Effective Date: October 4, 2026 · Version 1.6
Applies to: nably.co
Nably, LLC ("Nably," "we," "us," or "our") operates a peer-to-peer rental marketplace accessible at nably.co (the "Platform"). The Platform connects individuals and businesses who list vacation gear, outdoor and recreational equipment, and event services ("Hosts") with individuals who book those listings ("Renters"). Nably acts as an intermediary facilitating transactions between Hosts and Renters; it does not own, store, or physically handle any listed items or services.
This Privacy Policy explains what personal information we collect, how we use it, with whom we share it, and your rights regarding that information. It applies to all users of the Platform, including Hosts, Renters, and visitors who browse without an account.
By creating an account, making or accepting a booking, or otherwise using the Platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our practices, do not use the Platform.
When you register for an account, make a booking, create a listing, or communicate through the Platform, you may provide:
When you use the Platform, we and our third-party service providers may automatically collect:
Authentication tokens are stored in httpOnly, Secure cookies scoped to the nably.co domain. These are not accessible to JavaScript and are not used for advertising purposes.
We receive limited information from the following third-party service providers:
We use the information we collect for the following purposes:
We process your personal information to operate the Platform and provide the services you request, as described in Section 3. The principal purposes for which we process information include:
If you are a resident of California, Virginia, Colorado, Connecticut, or another state that has enacted a comprehensive consumer privacy law, and to the extent that law applies to Nably's processing of your personal information, you may have some or all of the following rights, subject to the exceptions and verification requirements set out in the applicable law.
You may submit a request to exercise these rights by emailing [email protected] with the subject line "Privacy Rights Request." We will need to verify your identity before responding, which may require you to confirm information already associated with your account. You may designate an authorized agent to submit a request on your behalf; we may require the agent to provide proof of authorization and may still require you to directly verify your own identity or confirm the agent's authority. We will respond to a verified request within 45 days, with one 45-day extension available where reasonably necessary, and we will notify you if an extension applies.
You may submit an opt-out request at any time via the "Do Not Sell or Share My Info" link in the Platform footer (see Section 9.1), or by emailing [email protected]. We also honor opt-out preference signals sent through your browser or device, such as the Global Privacy Control, to the extent we are able to reliably associate that signal with your visit — when your browser or device sends this signal, our advertising and analytics tags are automatically disabled for that visit, to the same effect as using the footer link.
If we decline to take action on your request, and you reside in a state that provides a right to appeal, you may appeal our decision by emailing [email protected] with the subject line "Privacy Rights Appeal" within a reasonable time after our decision. We will respond to your appeal within 60 days. If we deny your appeal, we will provide a method for you to contact the state attorney general or other applicable regulator to submit a complaint, where required by law.
This Section 4A applies only to the extent Nably meets the applicability thresholds of the relevant state law and to residents of that state. It does not expand any right beyond what the applicable law requires, and it will be updated as Nably's user base and the applicable statutory landscape develop.
Nably uses a deliberate, staged disclosure model to protect the personal information of both Hosts and Renters until a booking is confirmed and nearing its start date. This model works as follows:
Public Listings: Host public profiles display the Host's name or business name and general area (city or neighborhood). Precise addresses are never shown on public listings.
At Booking Confirmation: Once a booking is confirmed and payment is processed, the Renter receives confirmation of the booking details along with the listing's general area, and the Host receives the general area of the delivery location together with the approximate distance to it. Each of these is an area, not a point: it is shown as a region of the map sized so that any location within it lies within approximately half a mile of that region's center, and the accompanying distance is rounded to the nearest half mile. Neither precise addresses nor precise coordinates are disclosed at this stage, except where a Renter has expressly chosen at checkout to share their delivery address with the Host immediately upon confirmation (see below).
Optional Host-Required Contact Sharing: Some Hosts require Renters to share their email address (and, optionally, phone number) as a condition of booking their listing, for scheduling and confirmation purposes. This requirement is disclosed on the listing itself before booking, and Renters must affirmatively consent via a checkbox before completing such a booking. If provided, this contact information is shared with the Host only once the booking reaches confirmed status (or, for Request-to-Book listings, once the Host approves the request) — never before, and never for bookings made before this consent was given.
