Privacy Policy for AI Host Assistant for Airbnb

Last Updated: September 7, 2026

Overview

AI Host Assistant for Airbnb ("the Extension") is a browser extension designed to help short-term rental hosts manage their guest communications more effectively. This privacy policy explains what data the Extension accesses, what is stored locally, what is sent to our servers, and how third-party services are involved.

What Data Does the Extension Access?

The Extension accesses the following data within your browser:

Message Content: Text from your conversations with guests on Airbnb
Guest and Booking Information: Names, booking details, and reservation information visible on the platform
Calendar Data: Pricing, availability, and monthly performance data for your own listings, read from the Airbnb multi-calendar page and from Airbnb's host API using your own session
Listing Data: Your listing's texts, settings, reviews, and performance metrics, used by the listing health review and the hospitality audit
Guest Profiles: A guest's public Airbnb profile and the public reviews written about them, used by guest screening. To gauge whether the guest returns reviews, the screening also reads the public profiles and public reviews of the other hosts who reviewed that guest; this happens on your device to produce a simple reciprocity count, and those other hosts' details are not sent to us or to OpenAI
Market Search Results: Public search results for other listings in your area, used by the filter gap finder

Authentication

The Extension requires you to sign in with a Google account before use. When you sign in:

Your Google email address, display name, and a unique user ID are stored on our server (Firebase Firestore) to manage your account
Authentication tokens are stored locally in your browser and used to verify your identity on each server request
We use Google OAuth through Chrome's chrome.identity API; we never see or store your Google password

How Is Your Data Used?

Local Storage (Your Browser)

Extension Settings: Preferences such as language, tone style, and plan type are stored in chrome.storage.sync
API Keys: Your personal OpenAI API key (free plan only) is stored in chrome.storage.sync and never sent to our servers
Conversation State: Drafts, readings and screening results are cached locally in chrome.storage.local so you can navigate away and return without asking again
Subscription Cache: Your subscription status is cached locally for up to 5 minutes to reduce server requests

Server-Side Storage (Firebase Firestore)

When you use the Extension, the following data is stored on our servers:

User Profile: Email address, display name, account creation date, last login date, and subscription tier
Usage Counters: For the premium plan, a monthly count of AI interactions. The free plan is currently unlimited and reports no usage. We store the count only, not the content of your conversations
Device Fingerprint: A hashed identifier derived from non-identifying browser characteristics (screen resolution, language, timezone, hardware specs). This is used solely to enforce per-device usage limits and prevent abuse. The fingerprint is a one-way hash — it cannot be reversed to identify you or your device
Subscription Data: Your Stripe customer ID, subscription status, and billing period dates

AI Processing

When you use an AI feature — Draft a reply (⚡), Hospitality audit, Listing health, or Guest screening — the relevant data (conversation and reservation details, your own listing texts and photos, or the guest's public profile) is sent to OpenAI for AI processing:

Free plan: API calls go directly from your browser to OpenAI using your own API key. Our servers are not involved in the AI processing.
Premium plan: API calls are routed through our server (Firebase Cloud Functions) to OpenAI using a server-managed API key. Your conversation data passes through our server but is not logged, stored, or retained. It is forwarded to OpenAI and discarded.

In both cases, the data handling by OpenAI is subject to their privacy policy: openai.com/policies/privacy-policy

Analytics

The Extension sends no usage analytics. It does not talk to Google Analytics or any analytics service from inside your browser. (Earlier versions did; that was removed.)

Our marketing website, https://str-host-assistant.web.app, uses Google Analytics to measure page visits. That is separate from the Extension and covers only visits to the website — never anything you do inside the Extension or on Airbnb.

Background Daily Reading

Once you have opened the Listing Health panel for a listing, the Extension asks Chrome to wake it up every six hours and read that listing's own public performance data from Airbnb — the same figures the panel shows — so it can record a daily point and show you a trend. This happens in the background, with no Airbnb tab open, using your own logged-in Airbnb session.

It reads only your own listings, and only listings whose health panel you have opened at least once.
It reads performance metrics, pricing, reviews, Superhost status and resolution-center cases. It never writes anything to Airbnb and never reads guest conversations.
Nothing from this reading leaves your browser: it is stored locally and is not sent to our servers or to OpenAI.
It does not run until you have accepted the data-use dialog and are signed in to the Extension.
You can turn it off at any time: Extension options → Daily listing health reading. With it off, a listing is read only when you open the panel yourself.

What Data Do We NOT Collect?

We do not store your conversation text or guest messages on our servers
We do not store AI-generated responses on our servers
We do not store your OpenAI API key (free plan) on our servers
We do not sell, share, or monetize any of your data
We do not use cookies or web tracking mechanisms
We do not access any Airbnb data beyond what your own host account can already see; some of it is read from Airbnb's own web API with your logged-in session, not only from the page you are viewing

Payment Processing

If you upgrade to Premium, payment is processed by Stripe. We do not handle or store your credit card information. Stripe processes your payment and notifies our server of your subscription status via secure webhooks. We store only your Stripe customer ID and subscription status, not payment details.

