Privacy Policy

Last updated 20 September 2026

This policy describes what OpenHome stores, why, for how long, and who else sees it. It is written from the actual database, so it is specific. Where something has not been decided yet it is marked as a placeholder rather than filled with a plausible sentence.

1. Who is responsible for your data

1.1
The controller is {{OPERATOR_LEGAL_NAME}}, identification number {{OPERATOR_ID_NUMBER}}, registered at {{OPERATOR_REGISTERED_ADDRESS}}.
1.2
Data protection questions, access requests and complaints: @i417a65. We answer within 10 working days.
1.3
We have not appointed a data protection officer. If the volume of processing ever requires one under Georgian law, this page will name them.

2. The short version

We do not sell your data, and there is no advertising on the platform.
There is no third-party analytics and no tracking pixel. Usage counting is first-party, in our own database, behind a rotating salted identifier.
Identity verification never puts a document, a legal name, a date of birth or a photograph on our servers. We keep a status, a date, a provider name and the provider's session reference.
An anonymous report never stores your IP address. It stores a salted, truncated fingerprint that cannot be turned back into one.
Text you type into the AI features leaves our servers and is sent to a third-party model provider. Section 5 says exactly what is sent.
Deleting your account scrubs your personal fields but leaves your side of a conversation readable by the person you were talking to. Section 12 explains why.

3. What we collect, and why

Everything below corresponds to real fields. Nothing is collected "just in case" and there is no field whose only purpose is a profile of you.

Account: Which provider you signed in with and its identifier for you; your phone number or email address and whether it is verified; your name and avatar if the provider gave one; your language; your notification preferences; when you were last seen. Needed to have an account at all.
Advertiser profile: Display name, profile address (slug), bio, languages you speak, photo, WhatsApp number, Telegram handle, and for agents an optional agency name and licence number. All of this is public: it is what a person deciding whether to call you reads.
Listings: Everything you enter about a property, its photographs, its address and its coordinates, plus the contact phone number you put on it. Public by design, for as long as the listing is live.
Messages: The text of your messages, their attachments, when they were read, and (where an AI feature rewrote or translated a message) the original text as you typed it, which both sides can always reveal.
Enquiries and response times: The first contact on a listing and the time of the first reply. This is the denominator of the public response rate shown on an advertiser’s profile. It is not used for anything else: the reliability score it used to feed no longer exists.
Tenant dossier: Optional: occupation, employer, income range, household size, pets, smoker, move-in date, desired lease length, a free-text note and any documents you attach. Stored for you and shared with a lister only when you tap share, or through a link you create and can expire.
Contracts: The party details you enter (including an identity-document number, if you type one), a snapshot of the listing, the terms, the generated PDF and its hash; and for each signature, the signed name, the drawn image, the timestamp, the IP address and the browser string. Signature metadata is the evidence that a signature happened, which is the whole point of it.
Download records: When a contract PDF or a shared dossier is opened, we log the resource, the account (if any), the IP address and the browser string, so the owner of that document can see who fetched it.
Sessions: A hash of your session token (never the token), the IP address and browser string it was created with, and its expiry. This is what lets you log out of a device you no longer have.
Login codes: Your phone number and a hash of the one-time code, with a five-minute lifetime and an attempt counter.
Identity verification (optional): A status, the date, the provider name, the provider’s session reference, and how many attempts you have made. Never the document, the name on it, the date of birth or the photograph, those are the provider’s, not ours.
Reports: The reason, your free-text comment, the weight the report was given at the time and its outcome. If you were logged in, the report is linked to your account. If you were not, it carries a salted, truncated fingerprint of your IP address and browser string, 32 hexadecimal characters, enough to recognise a repeat report from the same source, never reversible to an address.
Notifications: What we sent you, on which channel, when it was read, and any delivery error the provider returned. Push subscriptions hold the endpoint your browser vendor issued and its keys.
Usage counting: Named events such as “listing viewed” with a rotating salted identifier, the listing, the language and a small set of properties. First-party, in our own database. No third-party analytics service receives anything.
AI cost log: For each AI call: the task, the model, token counts, cost, latency and whether it succeeded, attributed to your account. The text of the call is not stored in this log.
Favourites, saved searches, alerts: The listings you saved, the filters you saved, and when an alert last matched.

4. On what basis we process it

4.1
Performance of the service you asked for. Your account, your listings, your messages, your contracts. Without these there is nothing to run.
4.2
Our legitimate interest in a listings board that is not full of dead listings. Reports, duplicate detection, rate limiting and abuse prevention. This is the interest the entire product exists to serve, and it is balanced by keeping the consequences in human hands: apart from the duplicate rule, a report moves nothing by itself, it is read by an administrator, and any sanction is applied by a person who can be asked to undo it.
4.3
Your consent, for anything optional: notifications on each channel, sharing your dossier with a specific lister, identity verification, and each use of an AI feature. You can withdraw consent at any time, and withdrawing it costs you no functionality beyond the feature itself.
4.4
Legal obligation, where Georgian law requires us to keep or disclose something.

5. The AI features, and what leaves our servers

5.1
All model calls go through OpenRouter, which routes them to the model configured for that task. The models in use today are operated by DeepSeek, Alibaba (Qwen) and Google. Which model serves which task is a configuration value and can change; the provider in front of them is OpenRouter in every case.
5.2
What is sent: the search phrase you typed when you use natural-language search; the listing facts and your draft text when you ask for a description; the message text and the last few turns of that conversation, plus the listing facts, when you ask for a reply suggestion or a translation; the clause description you typed when you ask for a contract clause.
5.3
What is not sent: your name, your phone number, your email address, your password or token, your counterparty's contact details, your dossier, and the contents of any conversation other than the one you are using the feature in.
5.4
User text is always passed to the model as quoted material inside an unpredictable delimiter, and the output is screened before it is shown. This reduces the risk that text someone else wrote can steer a model call made on your behalf. It is a mitigation, not a guarantee.
5.5
We store the cost of each call, not its content. The provider's own retention is governed by the provider's terms, which we do not control. {{AI_PROVIDER_RETENTION_CONFIRMED}}
5.6
Every AI feature has a non-AI path, and the platform works fully with all of them turned off. If you would rather nothing you type left our servers, do not use them: search by filters, write your own description, and send your own words.

7. What identity verification does and does not store

7.1
Verification is optional. Nothing on the platform is gated behind it, it does not affect ranking, and a verified badge is the only thing it produces.
7.2
The check runs at the provider. Your document and your face are captured by the provider's own flow and are sent to the provider, never to us.
7.3
What we store afterwards is four things: a status, the date it was decided, the provider's name, and the provider's session reference. Plus a counter of how many attempts you have made, to limit repeated tries.
7.4
We do not store, and cannot retrieve, your identity document, the name on it, your date of birth, your personal number or your photograph. When a check fails we record that it failed and nothing about why, the provider's moderator comment can contain personal detail, so it is deliberately discarded.
7.5
To have the underlying data deleted you must ask the provider, under their retention policy. We can delete our four fields, which is all we have.

8. Anonymous reports

8.1
You can report a listing without an account, and we think you should be able to: the person who just phoned about a flat that was let three weeks ago is the most useful reporter there is, and making them sign up first is how other sites ended up full of dead listings.
8.2
An anonymous report stores no IP address. It stores sha256(secret + ip + user-agent), truncated to 32 hexadecimal characters. That is enough to collapse several reports from the same source into one, and it cannot be turned back into an address.
8.3
The lister is never shown who reported them, anonymously or otherwise.

9. How long we keep things

Active listing: For as long as it is live, which is until you close it, mark it taken or delete it. Nothing removes a listing on a timer; until September 2026 a listing was visible for 7 days per renewal cycle, and that is no longer the case.
Closed listing: A listing you closed, marked taken or deleted is kept for 90 days so you can publish it again in one tap, then archived, removed from your working view and from the public site, but not erased, because conversations and contracts refer to it.
Login codes: Five minutes. Used and expired codes are purged by an hourly job.
Sessions: A session lasts 60 days. Expired sessions are purged; a session you revoked is kept for 7 more days so that "log out everywhere" can still show you where you were signed in.
Confirmation and signing links: A confirmation link (the one that marks a listing as still available in one tap) lasts 10 days and is purged 10 days after it is used or expires, so that tapping the same link twice still gets a useful page. A contract signing link lasts 14 days and is spent as soon as both parties have signed.
Reports and strikes: A strike counts for 90 days and then stops counting on its own, with no appeal needed. The rows themselves are kept as the record of what an administrator did to an account and why.
Messages: For as long as the conversation exists. They survive the deletion of your account, see section 12.
Contracts: Kept. A contract is a document two parties agreed to and each of them has an interest in it; a signed contract can never be re-rendered, so what is stored is what was signed.
Orphaned uploads: A photograph uploaded to a form that was never submitted is deleted, file and row, after 24 hours.
Usage events and the AI cost log: {{EVENTS_RETENTION_DAYS}} Today there is no automatic purge for these two tables. We intend 12 months and are saying so here rather than implying a limit that is not enforced.
Geocoding cache: Kept indefinitely by default. It holds addresses and coordinates, not people, and it is what keeps the map inside its free quota and working when the geocoder is not.