24 Hours Before Rental Start: Approximately 24 hours before the scheduled pickup or delivery time, the Renter is provided with the full, precise pickup address, and the Host is provided with the Renter's precise delivery address. For delivery bookings this is the address the Renter provided at checkout, which is decrypted from encrypted storage at that time. Bookings made before this policy took effect retain the twelve-hour window that applied when they were made.
Purpose of Staged Disclosure: This model is designed to encourage all communication and coordination to occur through the Platform's in-app messaging system, protect user contact information from unnecessary early disclosure, and reduce off-platform transactions that circumvent Platform protections.
Renter-Controlled Early Release: At checkout, a Renter arranging delivery may choose to share their delivery address with the Host as soon as the booking is confirmed, rather than waiting for the 24-hour window. This choice is the Renter's alone, is never made on their behalf, and is not required in order to book. A Renter who did not make that choice at checkout may still make it later from their booking. Because a Host cannot un-see an address once shown, the choice cannot be reversed. For request-to-book listings, no address is disclosed unless and until the Host accepts the booking; a Host who declines never receives it.
Delivery addresses provided by Renters at checkout are encrypted using AES-256-CBC encryption and stored securely. The decrypted address is transmitted only through automated system processes at the applicable disclosure moment and is not accessible to Nably employees except for the limited purposes of dispute resolution and legal compliance.
We do not sell your personal information. We share information only in the following circumstances:
As described in Section 5, Host and Renter contact information is shared between the parties to a confirmed booking within the limited timeframes described. Public Host profiles, including name or business name, profile photo, and listing details, are visible to all Platform users. Where a Host has enabled the optional contact-sharing requirement described in Section 5, and the Renter has consented, the Renter's email and (if provided) phone number are additionally shared with that Host upon booking confirmation.
We share information with third-party service providers who assist us in operating the Platform, subject to confidentiality obligations. Current service providers include:
We may disclose your information if we believe in good faith that disclosure is necessary to: comply with applicable law or legal process; respond to lawful requests from government authorities; protect the rights, property, or safety of Nably, our users, or the public; or enforce our Terms of Service or other agreements.
If Nably is involved in a merger, acquisition, asset sale, or similar transaction, your information may be transferred as part of that transaction. We will provide notice before your information is transferred and becomes subject to a different privacy policy.
We may share your information for any other purpose with your explicit consent.
We retain your personal information for as long as necessary to provide the Platform's services and for the additional periods described below:
Unsubscribe preferences and opt-out records are retained indefinitely to ensure we honor your communication preferences.
You may access and update your account information, including your name, phone number, email address, profile photo, and biography, by visiting your Profile page within the Platform.
You may opt out of marketing emails at any time by clicking the unsubscribe link included in every marketing email, or by contacting us at [email protected]. Transactional emails related to your active bookings, account security, and Platform activity are not subject to marketing opt-out and will continue to be sent as necessary.
Your opt-out preference is recorded in both our Platform database and our email service provider (SendGrid) and takes effect promptly, typically within 10 business days.
You may request access to the personal information we hold about you, or request deletion of your account and associated data, by contacting us at [email protected]. We will respond to verified requests within 45 days. Requests may be subject to identity verification and to applicable legal exceptions, including our 90-day post-deletion retention period described in Section 7.
You may manage cookie preferences through your browser settings. Note that disabling certain cookies may affect the functionality of the Platform. Our authentication cookies are strictly necessary for Platform operation and cannot be disabled while maintaining an active session. You may also opt out of the advertising-related sharing described in Section 9 at any time via the "Do Not Sell or Share My Info" link in the Platform footer, without affecting your ability to browse or book.
We use the following categories of cookies and tracking technologies on the Platform:
Strictly Necessary Cookies: Authentication tokens stored in httpOnly, Secure cookies (nably_access, nably_refresh). These are required for you to remain logged in and use protected features of the Platform. They are not used for advertising.
Analytics and Advertising Technologies: We use Google Analytics (via Google Tag Manager) to measure Platform traffic and usage, and the Meta Pixel and Google Ads to measure the effectiveness of our advertising campaigns and, where enabled, to show you relevant ads on Meta and Google platforms based on your activity here ("remarketing" or "retargeting"). These technologies may set cookies or use device identifiers, and may receive page-view and event data (such as which listings you view or when a booking is completed) in connection with your visit. Where a booking is completed, we also share a hashed (irreversibly obscured) version of your email address with Meta and Google server-side, to help these platforms attribute a booking to the correct ad campaign even if a cookie is blocked. You may opt out of this advertising-related sharing at any time — see "Do Not Sell or Share My Information" below.
