Trust & Safety at AmarStay

Accounts are created with email and password or Google sign-in. Sessions are protected by short-lived access tokens issued by our backend provider; we do not store passwords in our application database.

Hosts must be manually verified by our team before their listings can go live.

Every property is reviewed by our admin team before being marked verified and shown publicly. Bookings move from pending to payment_pending to confirmed only after our team reviews the payment proof submitted by the guest.

All traffic to AmarStay is served over HTTPS. API requests from the app to our backend use authenticated, same-origin server functions.

We store the information you provide to create an account (name, email, phone), property details you publish as a host, booking records, and payment reference screenshots uploaded for manual verification.

Profile email and phone are never returned to other users through our APIs — only your display name and (for hosts) the WhatsApp number you choose to publish on your listings.

Messages between guests and hosts are only readable by the two participants and our admins for safety review.

To request a copy of your data or to delete your account, contact the AmarStay team from the email address on your account. We will respond within a reasonable time frame.

If you believe you have found a security vulnerability, please contact the AmarStay team privately before sharing details publicly so we can investigate and fix the issue.