Privacy Policy for AI Host Assistant for Airbnb

Last Updated: October 19, 2026

Overview

AI Host Assistant for Airbnb ("the Extension") is a browser extension designed to help short-term rental hosts manage their listings and guest communications inside their own Airbnb pages. This privacy policy explains what data the Extension accesses, what is stored locally, what is sent to our servers, what is sent to OpenAI, and how third-party services are involved. It also covers our website, str-host-assistant.web.app, and the sign-in the Extension shares with it.

AI Host Assistant for Airbnb is not affiliated with, endorsed by, or sponsored by Airbnb, Inc.

What Data Does the Extension Access?

The Extension accesses the following data within your browser:

1. Message Content: Text from your conversations with guests on Airbnb
2. Guest and Booking Information: Names, booking details, and reservation information visible on the platform, and your own reservations list read from Airbnb's host API (booking and cancellation dates, status, nights and payouts), used by the golden window, the booking pace and the days of the week
3. Calendar Data: Pricing, availability, and monthly performance data for your own listings, read from the Airbnb multi-calendar page and from Airbnb's host API using your own session
4. Listing Data: Your listing's texts, settings, reviews, photos, address and map position, and performance metrics, used by Signals, the hospitality audit, the reply drafter and the filter gap finder
5. Market Figures in Your Dashboard: The occupancy, nightly rate and conversion of similar listings that Airbnb's own performance dashboard shows you, used by the market pulse
6. Guest Profiles: A guest's public Airbnb profile and the public reviews written about them, used by guest screening. To gauge whether the guest returns reviews, the screening also reads the public profiles of the other hosts who reviewed that guest and looks there for the review the guest wrote back. The reciprocity count is worked out on your device. The reviews the guest wrote that it finds are stored on your device and, if you press "Evaluate with AI", are sent to OpenAI with the rest of the screening (see AI Processing); they are about those other hosts and can mention their names or their homes
7. Market Search Results: Public search results for other listings in your area, used by the filter gap finder

Authentication

The Extension asks you to sign in with a Google account before its tools request anything from Airbnb or send anything anywhere; the exceptions are listed under "Reading That Happens Without a Click", "Video Guides" and "One Sign-In for the Extension and Our Website". You can sign in from the Extension, or on our website, which signs the Extension in with the same account (see "One Sign-In for the Extension and Our Website"). When the Extension is signed in:

• Your Google email address, display name (and your first and last name, when Google provides them), and a unique user ID are stored on our server (Firebase Firestore) to manage your account
• Authentication tokens are stored locally in your browser and used to verify your identity on each server request
• We use Google OAuth through Chrome's chrome.identity API when you sign in from the Extension, and Google's own sign-in window when you sign in on our website; we never see or store your Google password

How Is Your Data Used?

Local Storage (Your Browser)

• Extension Settings: Preferences such as language, tone style, and plan type are stored in chrome.storage.sync
• API Keys: Your personal OpenAI API key (free plan only) is stored in chrome.storage.sync and never sent to our servers
• Conversation State: Drafts, readings and screening results are cached locally in chrome.storage.local so you can navigate away and return without asking again
• Airbnb Readings and Histories: What the tools read from Airbnb (calendar months, listing figures, reservations, guest profiles) and the daily histories described under "Background Daily Reading" are stored in chrome.storage.local, on this device only, kept apart for each Airbnb account signed in on it: one account never sees what was saved for another
• Voice Profile (reply drafter, only if you create it): your writing style (how long your replies run, your usual greetings and sign-offs, "tú" or "usted", emoji and exclamation marks), up to 24 short examples of your replies to other guests with what you had been asked (participants' names removed, figures and dates replaced by placeholders, each example expiring after 12 months), the facts you choose to save for a listing, and the ids and times of the conversations it has learned from. After you insert a draft, that draft is kept for up to 14 days, until the Extension sees what you sent in that conversation; then only how much you changed it, as a number, is kept (the last 200), and the draft is deleted. All of it is stored in chrome.storage.local, on this device only, kept apart for each Airbnb account; what is read from your inbox to build it is held in memory and never saved
• Video Guides: Which guides you dismissed (and when), whether the guides popup is minimized, and whether the guides are on are stored in chrome.storage.local, on this device only, and sent nowhere
• Subscription Cache: Your subscription status is cached locally for up to 5 minutes to reduce server requests
• Sign-In Marks: Whether the Extension's sign-in came from the Extension or from our website, when it began, and when you last signed out on purpose and from which account (its user ID) are stored in chrome.storage.local next to the sign-in; our website can ask when the sign-in began and when you last signed out (see "One Sign-In for the Extension and Our Website")

