Email protection at pet sitting signup means one managed alias for each platform, not the main personal address. Signup collects the owner's name, email address, postal address, phone number, date of birth, pet information and payment card details, and the platform then passes booking information to a sitter the owner has never met. Care takes place at the owner's home, with the sitter visiting, or at the sitter's home, with the pet staying there, and the owner is usually away throughout. A separate alias for each platform confines that platform's booking mail to one address, identifies the source of any leak from its list, and keeps the main inbox address out of the platform's records.
Data collected at signup#
Account information under Rover's privacy statement, last updated 27 March 2025, runs to name, email address, postal address, phone number, date of birth, pet information, availability and any other account-related information the user chooses to provide. Payment and tax information covers the amount and type of services bought, the date and time of each transaction and payment card information. Card transactions go through third-party payment processors. In the United States and Canada, the third-party background check provider collects a sitter's social security or social insurance number; in the United Kingdom, Switzerland and the European Economic Area, the identity verification provider collects a photo and an image of a passport, government identity card or driver's licence.
TrustedHousesitters' privacy policy, last updated 10 August 2026, describes the same pattern. Personal data is collected when a person creates an account, completes a sitter profile or posts an owner listing. Technical and usage data, including IP address, browser type, location and device information, is collected automatically. Personal data also arrives from third parties, including the provider that conducts background checks.
On both platforms the email address is the account: login, booking channel, receipt route and password reset route in one. Everything the platform knows about the owner, the home and the pet hangs on that address.
What the sitter receives#
Booking information goes from Rover to the sitter. Its privacy statement states that Rover shares information about a booking with the applicable pet service provider when the owner makes or accepts a booking. Rover's help centre states that Rover numbers are used before and after a service so the owner's actual phone number stays private, and that a sitter's address appears only when the service takes place at the sitter's home. The phone number is masked; the home address, the dates of the sit and the pet routine are not, because the sitter needs them to work.
At the point of handover, TrustedHousesitters works the same way. Its privacy policy states that certain personal data may be shared with other users of the platform as part of the normal operation of the service. Its help centre states that contact details are not shared with other members unless the owner requests it, and that members can communicate through the platform without exchanging phone numbers. Members describing the process on the company's community forum report that the owner Welcome Guide, shared with the confirmed sitter, contains the owner's full name, full address and telephone number. That point comes from users, not from the policy itself.
A shopping account hands an address to a warehouse. A pet sitting account hands a home address, the dates the owner is away and the pet routine to a stranger who then holds the keys. The guide on how to protect your email when booking vet care deals with a different record, the pet medical record held by a clinic. Pet sitting covers the home and the absence.
Background checks and identity verification#
Both large platforms screen sitters. The screening has stated limits. Rover's background checks page states that every sitter profile is reviewed and that every new sitter and dog walker undergoes an enhanced background check through a third-party service. The enhanced check comprises a search of the US Department of Justice National Sex Offender Public Website, a search of a national criminal database for disqualifying criminal offences, and a search of county criminal court records drawn from the person's address history. Sitters who joined before January 2022 and have not upgraded may still hold the basic check, which covers only the sex offender registry and the national criminal database.
The same page states the limits plainly: information reported for a background check can be limited by various laws and reporting systems, each check runs on information submitted by the applicant, and criminal records are not always comprehensive. Rover states that a criminal background check is only one consideration when hiring a pet care provider, and recommends Meet and Greets and verified reviews alongside it. Identity verification is separate: Rover's ID verification page states that every sitter and dog walker joining its European community undergoes identity verification through Onfido, using a timestamped selfie matched against the photo on the sitter's passport or other identity document. From 2026, new sitters in eligible locations in the North American community undergo identity verification too.
A background check and an identity check vet the person, not the address. Neither protects the owner's email address: the platform still holds it, booking details still reach the sitter through it, and a breach of the platform's records still exposes it. Screening establishes who the sitter is and places no limit on what happens to the owner's address after signup.
Recorded exposures in the pet sector#
This research found no breach of Rover or TrustedHousesitters customer email lists, and this article claims none. Pet owner data has been exposed in the wider pet sector, and the data types involved match what a pet sitting account holds.
On 5 August 2026, Edinburgh Live reported that Edinburgh Dog and Cat Home had warned supporters that an unauthorised third party had accessed a third-party system it uses and copied database backups. The home had been notified on Monday 3 August of a cyber security incident at Beacon, a third-party CRM provider. Name, email address, postal address, telephone number, records of interactions with the home, pet's name and past gifts were potentially accessed and downloaded. The home reported the incident to the Information Commissioner's Office and stated there was no evidence at that stage that the information had been misused. Payment details were not held in that system.
