Privacy Policy

Last updated October 26, 2026

Deposit Recovery helps New York tenants get their security deposit back: you record your case, keep your evidence, and send letters you review and approve. This policy explains what information that takes, what we do with it, and what we never do. It applies to the Deposit Recovery website and app, operated by Deposit Recovery (“we”, “us”).

The short version

We collect what you give us to run your case: your account, your lease details, your evidence and your messages with your landlord.
We use it to run your case and nothing else. We don’t sell it, and we don’t use it for advertising.
If you connect Gmail, we can only send letters you approve, from your address. We can’t read, search or delete anything in your mailbox, and we don’t receive your email.
Nothing is sent to your landlord until you review it and press Send.
Your evidence is sealed so it can’t be altered, which is what makes it useful if you go to court.

What we collect

Information you give us:

Account: Your name, email address and password (stored only as a secure hash). If you sign in with Google, your name, email address and Google account ID.
Your case: Your rental address and apartment type, lease details (deposit, rent, dates, landlord name and address, tenants on the lease), move-out details, your forwarding address, and how you paid your deposit.
Evidence: Files you upload: your lease, photos, videos, receipts and documents. Photos can contain metadata your phone added, such as when and where they were taken.
Messages: Letters you prepare and send, and emails your landlord sends to your case email address, including attachments.
Your decisions: Facts you confirm, charges you agree with or dispute, offers you accept or decline, payments you record and letters you approve.

Information collected automatically:

Sign-in and approvals: Your IP address and browser type when you sign in, and when you approve a letter for sending, so there is a record of who approved it.
Cookies: A sign-in cookie that keeps you signed in. We don’t use advertising or analytics cookies, and we don’t track you across other websites.
Service logs: Technical records of requests and errors, kept to run and secure the service.

We don’t ask for your Social Security number, bank account or card numbers. If you record a payment, we keep only what you enter: the amount, date and method.

How we use it

To run your case: track your landlord’s legal deadlines, organize your evidence and show you your timeline.
To fill in letters from the facts you confirmed, and send them when you tell us to.
To receive your landlord’s replies at your case email address and put them in your case.
To send you account emails (sign-in codes, password resets) and case notices (a reply arrived, a deadline is coming).
To build documents you ask for, such as a court-ready binder of your case.
To keep the service secure: scan uploads for viruses, prevent abuse and fix problems.
To meet legal obligations.

We don’t sell your information, use it for advertising, or build marketing profiles.

Gmail access: send only

You can choose to send letters from your own Gmail address instead of your case email address. This is optional; your case address works without Google at all.

What we ask Google for

Send email on your behalf (Google’s gmail.send permission). This permission can only send. It does not allow reading, searching, labeling or deleting your email.
Your email address and basic profile, so we know which address letters come from.

What we do with it

We send only letters you have reviewed and approved by pressing Send, one at a time. We never send anything on our own.
Each letter is sent with your case email address as Reply-To and in CC, and you are copied. That way your landlord’s reply comes to your case, not through your Gmail.
We keep a sealed copy of each letter we send, as part of your case record.

What we don’t do

We don’t read, scan, download or store any email in your Gmail account, including your landlord’s replies there.
We don’t receive email through your Gmail address. Only mail sent to your case address reaches us. If your landlord writes to your Gmail directly, you can forward it to your case address.
We don’t use Gmail data for advertising, sell it, or use it to train AI models.

Your Google tokens

Google gives us an access token to send on your behalf. We store it encrypted and use it only to send letters you approve. You can disconnect at any time from your Google account permissions. After that, we can’t send from your Gmail. You can keep sending from your case email address, or reconnect.

Deposit Recovery’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Automated reading

To save you typing, we use AI models from Anthropic (Claude) to read some documents and emails:

your lease, to suggest the key details for you to check;
scanned documents and photos of documents, to pull out their text;
your landlord’s emails, to label them (for example “itemized statement” or “refund”) and write a short neutral summary;
your landlord’s itemized statements and offers, to list the charges exactly as written.

These are suggestions only. Nothing becomes a fact in your case until you confirm it, and AI never writes your letters: letters are filled from fixed templates using the facts you confirmed. Anthropic processes this information on our behalf and does not use it to train its models. The AI never reads your Gmail.

When our team looks at a case

Most of the service runs automatically. A small team may look at parts of a case when it’s needed to help you: checking a landlord statement that couldn’t be read automatically, routing an email that didn’t match a case, fixing a failed upload, or answering your support request. Our team never sends anything for you, and every action they take is recorded on your case timeline.

How long we keep it

Evidence and your case timeline are kept until you delete them. Each file is sealed when it’s recorded: fingerprinted (SHA-256) and time-stamped on your timeline, so it can be relied on if you go to small claims court. Nobody can change a sealed file; only you can delete it.
Your account and everything in it are kept while your account is open. When you delete your account (in Settings), we delete your cases, files, messages, letters and timeline right away.
Gmail tokens are kept only while Gmail is connected.
Service logs are kept for a limited time for security and troubleshooting.

How we protect it

Connections are encrypted (HTTPS), and Google tokens are encrypted at rest.
Uploaded files are scanned for viruses and fingerprinted (SHA-256) when sealed, so any change would be detectable.
Your case timeline is chain-linked, so entries can’t be changed or removed without it showing.
Passwords are stored only as secure hashes, sign-in attempts are rate-limited, and staff access is limited by role.

No system is perfectly secure. If a breach affects your information, we’ll notify you as required by law.

Your choices and rights

See and download your case at any time, including a full case binder with your evidence and timeline.
Correct facts in your case. Corrections are added as new entries, so the history stays complete.
Disconnect Gmail at any time from your Google account permissions.
Delete any file, or your whole account and everything in it, yourself, at any time, in the app.
Ask what information we hold about you.

To make a request, email privacy@get-sleek.ink. We’ll answer within 30 days. Depending on where you live, you may have additional rights under local law, and we’ll honor them.

Children

Deposit Recovery is for adults. We don’t knowingly collect information from anyone under 18.

Changes to this policy

If we change this policy, we’ll update the date at the top. If a change affects how we use information we already have, we’ll tell you by email or in the app before it takes effect.

Contact us

Questions about privacy or this policy: privacy@get-sleek.ink. See also our Terms of Service.