Privacy notice

This notice explains what personal data Homelore (“we”, “us”) collects when you use homelore.homes, why, and the choices you have. We are the controller of that data. Questions go to info@homelore.homes.

The short version

• You can read the whole site without an account, and we collect nothing that identifies you when you do.
• We count visits without cookies and without storing your IP address. We use no advertising or tracking scripts, and we never sell personal data.
• If you create an account, we hold your email address, what you need to sign in, where you first arrived from, the buildings, notes and searches you choose to save, and your conversations with the guide while signed in, and nothing more.
• Without an account, your shortlist, notes and comparisons stay in your own browser.

What we collect

If you only browse. Like every website, our hosting provider receives your IP address, browser type and the pages you request, so the site can be delivered and protected from abuse. These logs are kept for a short period and are not used to identify or profile you.

Counting visits. Our hosting provider’s privacy-friendly analytics counts page views so we know which pages are read. It sets no cookie and stores no IP address. It receives the page’s path and any campaign tag in the link, never a search or anything you typed, and records country, browser and device type only in aggregate. Password-reset and sign-in confirmation pages send no page address. It also counts the steps of signing up and signing in, such as a sign-up sent, a confirmed sign-up or a sign-in with Google, without your email address or any identifier.

Catching errors. When a page breaks, your browser sends a report to PostHog, an error-tracking service in the European Union, through our own site address: the page’s path and any campaign tag, your browser and operating system, and the error itself with where in our code it happened. It sets no cookie, stores no IP address and holds nothing that identifies you; password-reset and sign-in confirmation pages send no report. Our server sends the same for an error it meets while building a page, with the page’s path and nothing about you. Your browser also sends three measures of how the page loaded, responded and held still, with the page’s path, to the same service, with the same limits.

You can stop this browser being counted and reporting errors. That also removes the note of where you first arrived, below, and keeps it from being stored with an account. Sign-up and sign-in steps are counted by our server, which cannot see this choice, so those are still counted, without anything that identifies you.

If you create an account. We hold:

• your email address; a securely hashed password, if you set one (an account can also sign in with an emailed link); and, if you sign in with Google, the basic profile Google shares (your name and email address);
• a display name and settings, if you choose to set them;
• the buildings and notes on your shortlist, and the searches you save by name, so they follow you to every device;
• your conversations with the guide while you are signed in: each question you asked and the reply you were shown, so you can pick one up again;
• sign-in records: when you signed in, the IP address and browser used, and the session tokens that keep you signed in;
• the note your browser kept of where you first arrived (see Cookies and local storage below), so we know which of our campaigns bring readers.

If you ask the guide a question. Your question, with the most recent exchanges of the conversation it belongs to, is sent to the AI model that writes the reply. Signed out, it is not stored with your identity. Signed in, the conversation is kept with your account until you delete it, from the guide, one conversation or all of them, or delete the account. We keep only an anonymous note when a reply is withheld, so we can improve the guide.

If you email us. We keep your message and email address for as long as we need to deal with it.

Why we use it

• To provide your account and keep it secure (performance of our agreement with you).
• To run, protect and improve the site, including preventing abuse and learning which campaigns bring readers (our legitimate interests).
• To reply when you contact us (our legitimate interests).
• To meet legal obligations, where they apply.

We send account emails only: confirming sign-up, a sign-in link when you ask for one, and resetting a password. We send no marketing.

Cookies and local storage

We set one cookie, and only when you sign in: it keeps you signed in and is removed when you sign out. It is strictly necessary, so no consent banner is needed. Your shortlist, notes and comparisons are saved in your browser’s local storage; clearing your browser data removes them there. Signed in, your shortlist, notes and saved searches are also kept with your account until you delete them or the account. Your browser also keeps, on your device, a note of where you first arrived: the landing page, any campaign tags and ad click identifiers in that link, and the referring site’s name, never its full address. If you create an account or sign in on this browser, that note is stored with your account so we know which campaigns bring readers. If you ask to keep a guide conversation before you sign in, this browser holds it in its local storage, on your device, for an hour at most, and removes it when you come back signed in.

Every photograph, floor plan and video thumbnail on the site loads from our own storage, kept by our database provider, so no other website learns of your visit from an image on our pages.

Who we share it with

We share personal data only with providers that process it for us under contract:

• our website hosting provider;
• our database and sign-in provider;
• Google, if you choose to sign in with Google, and our email provider, for account emails;
• the AI provider that answers guide questions, which receives the question and the conversation’s most recent exchanges only.

Some of these providers process data outside Malaysia and the United Kingdom. Where they do, we rely on their contractual safeguards for international transfers. We may also disclose data where the law requires it.

How long we keep it

Account data is kept until you delete your account or ask us to delete it. Sign-in records and server logs are kept for a limited period for security. A backup copy may persist for a short time after deletion before it is overwritten.

Your rights

Depending on where you live, including under Malaysia’s Personal Data Protection Act 2010 and the UK and EU GDPR, you may have the right to access, correct, export or delete your personal data, to object to or restrict how we use it, and to withdraw consent. To use any of these rights, email info@homelore.homes from the address on your account. We will reply within one month.

You can also change your details on the settings page. If you are unhappy with how we have handled your data, you may complain to your local data protection authority, such as the Personal Data Protection Department in Malaysia or the Information Commissioner’s Office in the UK.

Security

Data is encrypted in transit, passwords are stored hashed, and access to production systems is restricted. No system is perfectly secure; if you find a vulnerability, please report it to info@homelore.homes.

Children

Homelore is not intended for anyone under 18, and we do not knowingly collect their data.

Changes to this notice

We will update this page when our practices change. A significant change will be emailed to account holders before it takes effect.

Contact

Email info@homelore.homes, or see the contact page.