Server-Side Storage (Firebase Firestore)

When you use the Extension, the following data is stored on our servers:

• User Profile: Email address, display name, first and last name (when Google provides them), the language the Extension uses for you, the Extension version, account creation date, last sign-in date, the date and hour you last used the Extension (signed in, or opened Airbnb with it — kept to the hour, not the minute), and subscription tier. These are kept from the moment you sign in. None of it is read from Airbnb
• Usage Counters: Only for accounts with an active Premium subscription: a monthly and a lifetime count of AI requests. The free plan is currently unlimited and reports no usage. We store the count only, not the content of your conversations
• Device Identifier (Premium only): When an account with an active Premium subscription uses an AI feature, the Extension computes a SHA-256 hash of eleven characteristics of this browser and device (screen width, height and colour depth, language and language list, time zone, number of processor cores, device memory, platform, touch points, and whether the PDF viewer is on) and sends it with the request. It is a persistent identifier of this device, not an anonymous one: the hash has no secret salt and those characteristics take few values, so they can be worked out from the hash by trying combinations. We store it with a count of AI requests, the last time it was seen, and the list of accounts that have used the Extension on that device, which links those accounts to each other. It is used only to enforce per-device usage limits and prevent abuse. On the current free plan it is neither computed nor sent
• Records From Earlier Versions: Earlier versions of the Extension also counted free-plan AI requests and sent the device identifier with them; those counts and identifiers stay on our server until you ask us to delete them
• Subscription Data: Your Stripe customer ID, subscription status, and billing period dates

AI Processing

Nothing is sent to OpenAI until you press a button that asks for it. What each button sends:

• Reply drafter (⚡, "Draft a reply"): the last 40 messages of the conversation (each cut at 1,500 characters), and whether older messages were not loaded; the reservation details shown next to it (listing name, dates, number of guests); your listing's texts (title, description, the space, guest access, interaction with guests, other things to note, house rules, the neighbourhood, getting around), its house-rule switches and checkout time; from your listing's public page (the one any guest sees), how many guests it takes, its bedrooms, beds and baths and the names of the amenities it lists; up to four of your Airbnb quick replies whose topic matches the guest's last message, as Airbnb fills them in for that conversation, with the guest's name and every sentence that mentions a door, intercom, key, lock, code, Wi-Fi password or similar access detail removed, and links, email addresses, phone numbers and reservation codes removed (of a quick reply about arrival or check-in, or with any of those sentences, only its name, never its text); any instructions you type, and your answer when the drafter asks you to decide something first (for example, whether the guest may check in early); when you adjust a draft, that draft as it stands (your own edits included) and the adjustment you asked for; and, if you already screened the guest, the counts from that screening (trips, reviews received, years on Airbnb, identity verified) and up to three of its suggested actions. The public page and the quick replies are read from Airbnb in your browser only when you press Generate: the page is kept on this device for up to 30 days, and the quick replies are held in memory for that page only, never saved and never sent to our servers. Removing access details is automatic and imperfect: a name, a licence plate or an address written in an ordinary sentence can get through
• Voice profile (reply drafter, "Create my profile", only after you press "Analyze my conversations"): before asking, the Extension counts how many conversations Airbnb lets it read, with one read of your inbox list (one message per conversation). If you agree, it reads your inbox in one or two requests (up to 30 conversations, up to 50 messages each), keeps it in memory only, and sends to OpenAI, with your own API key, only pairs: each reply of yours with what the guest wrote just before, each cut at 300 characters, with the participants' names, phone numbers, email addresses, links, reservation codes and sentences with access details removed. Replies that copy one of your quick replies (read again for this) are left out. The GPT-6 Luna model only labels each pair with a topic: up to 70 pairs, in at most two requests. From then on, each draft also sends your style and up to 24 of those examples, and the facts you saved for that listing. Updating the profile sends only the pairs written since the last time. Nothing of this goes to our servers: with a Premium plan, whose AI requests go through our server, the voice profile is not available. Removing names and details is automatic and imperfect, and OpenAI may keep what it receives for up to 30 days for abuse monitoring
• Hospitality audit ("Audit my copy"): your listing's texts (title, description, the space, guest access, interaction with guests, other things to note, the neighbourhood, getting around and house rules), Airbnb's rule switches, and check-in and checkout times. After the first audit, a sentence you have not changed is not sent again, except the sentences right before and after one being rewritten (as context), sentences an earlier audit could not finish, sentences whose proposal depends on rule switches or check-in and checkout times that changed, and all of them when we update the audit's checks. It does not read or send your checkout instructions, which Airbnb keeps in the arrival guide
• Signals ("Generate plan with AI", "Review with AI"): your listing's figures and verdicts as the panel shows them (impressions, click-through, conversion, occupancy, average nightly rate, Airbnb's price estimate, reviews, cancellation and response rates, cleaning-fee share, cancellation policy, sleeping arrangements, and their trends), its title, description, house rules and room names, and the addresses of its first photos, which OpenAI downloads
• Guest screening ("Evaluate with AI"): from the guest's public profile, whether their identity is verified, their number of trips and reviews, their years on Airbnb and whether they also host; up to 20 reviews other hosts wrote about them; up to 10 reviews the guest wrote about past hosts, with their star ratings (see Guest Profiles); the reciprocity count; the guest's "About me" text and profile answers; how many past stays their profile lists, and up to 12 of those places and up to 12 of the interests they list; and the last 20 messages of your conversation with them (each cut at 700 characters), used only to suggest what to do. The guest's name, photo and home city are not sent as fields, but names can appear inside the reviews and messages that are sent

