contractually commit to a comparable level of protection, but we cannot exempt them from the law where they operate.
If you would rather your information not be processed outside Canada, do not use Zoink.
7. How long we keep it
| Data | Retention |
|---|---|
| Account and profile | While your account is open. On deletion, we soft-delete and then purge within 30 days, except where a longer period is required below. |
| Student verification codes | Expired or deleted within 24 hours. We keep only the verified email address and the date it was verified. |
| Listings and photos | While the listing exists. When you delete a listing, it and its photos are deleted immediately. |
| Bookings, payments, commission, payouts, tax records | 7 years from the end of the tax year, as required by Canadian tax and accounting rules |
| Handoff and condition photos | 12 months after the booking completes, or 90 days after any dispute about it is finally resolved, whichever is later |
| Messages | 24 months after the related conversation's last booking completes |
| Reviews and ratings | Indefinitely, since they are part of the public reputation record. Reviews you wrote remain visible after your account closes, shown as from a deleted user. |
| Disputes and reports | 3 years after resolution, for pattern detection and legal defence |
| Error and diagnostic logs | 90 days |
When a retention period ends we delete the information or irreversibly anonymise it.
8. Deleting your account
You can delete your account in the app or by emailing zoinksupport@gmail.com.
Some things survive deletion, and you should know which:
- Transaction records stay for 7 years for tax and accounting.
- Reviews you wrote about other people stay visible, attributed to a deleted user.
- Messages you sent stay in the other party's conversation view.
- An open dispute or booking must be resolved before we can delete your account.
9. How we protect it
We use, among other measures: encryption in transit (HTTPS) and at rest; bcrypt password hashing; short-lived JWT session tokens stored in the device's secure keystore; rate limiting on sensitive endpoints; role-based access so that only administrators can view dispute evidence; and automatic scrubbing of passwords, tokens, and secrets from error reports before they leave our servers.
Access to dispute evidence and handoff photos is restricted to the people who need it to resolve a dispute.
No system is perfectly secure. If we discover a breach that creates a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada as PIPEDA requires, and we will keep a record of the breach.
10. Your rights
Under PIPEDA you can:
- Access — ask what personal information we hold about you, how we have used it, and who we have disclosed it to. We will respond within 30 days. It is free unless the request is unusually costly, in which case we will tell you the cost first.
- Correct — ask us to fix information that is inaccurate or incomplete. Most of it you can edit yourself in the app.
- Withdraw consent — see section 4.
- Delete — see section 8.
- Complain — write to zoinksupport@gmail.com first. If we do not resolve it to your satisfaction, you can complain to the Office of the Privacy Commissioner of Canada at priv.gc.ca, 1-800-282-1376.
To make a request, email zoinksupport@gmail.com. We may ask you to verify your identity before we act on it.
We may refuse a request in the narrow circumstances PIPEDA allows — for example, where granting access would reveal personal information about another user, or would compromise an active fraud investigation. If we refuse, we will tell you why and tell you how to complain.
11. Automated decisions
Zoink does not make decisions about you by automated means alone that would significantly affect you. Deposit allocations and dispute outcomes are decided by a person who reviews the evidence.
Ratings shown on your profile are calculated automatically from the reviews other users leave.
12. Children
Zoink is for adults. You must be at least 18 to use it. We do not knowingly collect personal information from anyone under 18. If we learn we have, we will delete it and close the account. If you believe a minor has an account, tell us at zoinksupport@gmail.com.
13. Cookies and similar technology
The Zoink mobile app does not use cookies. It stores a session token in your device's secure storage so you stay signed in.
Our landing website (outside the app itself) uses only strictly necessary cookies — the kind needed for the site to function, such as remembering basic technical settings. It does not run analytics, advertising, or tracking cookies, and does not use any tool that builds a profile of your visit. If that changes, we will update this section and, where the law requires it, ask for your consent first.
14. Changes to this policy
We may update this policy. If a change materially affects how we handle your personal information, we will give you notice by email and in the app at least 30 days before it takes effect, and where the law requires it we will ask for your consent. Other changes take effect when posted, and we will update the "Last updated" date.
15. Contact
Questions, requests, or complaints about privacy:
Vansh Parikh — Privacy contact for Zoink
2 Goderich Drive, Brampton, Ontario L7A5A7
zoinksupport@gmail.com