Third-Party Service Technologies: Google Maps API may set cookies or collect data as part of address autocomplete and map display functionality. Cloudflare, which operates as our web infrastructure and security layer, may collect IP addresses and request metadata for security and performance purposes. These third-party technologies are governed by their respective privacy policies.
You may opt out of the advertising-related sharing described above at any time via the "Do Not Sell or Share My Info" link in the Platform footer, available whether or not you are logged in. Opting out disables Meta and Google advertising/remarketing tags and the server-side hashed-email sharing described above; it does not disable the Strictly Necessary Cookies described earlier, and does not affect your ability to browse or book on the Platform. Your choice is remembered on this device and reapplied automatically on future visits. We also automatically honor the Global Privacy Control and equivalent browser or device opt-out signals, where we are able to detect them — see Section 4A.3.
The Platform is intended for users who are 18 years of age or older. We do not knowingly collect personal information from anyone under the age of 18. Registration requires affirmative confirmation of age eligibility, and we may suspend or terminate any account we determine to belong to a person under 18.
If you believe we have inadvertently collected information from a person under 18, please contact us at [email protected] and we will promptly delete that information.
We implement reasonable technical and organizational measures to protect your personal information against unauthorized access, disclosure, alteration, or destruction. These measures include:
No method of transmission over the internet or electronic storage is completely secure. While we strive to protect your personal information, we cannot guarantee absolute security. If you believe your account has been compromised, please contact us immediately at [email protected].
Nably operates as a marketplace platform. Hosts are independent individuals or businesses; they own, control, and transfer possession of listed items and services. Nably facilitates the transaction but does not take physical custody of any item or perform any listed service.
When you communicate with a Host or Renter through the Platform, those communications pass through our in-app messaging system and may be reviewed by Nably for safety, fraud prevention, and policy enforcement purposes. Content filtering is applied to messages to detect policy violations including prohibited contact information sharing and prohibited content.
Hosts who list event services or higher-risk item categories may be required to provide insurance documentation. This documentation is reviewed by Nably administrators and retained for the duration of the Host's active listings.
We may update this Privacy Policy from time to time. When we make material changes, we will update the Effective Date and Version number at the top of this document. For significant changes, we will provide additional notice, which may include an in-app notification or email to registered users.
Your continued use of the Platform after any changes to this Privacy Policy constitutes your acceptance of the updated policy. We encourage you to review this policy periodically.
The version of this Privacy Policy you agreed to at registration is recorded in your account record, along with the timestamp of your consent. If we make material changes, we may require you to re-acknowledge the updated policy before continuing to use the Platform.
Nably offers an optional SMS/text messaging program for Hosts (and, where applicable, Renters) who wish to receive time-sensitive alerts by text in addition to email and in-app notifications. This section describes that program.
If you opt in, you may receive text messages regarding:
This is a transactional, account-related messaging program. We do not send marketing or promotional text messages.
SMS notifications are off by default. You may opt in at any time via the Notification Preferences section of your account settings, by affirmatively checking the box to enable text notifications and providing or confirming your mobile phone number for this purpose. Opting in to SMS is entirely optional and is never a condition of creating an account, making a booking, or listing on the Platform.
Message frequency varies based on your account and booking activity. Message and data rates may apply, as determined by your mobile carrier.
You may opt out of SMS notifications at any time by replying STOP to any message you receive from us, or by disabling text notifications in your Notification Preferences. Reply HELP to any message for assistance, or contact us at [email protected]. After you opt out, you will receive one final message confirming your opt-out, and no further text messages will be sent unless you opt in again.
Carriers are not liable for delayed or undelivered messages. Not all mobile carriers or devices are supported.
No mobile information collected as part of the SMS program, including your phone number and consent status, will be shared with third parties or affiliates for their own marketing or promotional purposes. This information is used solely to deliver the transactional messages described in Section 14.1 through our SMS delivery provider, which processes messages on our behalf and does not use your information for its own purposes. All other data-sharing categories described in Section 6 of this Privacy Policy exclude text messaging originator opt-in data and consent — this information is not shared with any third parties outside of what is necessary to deliver your messages.
See also Part A, Section 34 of the Terms of Service for the full SMS/text messaging terms.
If you have questions, concerns, or requests regarding this Privacy Policy or our handling of your personal information, please contact us at: