Privacy policy
Last updated: 23 October 2026
This policy explains what personal data Homely collects through the Homely app and homelymembers.com, why we collect it, who we share it with, and the rights you have over it.
Who we are
Homely is run by Hanna Yousef Judeh and Andy Khan Mamakaev in London, UK. In this policy, "Homely", "we" and "us" mean the two of us. We're jointly responsible for your personal data (the "joint controllers"). We've agreed that Hanna handles privacy questions and requests, but you can reach either of us at homely.stay.contact@gmail.com.
We follow UK data protection law (the UK GDPR and the Data Protection Act 2018) and, where it applies to you, the EU GDPR.
The short version
- We collect what Homely needs to work: your phone number, profile, listings, messages and contacts.
- We never sell your data and we don't show ads.
- Your contacts are used only to work out who you know. We don't keep their names, and we store each phone number in a scrambled (hashed) form, not the number itself.
- Our website doesn't use cookies.
- You can delete your account in the app at any time, and ask us to see or correct your data.
What we collect
When you use the app
- Account: your mobile number, which you sign in with using a one-time code sent by SMS.
- Profile: your name, email address, photo and, if you add it, your Instagram username, plus any referral code you used to join.
- Contacts: if you allow access, the app sends the phone numbers in your address book to our server. We immediately replace each number with a hash (a scrambled version of the number) and store it with an ID your phone uses for that contact. We don't store contact names or the original numbers. A hash still counts as personal data, so we protect it like the rest of your data. See People in your contacts below.
- Listings: your home's address and map location, photos, description, number of rooms and guests, price and the dates it's available.
- Messages: the conversations you have with other members in the app.
- Location: if you allow it and choose "Current location" when you search, your location, accurate to about 100 metres. We send it to Mapbox to suggest places near you. We don't save it to your account, but it's recorded in our server logs like the rest of your search.
- Device: a push notification token so we can notify you about messages. Each time you open the app, it tells Expo your app version, device type and operating system, which we use for basic usage statistics.
- Error reports: when the app or our server hits a problem, details of what went wrong. These can include your device model, operating system, app version, IP address, user ID and the request that failed. We also collect performance data from some app sessions.
- Server logs: our servers log each request from the app and the website, including your IP address, the time and the web address requested. For searches, that address includes what you searched for and, if you used it, your location. We use these logs for security and troubleshooting.
When you use the website
- Waitlist: if you join the waitlist, your email address and the city you entered.
- Analytics: we measure visits with Umami, which we run ourselves. It records the pages you view, the buttons you click, your browser, device type, country and the site that referred you. It doesn't use cookies and doesn't store your IP address.
- Server logs: the same server logs described above.
When you contact us
Your email address and whatever you tell us.
What you have to give us
To use Homely you need a mobile number, because that's how you sign in, and a profile with your name, email address and photo, so members know who they're dealing with. Sharing your contacts and location is optional. If you don't share your contacts, Homely can't find people you know, so you'll only see listings shared with everyone. If you don't share your location, search still works but won't suggest places near you.
Why we use it
Data protection law requires a lawful basis for each use of your data. Ours are:
| What we do | Lawful basis |
|---|---|
| Create your account, sign you in, show your profile and listings, deliver messages and notifications | Contract: it's how Homely works |
| Match your contacts to find friends and friends of friends, and decide who can see each listing | Contract for you; legitimate interests for the people in your contacts (letting members find people they already know) |
| Feature listings that are visible to everyone on Homely on our social media | Legitimate interests: helping members find homes and growing Homely |
| Email you when Homely launches in your city (waitlist) | Consent, which you can withdraw at any time |
| Website and app usage statistics, error reports and server logs, to fix problems and improve Homely | Legitimate interests: understanding how Homely is used and keeping it working |
| Keep Homely safe, prevent fraud and respond to legal requests | Legitimate interests (keeping members safe) and legal obligation |
Where we rely on legitimate interests, we've checked that they don't override your rights, and you can object at any time (see Your rights). We don't make automated decisions that have legal or similarly significant effects on you.
People in your contacts who aren't on Homely
If a member shares their contacts with Homely, we may hold a hashed (scrambled) version of your phone number, even if you've never used Homely. We don't store your name, and we never contact you because of it. We only use it to connect you with people you know if you join. You can object to this or ask us to delete it. If you do, we'll delete it and stop matching your number in future.
Who can see your information
- Other members can see your name, photo, Instagram username (if you add one) and when you joined. They can't see your phone number or email address. Each listing is visible only to the people you choose: friends, friends of friends, or everyone on Homely. Its full address isn't shown to other members. Anyone who has a listing's share link can see a preview of that listing, even if they're not on Homely.
- Service providers who run parts of Homely for us. They may only use your data to provide their service to us:
- Hetzner: the servers that run Homely, our server logs and website analytics (Finland)
- Tigris: photo storage (copies are kept in several regions worldwide, including the US)
- Backblaze: database backups (EU)
- Twilio: SMS sign-in codes (US)
- Expo: push notifications, app updates and app usage statistics (US)
- Apple: push notifications (US)
- Mapbox: address and place search (US)
- Sentry: error reports and app performance data (US)
- Google: our support email, if you email us (Gmail)
- The public, if your listing is visible to everyone on Homely and we feature it on our social media, like Instagram. We show photos and a description of your home and the area it's in, never the address. Tell us if you'd rather we didn't, and we'll take the post down.
- Authorities, if the law requires it or to protect someone's safety.
- A buyer, if Homely is ever sold or merged. They would have to keep to this policy.
We don't sell personal data or share it with advertisers.
International transfers
Some of our providers are based in, or process data in, the United States. When your data leaves the UK or the EEA, we rely on adequacy decisions (including the UK–US data bridge and the EU–US Data Privacy Framework) or on standard contractual clauses with the UK Addendum, which are part of each provider's data processing terms. Ask us if you'd like a copy of the safeguards for a particular provider.
How long we keep it
- Account, profile, contacts and listings: until you delete your account. Deleting your account in the app removes them straight away.
- Messages: if you delete your account, messages you sent stay in your conversations so the other person keeps their copy, but they're no longer linked to you. Once everyone in a conversation has deleted their account, we delete the conversation.
- Waitlist: until Homely launches in your city and we've let you know, or until you ask us to remove you.
- Server logs: 90 days.
- Error reports: up to 90 days.
- Backups: deleted data stays in our database backups for up to 90 days, then the backups are deleted. We don't restore deleted accounts from backups.
- Website analytics: aggregated statistics, kept indefinitely. They don't identify you.
We may keep information for longer if the law requires it or we need it to deal with a dispute.
Your rights
You can delete your account in the app at any time. You can also ask us to:
- give you a copy of your personal data
- correct it
- delete it, including deleting your account
- restrict how we use it, or object to us using it
- send it to you or another service in a portable format
- stop using it where we rely on your consent
Email homely.stay.contact@gmail.com from the address, or mention the phone number, linked to your data. We'll reply within one month and won't charge you.
If you're unhappy with how we've handled your data, email us and tell us what went wrong. We'll confirm we've received your complaint within 30 days, look into it, and tell you what we found and what we're doing about it. You can also complain to the Information Commissioner's Office at ico.org.uk or, if you live in the EEA, to your local data protection authority.
Cookies and your device
homelymembers.com doesn't set cookies or use any other technology that stores information on your device, and our analytics don't need them. The app doesn't use cookies. It keeps what it needs to work on your device, such as your sign-in, and reads basic details about your device for the usage statistics and error reports described above. If that ever changes, we'll update this policy and ask for your consent where the law requires it.
Children
Homely is for people aged 18 and over. We don't knowingly collect data from anyone younger. If you think a child has given us their data, contact us and we'll delete it.
Security
Data is encrypted in transit, phone numbers in contact lists are hashed, and access to our systems is limited to the two of us. We don't routinely read your messages, but we can access them when we need to, for example to look into a report, keep members safe or comply with the law. No system is perfectly secure, so if we ever have a breach that puts you at risk, we'll tell you and the regulator as the law requires.
Changes to this policy
We'll update the date at the top whenever we change this policy. If we make a significant change, we'll let you know before it takes effect.