Privacy Policy

For the purposes of the GDPR, DeviceRent acts as the data controller for the personal data described in this Policy. Questions, requests, or complaints can be sent to info@devicerent.net.

We collect the following categories of personal data:

• Account data: email address, display name, and any optional profile information you provide.
• Authentication data: hashed passwords, multi-factor authentication factors and recovery codes (TOTP), and session tokens. Plaintext passwords are never stored.
• Billing data: subscription status, plan, billing cycle, and a reference to your customer record at our payment processor (Stripe). Your full payment card number is collected and stored by Stripe; DeviceRent does not have access to it.
• Usage data: session start and end times, device selections, credit balance changes, and similar product telemetry needed to operate the Service.
• Device network metadata: while you are renting a device, a record of the network connections it opens — the hostnames looked up, the addresses and ports contacted, the application that opened each connection, and the time. This is metadata, not content: we do not intercept, decrypt, or store the data sent over those connections, and we do not capture your screen or your keystrokes. Rented devices reach the internet through our own network and IP address, which means abuse reports about that traffic are addressed to us; this record is what allows us to identify the responsible session rather than take the whole fleet offline. It is visible only to our operators, and is deleted after 30 days.
• Apps on a rented device: when you install an app through the upload page, the file, its package name and a SHA-256 hash of it; and, when each session ends, the list of apps installed on the device. We compare these against lists of known-malicious software, on our own systems: neither your file nor its hash is sent to anyone else. The uploaded file is deleted after 30 days; its package name and hash stay with the upload record until you delete your account.
• Technical data: IP address, browser type, operating system, referrer, and similar information collected automatically through server logs and analytics, used in aggregated form for security and product improvement.
• Account-security identifiers: when you sign up, sign in, rent a device or pay, we record (a) a random identifier held in a first-party security cookie, dr_did; (b) a fingerprint of your browser — screen size, time zone, language, graphics renderer and how it draws a test image (canvas rendering) — which is reduced to a one-way hash in your browser before it is sent; (c) the IP address the request came from; and (d) when you pay by card, the card fingerprint Stripe provides, a code that identifies the card but is not the card number. We store each of these only as a keyed one-way hash, from which the original value cannot be recovered. We compare them between accounts to prevent fraud, to stop one person claiming the welcome credit more than once through multiple accounts, and to stop a suspension being evaded with a new account. Our legal basis is legitimate interests (Art. 6(1)(f)); see section 7 for how long they are kept and section 9 for what a match can do.
• Communications: the content of any messages you send us through email or in-app channels.

We rely on the following legal bases under Article 6 of the GDPR:

• Contractual necessity (Art. 6(1)(b)): to create your account, deliver the Service, process your subscription, and provide support.
• Legitimate interests (Art. 6(1)(f)): to keep the Service secure, prevent fraud and abuse, debug problems, and improve the product. We balance these interests against your rights and freedoms.
• Consent (Art. 6(1)(a)): for non-essential cookies and any optional marketing communications. You may withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)): to retain billing records and respond to lawful requests by public authorities.

We process personal data to:

• create and authenticate your account;
• operate device sessions and bill the corresponding fees;
• send transactional emails (e.g., receipts, security alerts);
• provide customer support;
• monitor and protect the Service against abuse;
• investigate reports that a rented device was used to attack, spam, or otherwise harm a third party, and identify the session responsible;
• comply with applicable legal and tax obligations;
• improve and develop our products in aggregated form.

We do not sell personal data. We share it only with sub-processors that help us operate the Service, under written agreements requiring confidentiality and GDPR-compliant safeguards:

• Supabase — authentication and database hosting.
• Stripe — payment processing and subscription billing.
• Vercel — application and edge hosting.
• Resend — transactional email delivery.
• Google Analytics — aggregated usage analytics with IP anonymization where supported. Analytics runs only on our public marketing pages; the signed-in application and the admin tools are excluded.
• Google Ads — measuring which of our search ads lead to a signup. Only active if you accept cookies on the banner. See our Cookie Policy.
• AI model providers — Anthropic, OpenAI, Google and Mistral, used only when you start a DeviceyAI session. See section 9 for exactly what is sent.

We may also disclose personal data when required by law, regulation, court order, or to enforce our Terms or protect the rights, property, or safety of DeviceRent, our users, or others.

Our physical device fleet is located in the Netherlands, and we prioritize EU-based infrastructure for the core Service. Some of our sub-processors operate outside the European Economic Area. Where personal data is transferred to a country that has not received an adequacy decision from the European Commission, we rely on Standard Contractual Clauses or another lawful transfer mechanism, and we apply additional safeguards as appropriate. The AI model providers listed in section 5 are US-based; using the AI DeviceyAI is optional, and starting a session means accepting that its contents are processed outside the EEA on that basis.

We retain personal data for as long as your account is active and for a reasonable wind-down period after deletion to handle backups, dispute resolution, and security investigations. Billing and tax records are retained for the period required by applicable law (typically several years). DeviceyAI transcripts, including any screenshots captured during a session, are kept with the account that created them so the actions taken on a device can be reviewed, and are removed when the account is deleted. Device network metadata (section 2) is deleted after 30 days, and sooner if you delete your account. If an account that was suspended or banned is deleted, we keep a keyed one-way hash of its email address and of its account-security identifiers (section 2, other than IP addresses), the reason for the suspension and the related abuse records, so the same person cannot evade the suspension by registering again; the address cannot be recovered from the hash. When personal data is no longer needed, we delete or anonymize it.

