Privacy notice
What you share, who can see it and how to ask for help with your information.
Who is responsible
SuperIC LLC operates Neighborshare. This notice covers information handled through the website, accounts, exchanges, support, connected AI assistants and API keys, and walkthrough requests sent through the website. It also explains limits in the current account tools so you can make an informed choice.
Neighborshare is one app with neighborhood communities inside it, Sandbrockshare is its first community, and this notice covers the neighbor-share.com website and the Neighborshare app and its communities.
Contact us if you need access, correction, deletion or an explanation of a privacy decision. You can make a request without creating another account. Do not send a password, sign-in link or identity document in a support message.
Our support address is support@sandbrockshare.com. Privacy requests can also go to privacy@sandbrockshare.com.
Walkthrough requests on the website
The website has a form to request a walkthrough. It reads the name, email address, community and message you type, and the plan you chose if you opened the form from a plan.
When you send the form, the website emails those details to the SuperIC LLC team through Resend, with your email address as the reply address. The website does not keep its own copy of the request, and the form does not create an account.
To limit abuse, the website counts requests from each network address in the server's memory and refuses more than six in 15 minutes. That count is approximate and starts over when the server restarts. The form also has a hidden field that real visitors never see, and if it is filled in the website sends nothing.
If the website cannot send the email, the form opens a message to the team in your own email app instead, and nothing is sent until you send it from there.
Account and residency information
Account information includes your email, account identifiers, profile name and any optional photo, biography, phone number or profile details you provide. Authentication and account state help us secure access and apply membership restrictions.
When you sign in with Google, Google shares your name, email address and profile photo with Neighborshare. We use them to create your account and sign you in, and your Google name and photo fill in your profile name and photo, which other neighbors can see, until you change them.
Residency applications include the address you give, location information used to check the neighborhood boundary, an adult attestation, the method you choose and the records needed to review it. References, mail-code delivery details, corrections, reasons and decisions may also be recorded.
The current residency process uses an adult attestation. It does not require a birth date or an uploaded identity document. Application addresses and evidence are kept separately from the public profile and limited to the applicant and authorized review functions. Residency access is logged.
Offers, exchanges and payments
We handle the offers, asks, images, messages, plans, agreement state and records you create while sharing. These may identify participants, timing, amounts, handoff details, payment status and changes.
Where payment features are enabled, Stripe handles payment details and provider onboarding. The service stores payment and connected-account references, amounts and status needed to operate payments, refunds, disputes and payouts. The website does not ask you to put full card or bank details into a message.
Information you post publicly may be copied by others. Keep addresses and personal contact details out of public listing descriptions, images and asks.
Public information and private conversations
Listing information and selected profile fields can be publicly readable, including outside a signed-in session. Uploaded avatar images use public image URLs. Do not treat a profile or its photo as confidential.
Conversation access is based on participation and may include more than two people. Authorized operational access may be needed to investigate abuse or support a request. Do not use messages to store credentials or sensitive documents.
The private residency process does not establish privacy for every exchange location. Some existing listing location fields are still broadly readable. Until those controls are replaced, do not enter a home address or precise private pickup coordinates in public listing fields.
We are working toward permission-based, time-limited location sharing. That work is not a promise that existing listing coordinates already have those protections.
Support requests and abuse prevention
Support saves the topic and message you submit, an optional reply email, and any applicable account or authorized exchange reference. Request identifiers and receipt records let you check whether a submission was saved without sending it again.
Choosing no contact omits the reply email and account association from that request. The message itself and an abuse-prevention network identifier are still recorded. It is not an untraceable channel; avoid including information you do not want to share.
The network identifier is produced with a keyed transformation rather than saving a raw network address in the support request. Hosting and delivery services may separately process connection information as part of operating the website.
AI assistants and API keys
You can connect an AI assistant with Neighborshare sign-in, or create a personal API key for your own tools. Either one acts as you and sees only what your account can already see in the app.
A connection can read listings and asks, including the first name a neighbor shows on them, and your own listings, drafts and sharing activity. With permission to write, it can also save a listing draft for you to review and post in the app. It cannot read messages, publish a listing, pay, change a booking, delete your account, or change your email or password.
We do not receive your conversation with an assistant, only the requests it sends to our tools. We keep what a request saves, such as a draft, and not the words of other requests, such as a search. We do not sell information from a connection or use it for advertising.
The company that runs your assistant, such as Anthropic, OpenAI, xAI, Google, Mistral or Cursor, receives the results of those requests. It handles them under its own terms and privacy policy, not this notice.
WorkOS runs the sign-in for assistants. When you connect one, WorkOS receives your account identifier, your email address and, if your sign-in has one, your name. It keeps a record of the connection and when it was made. Records WorkOS holds follow its own retention.