Stripe's privacy policy: stripe.com/privacy

Third-Party Services

The Extension interfaces with the following third-party services:

Service	Purpose	Data Shared
OpenAI	AI reply drafting, guest screening, listing health and copy audit	Conversation text and reservation details (reply drafter); your own listing's texts and first photos (audit, reply drafter, listing health); a guest's public profile and the public reviews about them (guest screening). Only when you press the button that asks for it.
Google (Firebase Auth)	User authentication	Email, display name, user ID
Google (Firebase Firestore)	Usage tracking and account management	Usage counts, subscription status, device fingerprint hash
Google Analytics	Website (landing page) analytics — separate from the extension	Page visits to str-host-assistant.web.app only; never extension or Airbnb activity
Stripe	Payment processing (Premium only)	Handled by Stripe directly; we receive only subscription status
Airbnb	Host platform (read-only requests to Airbnb pages and to Airbnb's own web API, using your session)	Only the read requests themselves; the Extension writes nothing to Airbnb

Your Control Over Data

What You Can Do

Sign Out: Sign out from the extension panel at any time. This clears your local authentication tokens.
Clear Local Data: Remove all locally stored data via Chrome's extension settings or by uninstalling.
Remove API Key: Change or remove your OpenAI API key at any time in the extension options.
Cancel Premium: Manage or cancel your subscription through the Stripe billing portal, accessible from the extension panel.
Uninstall: Removing the extension deletes all locally stored data.

How to Delete Your Data

Local Data: Uninstall the extension from chrome://extensions/ — this removes all local storage.
Server Data: To request deletion of your server-side data (user profile, usage counts, device fingerprint), contact us at the email below. We will delete your data within 30 days.
Stripe Data: Manage your payment data through the Stripe billing portal or contact Stripe directly.
OpenAI Data: Data sent to OpenAI is subject to their retention policy. Contact OpenAI for data deletion requests.

Data Security

Security Measures

All server communication uses HTTPS encryption
Firebase Authentication verifies user identity on every server request
API keys (free plan) are stored in chrome.storage.sync — which Chrome may sync to your Google account and does not encrypt at rest — and are never sent to our servers
Server-side OpenAI API keys (premium plan) are stored in Firebase Functions config, not in client code
Device fingerprints are one-way hashed (SHA-256) before transmission
Firestore security rules restrict users to reading only their own data
Stripe webhook signatures are verified to prevent spoofing

Your Responsibility

Keep your OpenAI API key confidential (free plan)
Use a strong Google account password
Sign out of the extension on shared computers
Review and understand OpenAI's and Stripe's security policies

Data Retention

Local Data

Conversation analyses and settings: Retained until you clear them or uninstall
Authentication tokens: Retained until you sign out or they expire
No automatic expiration — you have full control

Server-Side Data

User profile: Retained as long as your account exists
Usage counters: Retained as long as your account exists. Premium monthly counters reset on the 1st of each month.
Device fingerprint: Retained as long as the associated account exists
Subscription data: Retained as long as your Stripe subscription record exists

To request deletion of server-side data, contact us (see Contact Information below).

Third-Party Data

OpenAI: Subject to OpenAI's data retention policy
Stripe: Subject to Stripe's data retention policy
Google Analytics (website only): Website page-visit data, subject to Google's data retention settings (configured for automatic expiration). The Extension itself sends no analytics

Children's Privacy

The Extension is not intended for use by individuals under 18 years of age. We do not knowingly collect data from children. If you are under 18, please do not use this Extension.

For users in the European Economic Area (EEA):

Legal Basis: Consent (you choose to sign in and use AI features) and legitimate interests (usage tracking to prevent abuse)
Your Rights: Access, rectification, erasure, restriction, portability, and objection
Data Controller: Jose Mendez is the data controller for server-side data
Data Processors: Google (Firebase), OpenAI, and Stripe process data on our behalf
Contact: See Contact Information below

California Privacy Rights (CCPA)

For California residents:

We do not sell personal information
You have the right to know what data we collect (described in this policy)
You have the right to request deletion of your server-side data
You have the right to opt out — you may uninstall the extension at any time

International Data Transfers

Your data may be transferred to and processed in:

United States: OpenAI (AI processing), Stripe (payment processing), Google Cloud / Firebase (authentication, storage, analytics)

These transfers occur under the service providers' standard data processing agreements and are subject to their respective international data transfer policies.

Changes to This Policy

We may update this privacy policy to reflect changes in the Extension's functionality or legal requirements. Updates will be posted with a new "Last Updated" date. Continued use of the Extension after changes indicates acceptance of the updated policy.

Contact Information

For technical support or privacy concerns: Create an issue at github.com/jomendez/str-host-assistant
For data deletion requests: strcopilot@gmail.com
For privacy concerns about third-party services: Contact OpenAI, Google, or Stripe directly

By installing and using AI Host Assistant for Airbnb, you consent to:

The Extension accessing message and booking data visible on Airbnb pages
Creating an account with your Google credentials on our Firebase server
Server-side tracking of your usage count and device fingerprint for abuse prevention
OpenAI receiving conversation content when you use AI features (via your own key or our premium server)
Local storage of settings, analysis results, and authentication data in your browser

You can withdraw consent at any time by signing out and uninstalling the Extension. To delete server-side data, contact us using the information above.

Disclaimer

The Extension is provided "as is" without warranties. We are not responsible for:

How OpenAI, Google, or Stripe handle your data
Changes to Airbnb's interface that may affect functionality
Accuracy of AI-generated analysis or responses
Any decisions you make based on the Extension's suggestions

Summary: AI Host Assistant for Airbnb stores your extension settings and API keys locally in your browser. Server-side, we store your user profile, usage counts, and device fingerprint for account management and abuse prevention. When you use AI features, conversation text is sent to OpenAI for processing (directly on the free plan, through our server on the premium plan) but is never stored on our servers. The Extension sends no usage analytics. You can delete all local data by uninstalling and request server-side data deletion by contacting us.