Privacy Policy

Effective July 2, 2026 (v1.1)

1. Introduction

Envalt LLC (d/b/a ToolShed) ("ToolShed," "we," "us," or "our") operates a peer-to-peer tool rental marketplace through our mobile application and website at toolshed.cc (the "Platform"). This Privacy Policy explains what personal information we collect, how we use and share it, and the choices and rights you have. By using the Platform, you agree to this Privacy Policy.

ToolShed is offered only to residents of the United States, and this Policy is written for US residents. The Platform is not directed to individuals outside the United States.

2. Information We Collect

Account information. Your name, email address, phone number (optional), and profile photo (optional). Authentication is handled by our provider, Clerk.

Identity verification information. To keep the marketplace safe and to meet our payment provider's requirements, we and our providers (including Stripe Identity) may collect your date of birth and a government-issued identification document, and process it to verify your identity and detect fraud. A government ID and date of birth are treated as sensitive information (see Section 3).

Location data. With your permission, we collect approximate location in the app to show nearby tools. We display only approximate, offset locations publicly; a tool's exact address is shared with the other party only after a booking is confirmed. We use MapTiler for maps and geocoding and PostGIS for location queries.

Payment information. Payments are processed by Stripe. We do not store full card numbers or bank account details on our servers; we store Stripe account and customer identifiers needed to process payments and payouts.

Listing information. Titles, descriptions, photos, pricing, category, and pickup location for tools you list.

Communications. Messages you send to other users through the Platform, and messages you send to our support (including through our support chat provider, Intercom, on our website).

Device and technical information. Device type, operating system, app version, push-notification tokens, and log information such as IP address and user agent. We record the IP address and user agent associated with your acceptance of our Terms and Privacy Policy and with certain security-relevant actions.

Usage information. Limited product-usage and error information (via Sentry for error and performance monitoring, and, on our marketing website only if enabled, PostHog for basic product analytics with input masking and no cross-site tracking). Analytics tooling is not used to track you across other companies' apps or websites, and product analytics is disabled in the consumer app and admin console.

3. Sensitive Information

Some information we process is considered "sensitive" under certain state laws, including your government-issued identification, date of birth, and precise geolocation (which we use only after a booking is confirmed and only to enable pickup). We use sensitive information only for the purposes described in this Policy - primarily identity verification, fraud prevention, safety, and enabling rentals - and not to infer characteristics about you or for targeted advertising.

4. How We Use Your Information

We use personal information to:

  • Provide, maintain, and improve the Platform
  • Match Renters and Lenders by location and availability
  • Process payments, payouts, deposits, and taxes through Stripe
  • Verify identity, prevent fraud, and promote safety and trust
  • Facilitate communication and send booking confirmations, reminders, and status updates
  • Provide customer support
  • Comply with legal obligations and enforce our Terms

5. How We Share Your Information

We do not sell your personal information, and we do not share it for cross-context behavioral (targeted) advertising.

With other users. When you transact, we share what is needed to complete the rental - such as your display name, profile photo, ratings, and, after a booking is confirmed, the exact pickup location.

With service providers that process information on our behalf, under contract, for the purposes above:

  • Stripe (payments, payouts, and Stripe Identity for identity verification)
  • Clerk (authentication and account management)
  • Cloudflare (content delivery, image storage, and web hosting)
  • MapTiler (maps and geocoding)
  • Sentry (error and performance monitoring)
  • Resend (transactional email delivery)
  • Intercom (customer support chat, on our website)
  • Expo (push-notification delivery, which relays to Apple Push Notification service and Firebase Cloud Messaging)

For legal and safety reasons. We may disclose information to comply with law, respond to lawful requests or legal process, enforce our Terms, or protect the rights, property, or safety of ToolShed, our users, or the public.

In a business transfer. If we are involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to this Policy.

6. We Do Not Sell or Share Your Information for Advertising

We do not sell your personal information for money, and we do not "share" it for cross-context behavioral advertising, as those terms are defined under California and other state laws. Because we do not sell or share your information for advertising, there is nothing to opt out of for those purposes; nonetheless, where required, we honor recognized opt-out preference signals (such as the Global Privacy Control) as a valid request to opt out.

7. Data Retention

We keep account information until you delete your account. We retain booking and payment records for up to 7 years to meet tax and legal recordkeeping obligations, and we retain messages and condition photos tied to past rentals for that period. Push tokens are deleted when you sign out or revoke them. When you delete your account, we promptly delete or anonymize your personal information, other than records we are required or permitted to retain, which are purged automatically when their retention period ends.

8. Your Privacy Rights

Depending on your state of residence, you may have the right to:

  • Know / Access the personal information we have collected about you
  • Correct inaccurate personal information
  • Delete your personal information
  • Obtain a portable copy of your personal information
  • Opt out of the sale of personal information, sharing for targeted advertising, and certain profiling (as noted in Section 6, we do not engage in these activities)
  • Not be discriminated against for exercising your rights

You can exercise the most common rights directly in the app: export your data from Profile > Account > Export My Data, delete your account from Profile > Account > Delete Account, and update your profile at any time. You may also email us at privacy@toolshed.cc. We will verify your request using information associated with your account, and you may use an authorized agent where the law allows. If we decline a request, you may appeal by replying to our response or emailing privacy@toolshed.cc with "Appeal" in the subject line.

9. State Privacy Disclosures

Several US states - including California (CCPA/CPRA), Colorado (CPA), Virginia (VCDPA), Connecticut (CTDPA), Utah (UCPA), Texas, Oregon, Montana, and others - provide the rights described in Section 8. This Section provides the additional detail those laws require.

Categories of personal information we collect: identifiers (name, email, phone, account and device identifiers, IP address); customer records and payment identifiers; commercial information (bookings and transactions); government identifiers and date of birth (sensitive; for identity verification); precise geolocation (sensitive; after a confirmed booking); internet and device activity (app usage, logs); audio/visual information (profile and tool photos); and user communications.

Sources: you, your device, other users you transact with, and our service providers (such as identity verification and payment providers).

Business or commercial purposes: the purposes listed in Section 4, including providing the marketplace, processing payments, verifying identity, preventing fraud, ensuring safety, providing support, and complying with law.

Categories of third parties: the service providers listed in Section 5, other users to a transaction, and government or legal authorities where required.

We do not use or disclose sensitive personal information for purposes other than those permitted under applicable law, and we do not sell personal information or share it for targeted advertising. California residents may also request the specific pieces of personal information we hold, and California Civil Code Section 1798.83 permits certain residents to request information about disclosures for third-party direct marketing (we do not make such disclosures).

10. Cookies and Tracking

Our website uses essential cookies only, for authentication and session management. We do not use third-party advertising cookies or engage in cross-site tracking. Our mobile app does not use cookies.

11. Data Security

We use technical and organizational measures to protect your information, including encryption in transit (TLS/HTTPS), encryption of sensitive data at rest, access controls, rate limiting and abuse prevention, and regular review. No system is perfectly secure, but we work to protect your information and to respond appropriately to security incidents. You can report a security concern to security@toolshed.cc.

12. Children's Privacy

The Platform is intended only for adults 18 and older. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated Policy and updating the effective date, and, where appropriate, by requiring acknowledgment. Your continued use of the Platform after changes take effect constitutes acceptance.

14. Contact Us

For privacy questions or to exercise your rights, contact us at:

← Back to Home