For each API key we store the name you give it, its permissions, its first characters so you can recognize it, when it was created and last used, and when it expires or was rotated or revoked. We store a keyed hash of the key, never the key itself, and a keyed hash of the network address that last used it.
We count each request from a key or an assistant toward your account's limits. Request counts and the record of key activity, such as creating, using, rotating or revoking a key, are deleted after 30 days. A key's own record stays with your account after it is revoked or expires; we have not set an automatic deletion schedule for it.
Settings > Developer lists your connected assistants and your API keys. Revoke an assistant there to sign it out; access it already holds ends within minutes. You can also rotate or revoke a key there. A revoked key stops working on its next request. A rotated key keeps working for up to 7 days, so revoke a key you think someone else has. Keys expire after the period you choose, up to a year. Deleting your account revokes your keys and signs out your assistants.
Storage on your device
The neighbor-share.com website does not keep anything in browser storage. The rest of this section describes the Neighborshare app.
The site uses browser storage for preferences, limited recovery identifiers and certain unfinished drafts. Support recovery stores request metadata rather than your message or reply email. Other forms, such as listing drafts, may retain typed draft fields in the current browser session.
Clearing browser storage or using another device can remove recovery information and unfinished drafts.
The website may cache public pages for loading and connection recovery. Sign out on a shared device and do not rely on browser storage as a permanent copy of a request or agreement.
Service providers and disclosure
The service uses Supabase for account, database and storage functions, Stripe for enabled payment functions, Resend for enabled email delivery and WorkOS for enabled assistant sign-in. Vercel hosts the website and processes the requests needed to deliver the service. Each provider receives the information needed for its role.
When enabled, Sentry receives error and performance diagnostics, which can include page or request references and information about the browser or device. Session recording is disabled in the current source configuration.
We may disclose relevant information when required by law or necessary to investigate abuse, protect people or resolve a transaction. This does not make private application information generally available to neighbors, an HOA or a developer.
Selling personal information, advertising targeting and public trust scores are not part of the adopted product. Optional measurement needs its own reviewed configuration and disclosure before activation.
Retention and the current account tools
Records may be needed to operate an account, fulfill an agreement, investigate a case, reconcile a payment or meet a legal obligation. We have not established a complete automatic deletion schedule for every category. An expired code or closed request does not by itself prove that its record has been erased.
The account export includes your profile, listings, agreements, reviews, messages you sent, favorites, notifications, support requests, asks, residency application, address verification records and invites, and a list of the files stored under your account. It does not include messages other people sent, earlier policy acceptances, payment-processor records, tax reports or server-side logs. Request a fuller copy through support if the download does not cover what you need.
While an item is out with a borrower, an agreement is in a dispute or a paid booking is still open, account deletion is refused and nothing changes until that is finished. Otherwise the pending requests and unpaid approved bookings you are part of are canceled, and each neighbor is told as with any cancellation. Before anything is canceled, deletion signs you out on every device, blocks sign-in, replaces the account email with a placeholder, clears the name, email and photo your sign-in provider shared, and removes your phone number and linked social sign-in. Only after that does it clear your profile details, remove the titles of your Plans and the link to your payment account, take your listings down and clear their descriptions and locations, delete your address verification records, the address on your residency application, your favorites, notifications and push notification settings, your saved handoff location and the handoff locations you shared, close your open Asks and clear the text of every Ask you wrote, delete the record of the Asks you offered to help with, revoke the invites you issued, and delete the files stored under your account. It does not erase the account record itself, agreements (apart from the note you wrote on a request), reviews, payouts, conversations, the messages you sent, the title of a closed Ask, the decision on your residency application, the record that you accepted these policies and of the actions you took, the rides you were part of, safety reports made by you or about you, or the record of your deletion request, and it keeps a handoff photo attached to an exchange. Records our payment processor holds follow its own retention. Request deletion through support and identify any records or concern you want addressed; do not assume a closed login means complete erasure.
A deletion request may need to preserve information for an unresolved obligation or applicable law. Ask us to identify what remains, why it is retained and what can be removed.
Requests, corrections and review
You can ask for a copy, correction or deletion of your information, or an explanation of how it is used. We may need enough information to verify that the request concerns you, without collecting unnecessary details.
If you disagree with a privacy decision, reply with the request reference and ask for review. Explain what you believe is missing or incorrect. Rights and deadlines can depend on the laws that apply; this notice does not limit those rights.
Children and sensitive information
Accounts and exchange commitments are for adults. Do not create an account for a child or post a child's identifying details. Children shown in illustrations do not represent account eligibility.
Contact support if you believe a child's information or another person's private information has been submitted improperly. Include a link or reference when possible, rather than copying the sensitive material into another message.
Changes to this notice
A material change receives a distinct revision. Account setup identifies the notice being acknowledged. A new revision does not backdate consent or activate a new data use.