10. Cookies and local storage

10.1
We set two cookies (one to keep you logged in, one to remember your language) and we use your browser's local storage for your currency, your theme and your answer to the cookie notice.
10.2
There is no advertising cookie and no third-party analytics cookie, because there is no advertising and no third-party analytics. The full list, with lifetimes, is on the cookies page.

11. Your rights, and the buttons that serve them

You can see, correct, export and delete what we hold. Two of those are buttons rather than a request form, and they work immediately.

11.1
Access and portability. GET /api/me/export returns everything we hold about you, profile, advertiser profile, listings, conversations, your messages, favourites and saved searches, as a JSON file, immediately. Not a request queue, not an email in 24 hours.
11.2
Rectification. Your profile and your listings are editable in place. Anything you cannot edit yourself, write to us and we will correct it.
11.3
Erasure. DELETE /api/me, from the button below or from your profile. Exactly what it does is section 12, please read it before you press it.
11.4
Objection and restriction. Write to @i417a65. If you object to a specific processing based on our legitimate interest, tell us which one and we will answer with reasons, not a form letter.
11.5
Withdrawing consent. Notification channels are switches in your profile. Stop using an AI feature and nothing more is sent for you. A dossier share link can be revoked.
11.6
Complaint. You can complain to the Personal Data Protection Service of Georgia (personaldata.ge). We would rather you told us first, but it is your right either way.

Export my data

The file downloads immediately. You need to be logged in.

Export my data

Delete my account

Your personal details are scrubbed and your listings archived; your side of a conversation stays readable by the other party. See section 12.

12. What deleting your account actually does

Most sites describe deletion in one sentence that is not quite true. Here is the exact behaviour.

12.1
Your email address, phone number, name and avatar are cleared, the account is marked deleted, and the sign-in identifier is replaced so the account cannot be logged into again. Every session is revoked and the cookie is cleared.
12.2
Your listings (active, reserved, expired or draft) are archived and closed as closed by you. They leave the public site.
12.3
Your conversations remain readable by the person on the other side. Their messages are their record of a negotiation about their home, and deleting your account cannot take that from them. Your messages stay in the thread; your name no longer does.
12.4
Contracts and their signatures are kept. They are documents two parties agreed to.
12.5
Reports you filed keep their weight and their outcome, because a listing's history has to stay explicable, but they no longer point at a named person.
12.6
{{ADVERTISER_PROFILE_ERASURE}} Your public advertiser profile (display name, bio, photo, agency details) is currently removed by us on request rather than by the button. Message us on Telegram at @i417a65 and we will do it; automating it is a known gap.
12.7
Export first if you want a copy. After deletion we cannot reconstruct what was scrubbed.

13. International transfers

13.1
The platform is operated for Georgia, but several of the processors in section 6 are outside Georgia, the model provider, the map provider, the email and SMS providers and, if enabled, the identity provider.
13.2
Where a processor is in the European Economic Area, the transfer is to a jurisdiction with equivalent protection. Where one is elsewhere, we rely on that provider's standard contractual commitments.
13.3
Servers and database: {{HOSTING_REGION}}. Until that is filled in, treat this section as incomplete. {{TRANSFER_MECHANISM}}

14. Security

Session tokens are random and stored only as a hash; the cookie is httpOnly.
One-time login codes are stored only as a hash, with an attempt counter.
Confirmation and contract-signing links are signed, verified before any database query, and stored only as a hash.
The contract signing page a counterparty sees is redacted: no earlier signature images, no IP addresses, and identity numbers masked to their last three digits.
Every contract download and dossier access is logged, so the owner of the document can see who fetched it.
We take no payments and therefore hold no card or bank details, anywhere, ever.
No system is perfect. If you find a vulnerability, write to @i417a65 and we will treat it seriously and credit you if you want that.

15. Children, changes and contact

15.1
The platform is not for people under 18 and we do not knowingly hold data about them. If you believe we do, write to us and we will remove it.
15.2
When this policy changes, the date at the top changes with it. A change that materially affects you will be announced on the site, not slipped in.
15.3
Controller: {{OPERATOR_LEGAL_NAME}}, {{OPERATOR_REGISTERED_ADDRESS}}. Data protection contact: @i417a65. Supervisory authority: Personal Data Protection Service of Georgia, personaldata.ge.