Account-security identifiers (section 2): the hashes of IP addresses are deleted after 90 days; the others are kept while your account exists. If you delete an account that received the welcome credit, the hashes of its email address, security cookie, browser fingerprint and card fingerprint are kept for 12 months, only to stop the welcome credit being claimed again, and are then deleted. When a sign-up is refused under section 9, we keep a record of which check matched, the existing account it matched and a keyed one-way hash of the email address (never the address itself) for 90 days, and then delete it.

If you are in the EEA, the UK, or a comparable jurisdiction, you have the right to:

• access the personal data we hold about you;
• request rectification of inaccurate or incomplete data;
• request erasure of your personal data ("right to be forgotten"), subject to legal retention obligations;
• request restriction of processing in certain situations;
• receive a portable copy of the data you provided to us in a structured, commonly used, machine-readable format;
• object to processing based on legitimate interests;
• withdraw consent at any time without affecting the lawfulness of prior processing;
• lodge a complaint with the data protection supervisory authority of your country.

To exercise any of these rights, email info@devicerent.net. We will respond within the time limits set by applicable law. We may need to verify your identity before fulfilling certain requests.

Three parts of the Service process data automatically. Apart from the sign-up check described under “Multiple-account checks”, none of them produces a final decision with legal or similarly significant effects without human involvement, and we do not profile you for advertising or scoring purposes.

Payment-risk automation. If a payment is charged back or is flagged as fraudulent, your account may be placed under review or suspended automatically to protect the fleet and other customers. You can contest any such action by contacting us, and a person will review it.

Multiple-account checks. When the account-security identifiers in section 2 show that an account very likely belongs to the same person as another, an automated check can withhold the welcome credit, or — where the other account was suspended or banned — pause renting and payments until a person has reviewed it. It never bans an account. Since October 18, 2026 it also runs when an account is created: a new sign-up is refused if it shares an email address (including an alias of one), the security cookie or a card with an existing account, matches an account that was suspended or banned and then deleted, or shares both its browser fingerprint and its IP address with an account that is suspended, banned or under review. An IP address alone never refuses a sign-up. If the new account was already created (for example through Google or GitHub) and has not rented or paid for anything, it is deleted straight away. A sign-up whose email address was never confirmed is deleted when another account with the same security cookie or card is confirmed. You can contest any of these at info@devicerent.net, and a person will review it.

DeviceyAI. This is optional and off unless you start it. When you do, the following is sent to the AI provider you selected — Anthropic, OpenAI, Google or Mistral:

• the instructions you type, and the model’s replies;
• a text description of what is on the rented phone’s screen, and, when you or DeviceyAI requests one, a screenshot of it;
• the results of the actions it performs on the device, such as command output and the list of installed apps.

Anything you type or display on the rented device during a DeviceyAI session may therefore be transmitted to that provider. Do not sign in to personal accounts or enter real personal data on a rented device while DeviceyAI is running. DeviceyAI has no access beyond what you have in that same session, and it cannot act on the device at all until you explicitly enable actions.

If you supply your own provider API key (“bring your own key”), that data is sent to your own account with that provider and is governed by your agreement with them, not ours. Your key is encrypted at rest and is used only for your own sessions.

Copilot transcripts are stored with your account so that you and our support team can see what DeviceyAI did on a device. They are retained under section 7 and are deleted when you delete your account.

We apply reasonable technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, and loss. These include encryption in transit (TLS), hashed credential storage, optional multi-factor authentication for users, row-level security at the database layer, and least-privilege access for our team. No system is perfectly secure; if you believe your account has been compromised, contact us immediately at info@devicerent.net.

The Android devices in our fleet are shared, physical hardware that is rented to one customer at a time. Between rentals each device is automatically wiped: applications you installed are removed, shared storage is erased and verified to be empty, the temporary directory is cleared, and settings a session can change — including accessibility services, the selected keyboard, and any always-on VPN — are reset. A device that fails any of these checks is taken out of service rather than handed to the next customer.

You should nevertheless treat a rented device as a public, untrusted computer. Please do not sign in to personal accounts, enter passwords or payment details, or place personal data on a device. Anything you do put on one is processed as described in this Policy, but a shared device is not a private environment and we ask you not to use it as one.

Two specifics we think you are entitled to know rather than discover:

• The devices carry an operator-owned Google account. It exists so that Google Play and related services work during your session, it is ours rather than yours, and it is not removed by the between-rental wipe. It is shared by every customer who rents that device. Do not use it to make purchases, and do not rely on it for storage — anything associated with it may be visible to, or altered by, other customers. Do not add your own Google account to a device.
• Some system-level changes cannot be verified as reversed. A rented device gives you developer-level access, which is the product. Certain changes that level of access permits — most notably installing a user certificate authority — are stored in a location our wipe process cannot read or clear on these devices. We do not claim to detect or undo them, and we log each wipe accordingly rather than reporting a device clean when we cannot prove it. This is one of the reasons for the guidance above.

Where a device is used to process personal data, our Terms govern your own obligations as a controller of that data.

The Service is not directed at children under the age of 16, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so that we can delete it.

We use cookies and similar technologies as described in our Cookie Policy.

We may update this Privacy Policy from time to time. If we make material changes, we will give reasonable notice before they take effect (for example, by email or in-app notice). The "Effective" date at the top of this page reflects the most recent revision.

For privacy questions or to exercise your rights, email info@devicerent.net.