Privacy in this preview

What the application stores

Your name, email, password hash, sessions, saved homes, requests and messages are stored in the application database. Operator accounts also store listing information, image rights declarations, uploaded images and availability events. Passwords are never stored in plain text.

Guest requests store your name, email, stay details and messages without creating an account or password. Email links expire after 20 minutes; verified browser access lasts seven days and is limited to one request. Access tokens are stored as hashes. A new verified recovery link replaces earlier browser access to that request.

Who can see it

Account data is restricted to your session. A traveler and the operator of their requested home can see their shared conversation and request. Guest requests become visible to the operator only after email verification; the request conversation shows the guest’s name, not their email address. If the guest later chooses online payment, payment details are shared as described below. Staff can review listings. Public listing images and descriptions become visible when approved. Do not upload passports, financial documents or other sensitive files.

Local and cloud operation

Local development stores data on this computer and writes authentication emails to a local test inbox. A configured production deployment uses Neon PostgreSQL, Vercel hosting and Blob storage, and Resend email delivery. No advertising analytics are included. Essential cookies maintain account authentication and private guest request access.

Online payments

When you choose secure checkout, Okaeri Stay sends your email, the payment amount and internal request or campaign references to Stripe. For a stay payment, the connected property operator receives payment information through Stripe, including the payer’s email. Okaeri Stay stores provider references, amounts, payment and refund states, and an audit history. Your card number and security code are entered directly on Stripe and are not stored in Okaeri Stay’s database.

Operators complete identity, business and bank information directly in Stripe’s onboarding flow. Okaeri Stay stores the connected account reference and whether payments and payouts are enabled. Authorized administrators can review payment records and submit refunds. See Stripe’s privacy policy.

Conversational search and voice

When AI search is available, your search message, selected filters and a limited recent conversation are sent through Vercel AI Gateway to the configured model provider to interpret your housing preferences. Search results come from our listing database. Do not include contact details or sensitive personal information in a search message. Conversation state stays in this page while it is open; the application does not save the chat in your account. Provider processing and retention are subject to their own terms. Request counters help limit abuse and AI usage.

Voice input is optional. Recording starts only when you press the microphone control and allow microphone access. When you finish a recording or choose an audio file, the audio is sent to Okaeri Stay and through Vercel AI Gateway to OpenAI for transcription. The application does not save audio recordings in its database or file storage; provider processing and retention follow their own terms. Cancel to discard a recording before transcription. Review or edit the text before sending it as a search; transcription never submits a search automatically. Microphone access depends on your browser and device.

Maps

Opening map view loads map data, styles and fonts directly from OpenFreeMap, using OpenStreetMap data. The map service receives your IP address, our site origin and the map area requested by your browser. We do not request your device’s location. We save your English or Japanese map preference in this browser’s local storage. Listing travel times are supplied by operators; map labels come from the map provider. See OpenFreeMap’s privacy policy.

Before public launch

The operator must publish a real contact address, retention schedule, deletion/export process, hosting regions, processor agreements, applicable rights and cross-border disclosures. Do not enter sensitive or production customer data into this preview.