The reply drafter and guest screening send personal data about other people to OpenAI: your guest's, and in screening, text written by or about the hosts who reviewed them.

• Free plan: API calls go from the Extension in your browser directly to OpenAI using your own API key. Our servers are not involved in the AI processing.
• Premium plan (not currently offered to new subscribers): API calls are routed through our server (Firebase Cloud Functions) to OpenAI using a server-managed API key. Your conversation data passes through our server but is not logged, stored, or retained. It is forwarded to OpenAI and discarded.

In both cases, the data handling by OpenAI is subject to their privacy policy: openai.com/policies/privacy-policy

Analytics

The Extension sends no usage analytics: no clicks, pages or features used are recorded. The only activity our server keeps is in your user profile (see above): the hour you last used the Extension. It does not talk to Google Analytics or any analytics service from inside your browser. (Earlier versions did; that was removed.) Our website is covered separately, under "Our Website".

Background Daily Reading

Three tools keep a history that Airbnb does not keep for you. For that, the Extension asks Chrome to wake it up every six hours, with no Airbnb tab open, and read from Airbnb using your own logged-in Airbnb session. Signals and the golden window read each listing at most once a day: a wake-up that finds that day's reading already done, or already failed or incomplete, reads nothing more for that listing until the next day. Before reading, the Extension checks which Airbnb account is signed in, from the account number in Airbnb's own _user_attributes cookie (it reads that one cookie and no other, writes none, makes no request for it and sends the number nowhere), and reads the list of that account's listings at most once a day: it reads only listings in that list. Once, for each of those listings that still has data saved by a version from before accounts were kept apart, the Extension opens the listing's public page (the one any guest sees) to check whether the signed-in account is its primary host; only then is that saved data moved to that account, and the answer is kept so the page is not asked for again.

• Signals: for each listing you have read in the Signals panel at least once, it re-reads the same figures from your host dashboard (performance metrics, pricing settings, reviews, Superhost progress, open opportunities, sleeping arrangements, cancellation policy and resolution-center cases) so the panel can show a trend. This history keeps the last 180 days.
• Golden window: for each listing whose golden window you have measured, it records the calendar for the next 180 nights (the price the calendar shows for each night, and whether that night is still free) in about seven requests per listing, made one at a time. It keeps up to 400 days of these records, so the golden window can later compare the prices you showed with when nights sold.
• Extra nights: if you have opened the Extra nights panel for at least one listing, it reads the first page of your account's reservations list, in one request, at most once every six hours (four times a day at most, and only while that day's other background readings have not been stopped). It uses it to notice new and cancelled reservations next to free nights, and to confirm extensions you offered. From that page it keeps only each reservation's code, listing, dates, nights, status and payout, never guest names, phone numbers or guest account numbers, and forgets a reservation 60 days after its checkout.

For all three:

• They read only your own listings (the ones in the listing list of the Airbnb account that is signed in), and only the ones whose reading was started from those panels in this browser (for Extra nights, the reservations of that same account). They never write anything to Airbnb and never read guest conversations.
• Nothing from these readings leaves your browser on its own, and none of it is sent to our servers. The Signals figures and trends built from them are sent to OpenAI only if you press one of Signals' AI buttons (see AI Processing).
• They run only while you are signed in to the Extension. The Signals reading also waits until you have accepted the data-use dialog.
• You can turn all three off at any time: Extension options → Daily background reading. With it off, nothing is read in the background; what is read while you use Airbnb is listed under "Reading That Happens Without a Click".
• Signing out or turning the switch off stops new readings but does not delete what is already stored; uninstalling the Extension deletes it.

Reading That Happens Without a Click

• Booking window band (multicalendar): when the multicalendar opens on a listing, the Extension reads that listing's booking-window average from your Airbnb performance page. In this version it does so even if you are not signed in to the Extension. It keeps the answer on your device with the time it was read, whether the read brought a figure or not, and does not read that listing again until that answer is 12 hours old. The one exception is a read that brought no figure: the band's switch then says so, and pressing it tries again. Turning the band off with its own "Booking window" switch, on the year view's heading row, stops that reading.
• Panels you left open, such as the market pulse row, open again and read again when you come back to the multicalendar while signed in.
• Net card (multicalendar): when you select nights while signed in, the Extension reads that listing's cleaning fees and length-of-stay discounts from its Airbnb pricing page, so the card can show what you keep. It reads them once and keeps them while you stay on that listing; after a failed read it waits a minute before trying again.
• Voice profile check (reply drafter): if you created a voice profile, opening the drafter reads your inbox list once (one message per conversation), at most once a day, to see whether you have new conversations to learn from, and suggests updating. It sends nothing anywhere.
• The net figure under the price of each night that can still be booked, and the unsold figure on each collapsed month strip, are arithmetic on the prices already on the page; nothing is requested for them.
• While you use Airbnb, the Extension updates your account profile on our server (language, extension version, the hour of your last use) at most once per clock hour, and again whenever you sign in or the Extension's language or version changes. It reads nothing from Airbnb for that, and it has no switch.

What Data Do We NOT Collect?

• We do not store your conversation text or guest messages on our servers
• We do not store AI-generated responses on our servers
• We do not store your OpenAI API key (free plan) on our servers
• The Extension does not sell, share, or monetize any of your data; our website's "Equip your rental" and stayKit pages carry Amazon affiliate links and Amazon's product photos, described under "Our Website"
• The Extension does not set cookies or use web tracking mechanisms (our website's Analytics cookies, and any Amazon sets from the product photos on its "Equip your rental" and stayKit pages, are covered under "Our Website", and the YouTube player you start from a video guide, which is Google's, under "Video Guides")
• We do not access any Airbnb data beyond what your own host account can already see; some of it is read from Airbnb's own web API with your logged-in session, not only from the page you are viewing

Video Guides

The Extension offers a short YouTube video for each of its tools. On an Airbnb page, when a tool is on screen, a small popup in the bottom-right corner offers that tool's video; with several on screen it reads "1 of N", and you can move between them, dismiss one or all of them, or minimize the popup. The options page offers the account and settings video the same way.

• Nothing reaches YouTube until you press play. Until then the video box is the Extension's own button: no player, thumbnail or script is loaded from YouTube. Showing dismissed guides again with "▶ Guides" or the toolbar icon (see below) loads nothing from YouTube either.
• When you press play on an Airbnb page, or a tool's own "▶ Video" button, which opens that tool's guide with the player already on, the popup loads YouTube's embedded player from www.youtube-nocookie.com. Google then receives what any embedded YouTube player receives: your IP address, your browser details and the video you watch, with the Airbnb page's domain as the referrer (for example www.airbnb.com, never the rest of the page's address). What the player keeps in your browser and records while you watch is up to Google, under Google's privacy policy.
• On the options page, YouTube does not play embedded videos inside an extension's own pages, so the same button opens the video on youtube.com in a new tab instead, as any link to YouTube would. The "▶ Video" link in the data consent dialog does the same.
• "Read the guide", in the popup, opens that tool's guide on our website in a new tab (see "Our Website").
• Getting dismissed guides back: after a dismissal that leaves the popup empty, a notice offers "Undo" and "Open options" for about ten seconds. After that, a small "▶ Guides" button stays in the corner of any page whose guides you all dismissed, and shows them again. The Extension's icon (in Chrome's toolbar, or in its extensions menu if you have not pinned it) shows the guides of the Airbnb page you are on, dismissed ones included; on any other page, on an Airbnb page with no tool on screen, or with the guides turned off, it opens the options page instead. Showing them this way does not undo the dismissal: on another page, those guides stay dismissed.
• Stored on your device: which guides you dismissed, whether the popup is minimized and whether the guides are on are kept in chrome.storage.local in this browser; none of it is sent anywhere.
• Turn them off: Extension options → "Video guides". With them off, the popup, "▶ Guides" and every "▶ Video" button are gone. "Show dismissed guides again", in the same place, undoes every dismissal, so the popup offers those guides again on every page.

Google's privacy policy: policies.google.com/privacy

Our Website

Our website, str-host-assistant.web.app, is the Extension's own website. You can sign in there with the same Google account as in the Extension, and the two share that sign-in in your browser, as described under "One Sign-In for the Extension and Our Website". Apart from that sign-in, the Extension sends the website nothing and the website sends the Extension nothing.

• Signing in: "Sign in", at the top of every page, opens Google's sign-in window (through str-host-assistant.firebaseapp.com, our Firebase project's own sign-in address), and Firebase Authentication, Google's sign-in service, opens your account: the same account, with the same user ID, as in the Extension. The website keeps that session in this browser's storage for the website (IndexedDB): your user ID, name, email address and profile photo address, and the tokens that keep you signed in. While you are signed in, its pages talk to Firebase Authentication (identitytoolkit.googleapis.com and securetoken.googleapis.com) to keep that session valid. In its local storage it keeps two timestamps and nothing else of the sign-in: aha-cuenta-entrada, when you last signed in there with a click, and aha-cuenta-salida, when you last signed out there. The website itself writes nothing to our database (Firebase Firestore); the account profile described under "Server-Side Storage" is written by the Extension, also when the website signs it in. In Safari, and on phones and tablets, every page loads Google's sign-in helper as it opens (a script from apis.google.com and a hidden frame from str-host-assistant.firebaseapp.com), so that the sign-in window is not blocked when you press "Sign in"; in other browsers that helper loads only when you press it. "Sign out", in the menu with your name, ends the session on the website.
• Google Analytics: counts visits to the website. It loads, and sets its cookies (_ga and _ga_CJRNWYS3KF), only after you press "Accept" in the cookie notice; until then nothing is sent to Google Analytics. "Decline" takes one click, like "Accept", and "Cookie settings" at the foot of every page lets you change your choice; withdrawing it deletes those cookies. Your choice is remembered in this browser's local storage for the website. It never covers anything you do inside the Extension or on Airbnb.
• Google Fonts: the website's pages load the Fraunces and Inter typefaces from Google Fonts, so opening a page sends your IP address and browser details to Google's font servers.
• YouTube: each guide page under /docs and /es/docs embeds its video with YouTube's player from www.youtube-nocookie.com. Unlike the Extension's popup, the website does not wait for a click: the player sits just under the guide's introduction and loads as the page opens (it is marked to load lazily, which only defers it while it is far from the screen), whatever you chose in the cookie notice, which covers Google Analytics only. Loading it sends Google your IP address, your browser details, which video the page shows and the website's domain as the referrer; what the player keeps and records is under Google's privacy policy.
• Amazon: our "Equip your rental" pages, /equip-your-rental and /es/equipa-tu-alojamiento, list products for an Airbnb, each with a photo from Amazon and a link to it on amazon.com. The photos load from Amazon's servers (ws-na.amazon-adsystem.com, and images-na.ssl-images-amazon.com when that one fails) as the page shows them (they are marked to load lazily, which only defers those far from the screen), whatever you chose in the cookie notice, which covers Google Analytics only. Each photo sends Amazon your IP address, your browser details, which product it shows and our Amazon Associates tag; the page asks your browser to send no referrer with them. Amazon may read or set its own cookies there, under Amazon's privacy notice. The product links are affiliate links: following one opens amazon.com in a new tab with our Associates tag and the website's domain as the referrer, and as an Amazon Associate we earn from qualifying purchases. Amazon's reports to us show which products were ordered, not who ordered them. The starter-kit items you tick and the optional kit sections you add are remembered in this browser's local storage for the website and sent nowhere; "Copy list" writes to your clipboard only when you press it.
• Amazon on stayKit: our stayKit pages, /staykit and /es/staykit, list products to equip a rental, each with a photo from Amazon and a link to it on amazon.com. The photos load from Amazon's servers (m.media-amazon.com, and ws-na.amazon-adsystem.com when that one fails) as the page shows them (they are marked to load lazily, which only defers those far from the screen), whatever you chose in the cookie notice, which covers Google Analytics only. Each photo sends Amazon your IP address, your browser details and which product it shows, and one from ws-na.amazon-adsystem.com also our Amazon Associates tag; the page asks your browser to send no referrer with them. Amazon may read or set its own cookies there, under Amazon's privacy notice. The product links are affiliate links, as on the "Equip your rental" pages. The property type, the number of guests, the section you show, the products you save to "My selection" or mark "I have it", and whether you closed its welcome tip are remembered in this browser's local storage for the website and sent nowhere; "Copy list" writes to your clipboard and "Export CSV" saves a file on your device only when you press them, and neither carries our Associates tag.

Amazon's privacy notice: www.amazon.com/privacy

One Sign-In for the Extension and Our Website

The Extension and our website sign you in to the same account, so that signing in or out on one does the same on the other, in the same browser. For that, our website's pages talk to the Extension inside your browser. If the Extension is not installed, they ask nothing.

• Only our website: the Extension answers only pages of str-host-assistant.web.app open in a browser tab (not frames inside other pages, other websites or other extensions), and only four requests: who is signed in, a sign-in pass, sign in with the website's account, and sign out.
• What a page of the website learns: whether the Extension is signed in and, if it is, the account's user ID, email address and name, and when that sign-in began; and when you last signed out of the Extension on purpose. Each page asks as it opens, and again when you come back to it (at most once every 30 seconds), whether or not you are signed in on the website. The page uses the answer only to decide what to do, as described below, and to show the Extension's email address when the two accounts differ; it sends it nowhere.
• The sign-in pass: to sign one side in with the other's account, the Extension asks our server (Firebase Cloud Functions) for a sign-in pass. Our server creates it only from a valid, unrevoked sign-in token, and only for that token's own account. The pass is valid for one hour; the side that receives it uses it once, with Firebase Authentication, to start its own session, and does not keep it. When it is the website that signs the Extension in, the website gives the Extension its own sign-in token for this, which the Extension sends to our server only when it is going to sign in with it, and does not keep. Our server writes neither the sign-in token it receives nor the pass to its logs, and keeps nothing of the pass except, in memory only, the times each account got one, counted for ten minutes to limit how many passes an account can get.
• What never passes: your OpenAI API key, your settings, and anything the Extension reads from Airbnb or stores never reach the website, and none of it goes to our server through this. The website gives the Extension only its sign-in token and its account's user ID, and asks it to sign in or out.
• Without a click:
  • When the Extension is signed in and the website is not, opening a page of the website signs it in with the Extension's account, unless you have signed out on the website since the Extension signed in.
  • When the website is signed in and the Extension is not, the Extension signs in with the website's account, unless you signed out of the Extension on purpose; then only pressing "Sign in" on the website signs the Extension in again. As at any sign-in, the Extension then updates your account profile on our server (see "Server-Side Storage").
  • When you first install the Extension, it opens our website's home page in a new tab, once (in Spanish if Chrome's language is Spanish); if you are already signed in there, that page signs the Extension in with the same account. Updates open nothing.
• Signing out: signing out on the website signs the Extension out too, at once. Signing out of the Extension on purpose (Extension options → "Sign out") signs the website out too, the next time one of its pages opens or you come back to one, unless you have signed in on the website with a click since.
• Two accounts: if the Extension and the website are signed in with different accounts, neither changes on its own, and signing out of one does not sign the other out. The website shows both email addresses, with a button to use either one on both sides.
• What the Extension keeps: next to its sign-in, whether it came from the Extension or from the website, when it began, and when you last signed out on purpose and from which account (its user ID), in chrome.storage.local, on this device only. Its options say "(from the website)" next to your account when the sign-in came from the website.

