Privacy Policy

Who we are

Homes is an online platform that helps students discover available housing and connect with agents who list properties. In this policy, “we”, “us” and “Homes” refer to the operator of the Homes platform, who acts as the data controller for the personal data described below. You can reach us at privacy@homes.example.

Information we collect

We collect only the information needed to run the platform:

Account information

• Your email address.
• Your password — stored only as a secure bcrypt hash. We never store, and cannot see, your actual password.
• Your display name (optional) — shown to people you message and, for agents, on your listings.
• The general area/location you select from our predefined list (for example a town near your campus). This is a choice you make — we do not collect your device’s GPS or precise location.
• Your account type (finder or agent), email-verification status, and account timestamps.

Agent application information (agents only)

• Your phone number and an optional business/agent name.
• Your application status and the outcome of our review.

Identity verification (agents only)

To help keep Homes safe, agents applying to list properties provide identity information that our team reviews manually. We practise strict data minimisation here:

• National Identification Number (NIN): we do not store your NIN. We keep only its last four digits (to help our reviewer identify the record) and a one-way, secret-keyed hash used to detect the same NIN being reused across accounts. The full NIN cannot be recovered from what we store.
• Selfie: a photo you provide is stored in a private location, not publicly accessible. It is used only as evidence for a human reviewer — we do not run facial recognition or any automated biometric matching on it.
• Your identity-verification status and the outcome of our review.

This information is visible only to Homes administrators during review. It is never shown on your public profile, to finders, or in any public API — finders see only an “identity verified” indicator. We ask for your explicit consent before collecting it, and we rely on it as necessary to operate a trustworthy marketplace.

Property information (agents only)

• Listing details you provide: title, description, price, area, property type, water source, power source, whether the property is fenced, and availability status.
• Photos you upload of the property.

Messages and favourites

• The content of messages you send, who they are between, timestamps, and read status.
• The properties you save to your favourites.

Technical and security information

• A session cookie that keeps you signed in (see Cookies below).
• Security tokens for email verification and password resets — stored only as hashes and short-lived.
• Limited request metadata (such as an identifier derived from your IP address) used transiently to rate-limit requests and protect the service from abuse.

What we do not collect

• Precise or GPS device location — only the area you choose from our list.
• Payment or card details — Homes does not process payments or handle rent.
• We do not use advertising or analytics trackers, and we do not buy personal data about you.

How we use your information

• To create and secure your account and sign you in.
• To verify your email address using a one-time code.
• To display, search, and manage property listings.
• To enable messaging between finders and agents.
• To receive and review agent applications.
• To protect the platform — rate limiting, preventing abuse, and investigating violations.
• To communicate service and account information to you.
• To comply with legal obligations.

Our legal bases (NDPA)

Depending on the activity, we rely on one or more of the following bases under the NDPA:

• Performance of a contract — to provide the platform and your account.
• Consent — where we ask for it (you may withdraw it at any time).
• Legitimate interests — to keep the service secure and prevent abuse.
• Legal obligation — where the law requires us to process or retain data.

Who we share it with

We do not sell your personal data. We share it only as needed to run the service:

• Service providers (processors) acting on our instructions — our database and file storage provider, our email delivery provider, and our hosting provider.
• Other users, as inherent to the platform — if you message an agent, that agent can see your message and display name; an agent’s display name and optional business name appear on their listings, which are publicly visible.
• Legal and safety disclosures — where required by law, or to protect the rights, safety, or property of Homes, our users, or others.

International transfers

Some of our service providers may process data on servers outside Nigeria. Where that happens, we take steps to ensure your data continues to be protected in line with the NDPA.

How long we keep it

• Account information is kept while your account exists.
• Listings are kept until the agent or Homes removes them.
• Messages are kept while the related conversation exists.
• Deleting a property also removes its photos, saved copies, and related conversations.
• Email verification codes expire within minutes; password-reset links expire within an hour.
• Expired sessions are removed.
• Identity-verification material (the selfie and the NIN last-4/hash) is retained only as long as needed to establish and maintain an agent’s verified status, and is deleted or anonymised when it is no longer required or on account deletion, except where we must retain a minimal record by law.
• When you ask us to delete your account, we delete or anonymise your personal data, except where we must keep it to meet a legal obligation or resolve disputes.
• After deletion, residual copies may remain for a limited period in the secure backups kept by our infrastructure providers, until those backups are rotated and overwritten in the ordinary course.

Your rights

Under the NDPA, you have the right to:

• access the personal data we hold about you;
• correct inaccurate or incomplete data;
• request deletion of your data;
• restrict or object to certain processing;
• request a copy of your data in a portable format;
• withdraw consent where we relied on it; and
• lodge a complaint with the Nigeria Data Protection Commission (NDPC).

To exercise any of these, email privacy@homes.example. Account deletion is currently handled on request (there is not yet a self-service delete option); we will action verified requests promptly.

How we protect your data

Security measures we use include:

• bcrypt hashing of passwords, and hashing of session, verification, and reset tokens;
• HttpOnly, Secure, SameSite session cookies served over HTTPS;
• rate limiting and cross-site request protection on sensitive actions;
• server-side validation of all input, and image checks on uploads.

No online service can be completely secure, but we work to protect your data appropriately.

Cookies and session technologies

We use a small number of essential and functional cookies only:

• Session cookie (homes_session) — essential; keeps you signed in. It is HttpOnly, so it cannot be read by scripts in your browser.
• Theme preference (homes-theme) — functional; remembers whether you chose light, dark, or system appearance. It holds no personal data.

We do not use advertising or analytics cookies. If we ever add analytics or marketing technologies, we will update this policy and this notice first.

Children

Homes is intended for people who can enter into a binding agreement and is not directed at children under 18. If you believe a child has provided us personal data, contact us and we will take appropriate action.

Changes to this policy

We may update this policy from time to time. The “Last updated” date above shows when it last changed, and we will take reasonable steps to notify you of material changes.

Contact us

Questions or requests about your privacy: privacy@homes.example. You also have the right to complain to the Nigeria Data Protection Commission (NDPC). See our Contact page for more ways to reach us.