An earlier case shows the same data reaching the wrong owner through a configuration failure, not an attack. In March 2021, Computing reported that a database migration at Petlog, the UK microchip database managed by the Kennel Club, left owners seeing other people's details, including an address and phone number. The company said no pet details had vanished and that they had been safely migrated.
In both cases the exposed data was the ordinary account record: name, email address, postal address, phone number and pet name. No targeted attack on the pet owner was needed; the record itself was the target, and the email address was part of it.
Phishing aimed at pet owners#
A pet sitting account also attracts phishing, because messages around a booking are expected and trusted. Rover's account security help page states that phishing messages usually request personal information such as full name, email address, phone number, password and financial information. Rover states that its support team never asks for a username or password, and that official Rover emails end in @e.rover.com or @rover.com. Any other address in the From line is likely not from Rover. The same page describes the overpayment scam: a person is sent a cheque for more than the amount owed and asked to reimburse the difference, then the cheque bounces and the money sent is kept.
Pet details make a phishing message more convincing: a sender who knows the pet name, the breed, the dates of a sit and the amount charged can write a message that reads as if it comes from the platform or the sitter. A leak of the booking record supplies all of those details. An alias does not stop phishing on its own, and it does not verify a sender. It makes the phishing visible: a message about a pet sitting booking that arrives on the pet sitting alias is in the right place, while a message about a booking that arrives on an address the platform never had is plainly wrong.
One alias per pet sitting platform#
The setup is one managed alias per platform: a separate forwarding address for Rover, another for TrustedHousesitters, another for any local sitting service, with no other service using any of them. Booking confirmations, receipts, messages from the sitter and reminders for one platform all arrive on that platform's alias. The alias is created before signup, labelled with the platform name, and stays active while the account exists and any booking, payment, claim or review is still open.
The arrangement confines a leak to one platform: the exposed address belongs to that platform only and cannot sign in to other accounts. It also identifies the source of unwanted mail, because marketing mail or spam arriving on the alias given to one platform points to that platform with no investigation needed. And the alias can be paused or replaced once the platform is no longer used or its mail turns unwanted, without changing the main inbox address.
The same pattern appears in other guides. The guide on how to protect your email when setting up smart home devices applies one alias per device brand, because the address is the key to cameras inside the home. The guide on a separate email for health and fitness apps applies one alias per app, because the address is the field that joins health data to a person. Pet sitting follows the same logic with a different stake: the address is tied to a home, an absence and a stranger with the keys. The alias must stay active while the account is live, because booking confirmations, receipts and messages about the sit arrive on it, so closing it after the first booking can block messages the owner still needs. A change of platform is a planned move: the new platform gets a new alias, and the old alias stays active until no booking, payment or claim is outstanding.
The alias stays active while any booking, payment, claim or review is still open. Booking confirmations, receipts and messages about the sit arrive on that alias, and closing it early blocks messages the owner still needs.
Two other measures sit alongside the alias: a unique password on each pet sitting account stops a leak at one platform from opening the others, and two-factor authentication stops a password alone from opening an account. The alias controls the handover of the address; it does not replace either measure. The owner should also check the address on Have I Been Pwned after signup, to see whether it has appeared in a known breach.
AliasFleet for pet sitting accounts#
AliasFleet provides managed email aliases that forward to a verified destination inbox. Each pet sitting platform gets a separate alias, and every alias forwards to the same destination inbox, so booking mail from all platforms arrives in one place while each platform holds a different address. Replies travel back through the alias, so the destination address stays out of the platform's records. The free tier includes 10 active aliases, 1 verified destination inbox, 3 managed subdomains and 100 MB of monthly forwarding, according to the AliasFleet pricing page. AliasFleet does not control the security of the pet sitting platforms, and an alias does not replace two-factor authentication or a unique password on those accounts.
Limits of an alias for pet sitting#
An alias does not make the pet sitting platform secure, and it does not stop a platform from being breached. A breach of the platform's records exposes the name, home address, phone number and pet details alongside the alias, whatever address the owner gave. An alias does not hide the pet name, the home address or the dates of the sit from the platform or the sitter, because both need those details to arrange care. Nor does it stop the platform sharing the address with the suppliers who need it, including payment processors, background check providers and identity verification services. Rover's privacy statement lists third-party data sources and service providers among the parties it shares information with. TrustedHousesitters' privacy policy lists service providers including payment processing, sitter verification, banking, advertising, fraud prevention, web hosting and analytics.
An alias also leaves the banking rule unchanged. A bank account keeps a permanent real address used only for financial accounts, because recovery, statements and fraud alerts depend on it. The pet sitting alias covers the platform signup and its booking mail, never the bank account identity.