Payment Processing

If you upgrade to Premium, payment is processed by Stripe. We do not handle or store your credit card information. Stripe processes your payment and notifies our server of your subscription status via secure webhooks. We store only your Stripe customer ID and subscription status, not payment details.

Stripe's privacy policy: stripe.com/privacy

Third-Party Services

The Extension and our website interface with the following third-party services:

Your Control Over Data

What You Can Do

• Sign Out: Sign out at any time in the Extension options (Account → "Sign out"). This clears your local authentication tokens, and signs our website out too in this browser (see "One Sign-In for the Extension and Our Website"); it does not delete the readings stored on this device. On our website, "Sign out" signs out the website and the Extension.
• Turn Off Background Reading: Extension options → "Daily background reading".
• Turn Off Video Guides: Extension options → "Video guides". "Show dismissed guides again", in the same place, brings back the ones you dismissed.
• Remove API Key: Change or remove your OpenAI API key at any time in the Extension options.
• Delete Your Voice Profile: in the reply drafter, "Your profile" → "Delete the whole profile" deletes everything the voice profile keeps on this device for that Airbnb account; each example and each saved fact can also be deleted on its own.
• Cancel Premium: Manage or cancel your subscription through the Stripe billing portal, opened with "Manage subscription" in the Extension options.
• Uninstall: Removing the extension deletes all locally stored data.

How to Delete Your Data

1. Local Data: Uninstall the extension from chrome://extensions/ — this removes all local storage.
2. Website Data: "Sign out" on our website ends its session; clearing str-host-assistant.web.app's site data in your browser removes the session and its two timestamps.
3. Server Data: To request deletion of your server-side data (user profile, usage counts, device identifier), contact us at the email below. We will delete your data within 30 days.
4. Stripe Data: Manage your payment data through the Stripe billing portal or contact Stripe directly.
5. OpenAI Data: Data sent to OpenAI is subject to their retention policy. Contact OpenAI for data deletion requests.

Data Security

Security Measures

• All server communication uses HTTPS encryption
• Firebase Authentication verifies user identity on every server request
• API keys (free plan) are stored in chrome.storage.sync — which Chrome may sync to your Google account and does not encrypt at rest — and are never sent to our servers
• Server-side OpenAI API keys (premium plan) are stored in Firebase Functions config, not in client code
• Device identifiers (Premium only) are sent as a SHA-256 hash; as explained above, the hash alone does not make them anonymous
• Firestore security rules restrict users to reading only their own data
• Stripe webhook signatures are verified to prevent spoofing
• The Extension answers sign-in requests only from pages of str-host-assistant.web.app open in a browser tab, and our server creates a sign-in pass only for the account whose valid sign-in token it receives
• Our website runs only its own scripts and Google's (the sign-in, and Analytics once you accept them), enforced by its Content Security Policy

Your Responsibility

• Keep your OpenAI API key confidential (free plan)
• Use a strong Google account password
• Sign out of the extension on shared computers (that signs our website out too)
• Review and understand OpenAI's and Stripe's security policies

Data Retention

Local Data

• Settings, conversation analyses and readings: Retained until you uninstall the Extension; a reading is replaced when it is read again
• Daily histories: trimmed automatically; Signals keeps the last 180 days, and the golden window's calendar records keep up to 400 days
• Voice profile: examples expire after 12 months; an inserted draft is kept up to 14 days until it is measured, then only the number remains; the rest stays until you delete it in "Your profile" or uninstall
• Authentication tokens: Retained until you sign out; the time of your last deliberate sign-out, and the user ID of the account you signed out of, are kept until you sign in again
• Our website's session: kept in the website's storage in this browser until you sign out (on the website, or in the Extension); its two timestamps are replaced by each sign-in or sign-out there and stay until you clear the website's data in your browser

Server-Side Data

• User profile: Retained as long as your account exists
• Usage counters: Retained as long as your account exists. Premium monthly counters reset on the 1st of each month.
• Device identifier: Retained until you ask us to delete it; it is not deleted automatically, even when an account that used it is deleted
• Counts and identifiers from earlier versions: The free-plan counts and device identifiers that earlier versions sent are retained until you ask us to delete them
• Subscription data: Retained as long as your Stripe subscription record exists

To request deletion of server-side data, contact us (see Contact Information below).

