Privacy policy
Effective November 6, 2026
The short version. Lentt stores the list you type (things, first names, dates, optional notes and photos) so it can show it back to you. One session cookie, no tracking cookies, no ads, nothing sold. You can export or delete everything from Settings at any time.
Who we are
Lentt is a small, free web app for remembering what you lent to people and what you borrowed from them. It is run by its maker. Questions about this policy go to hello@lentt.app.
What we store
- Your list. The items you add (title, category, optional note), the dates you set (since, due, returned), and a short history of events such as "returned" or "nudged".
- Names you type. The people you lend to or borrow from, exactly as you enter them. A first name is enough; we never ask for their contact details and never contact them.
- An email address, only if you add one. Lentt works without an account. Adding an email lets you keep your list across devices and, if you turn it on, receive reminder emails.
- Photos, only if you attach them. Stored privately and shown only to you and to anyone you give a loan card link to.
- Feedback you send through the app, with the optional email you include.
- Technical logs. Our hosting provider keeps short-lived request logs (IP address, browser type, timestamps) for security and debugging.
Where it lives
Everything runs on Cloudflare: a D1 database for your list and R2 storage for photos, served from Cloudflare's network. Data may be processed on servers in the European Union and the United States. We do not use any other hosting or analytics backend.
Cookies
Lentt sets one cookie, lentt_sid, which keeps you signed in to your own list for up to a year. It is HttpOnly and never shared with anyone else. There are no advertising or tracking cookies. If analytics are enabled, they run cookieless through PostHog (EU region) using a random, non-identifying ID and never record what you type.
Third parties
- Cloudflare — hosting, database, storage and request logs.
- Resend — sends sign-in codes and, if you turn them on, reminder emails. Only active once you add an email.
- PostHog (EU) — cookieless product analytics, only when enabled in a given deployment.
We never sell your data, never share it for advertising, and never pull your contacts.
Loan card links
When you share a loan card, anyone with that link can see the item's name, the names on it, the dates, the photo if there is one, and can mark it returned. Treat the link like a note you handed over. You can revoke a link from the item at any time; the old link then stops working.
How long we keep it
As long as you keep using Lentt. Settings → Delete everything removes your account, list, people, events and photos immediately and permanently. Settings → Export gives you a JSON copy first if you want one. We may remove guest lists that haven't been opened for a very long time; we'll say so in the app before that happens.
Your rights
If you are in the EU, UK or a place with similar laws, you have the right to access, correct, export, delete, or object to the processing of your data. Export and deletion are self-service in Settings; for anything else, email hello@lentt.app and we'll answer within 30 days. Our lawful basis is: providing the service you asked for (your list), consent (email reminders, which you can switch off), and legitimate interest (keeping the service secure and understanding how it is used in aggregate).
Children
Lentt is not for children under 13, and we don't knowingly keep their data. If you think a child has used it, tell us and we'll delete the account.
Security
Everything travels over HTTPS. Sign-in codes are stored hashed, expire after ten minutes and work once. No system is perfect; if something goes wrong we will tell affected people as soon as we can.
Changes
If this policy changes in a way that matters, we'll update the date above and mention it in the app. Older versions are available on request.