Third-Party Data

• OpenAI: Subject to OpenAI's data retention policy
• Stripe: Subject to Stripe's data retention policy
• Google Analytics (website only, if you accept): Website page-visit data, subject to Google's data retention settings (configured for automatic expiration). The Extension itself sends no analytics
• YouTube (video guides you play, and our website's guide pages): Subject to Google's data retention policy
• Amazon (our website's "Equip your rental" and stayKit pages): Subject to Amazon's privacy notice

Children's Privacy

The Extension is not intended for use by individuals under 18 years of age. We do not knowingly collect data from children. If you are under 18, please do not use this Extension.

Legal Basis for Processing (GDPR Compliance)

For users in the European Economic Area (EEA):

• Legal Basis: Consent (you choose to sign in and use AI features, and on our website you choose whether to accept Analytics cookies) and legitimate interests (usage tracking to prevent abuse, and, on our website, loading its typefaces, guide videos and Amazon's product photos as each page opens)
• Your Rights: Access, rectification, erasure, restriction, portability, and objection
• Data Controller: Jose Mendez is the data controller for server-side data
• Data Processors: Google (Firebase, and Analytics on our website), OpenAI, and Stripe process data on our behalf
• Amazon: a separate controller for what its product photos and links on our website send it, under Amazon's privacy notice
• Contact: See Contact Information below

California Privacy Rights (CCPA)

For California residents:

• We do not sell personal information. On our website's "Equip your rental" and stayKit pages, Amazon receives what its product photos and links send it (see "Our Website") and pays us a commission on qualifying purchases, never for your personal information
• You have the right to know what data we collect (described in this policy)
• You have the right to request deletion of your server-side data
• You have the right to opt out — you may uninstall the extension at any time

International Data Transfers

Your data may be transferred to and processed in:

• United States: OpenAI (AI processing), Stripe (payment processing), Google Cloud / Firebase (authentication, storage), Google Analytics and Google Fonts (website), YouTube (video guides you play, and the website's guide pages), Amazon (product photos and links on the website's "Equip your rental" and stayKit pages)

These transfers occur under the service providers' standard data processing agreements and are subject to their respective international data transfer policies.

Changes to This Policy

We may update this privacy policy to reflect changes in the Extension's functionality or legal requirements. Updates will be posted with a new "Last Updated" date. Continued use of the Extension after changes indicates acceptance of the updated policy.

Contact Information

• For technical support or privacy concerns: Create an issue at github.com/jomendez/str-host-assistant/issues
• For data deletion requests: strcopilot@gmail.com
• For privacy concerns about third-party services: Contact OpenAI, Google, Amazon, or Stripe directly

Consent

By installing and using AI Host Assistant for Airbnb, you consent to:

1. The Extension accessing message and booking data visible on Airbnb pages, and reading your own data from Airbnb with your session, including the background daily reading described above
2. Creating an account with your Google credentials on our Firebase server, with the user profile described above
3. Server-side tracking of your usage count and device identifier for abuse prevention (Premium accounts only)
4. OpenAI receiving what each AI feature sends, as listed under AI Processing, when you use it (via your own key or our premium server)
5. Local storage of settings, analysis results, readings and authentication data in your browser
6. The Extension and our website sharing your sign-in, as described under "One Sign-In for the Extension and Our Website"

You can withdraw consent at any time by signing out and uninstalling the Extension. To delete server-side data, contact us using the information above.

Disclaimer

The Extension is provided "as is" without warranties. We are not responsible for:

• How OpenAI, Google, Amazon, or Stripe handle your data
• Changes to Airbnb's interface that may affect functionality
• Accuracy of AI-generated analysis or responses
• Any decisions you make based on the Extension's suggestions