Privacy

Who we are

HomeTruths is operated by HomeTruths (“we”, “us”), currently operated as an unincorporated project by its founder, based in the United Arab Emirates. For anything on this page, write to legal@hometruths.io.

What we collect

If you create an account

Your email address, a display name if you give one, and your password, stored only as a salted scrypt hash, never as text we can read. If you turn on two-factor sign-in we store that preference and a token identifying devices you’ve trusted. Sign-in codes are stored hashed and expire after ten minutes.

If you unlock with a verified account instead of a review, we also collect the answers you give at signup – how you describe yourself (with a “prefer not to say” option), an age band, the property types you’re looking for, whether you plan to rent or buy, a budget band, and when you’re moving – plus your phone number, stored only after you confirm a verification code and used only to keep one account per person. None of it is ever shown publicly or sold. Verification codes are delivered by Twilio (via WhatsApp or SMS), which processes your number for that purpose; we never see or store the code itself.

If you post a review, tip or photo

The content itself, your answers to the survey questions, and the optional profile you choose (whether you rent or own, roughly how long you’ve lived there, who you live with). If you post your first review without an account we also ask for your email address. It’s stored privately so every review has a contactable person behind it, and used only to reach you about your own content. Reviews are published anonymously. Your name and email are never shown alongside them. If you post without an account we set a long-lived cookie holding a random contributor id so your contributions stay yours; it contains nothing about you.

When you simply browse

We record page views through our own first-party analytics: the page, a random visitor id, the referring site, rough screen size, and an approximate location (country, and emirate or city) derived by our host from your IP address. We do not store your IP address in our own analytics.

We also use Google Analytics to understand how the site is used and to report audience figures to commercial partners, but only if you agree to it. Until you do, Google’s script is not loaded and none of its cookies are set. If you agree, it records the pages you view and how you arrived, and derives an approximate location; Google truncates your IP address before storing it, and we have switched off advertising personalisation, so your visit is not used to build an advertising profile or a remarketing audience, here or anywhere else. You can change your answer at any time on the Cookies page, and withdrawing it deletes the cookies it left behind.

IP addresses are used transiently for security (rate-limiting sign-ins and blocking review-stuffing) and are not kept as part of your profile.

Cookies

Cookies the site needs to work: ht_session (keeps you signed in), ht_cid (remembers an anonymous contributor), ht_td (a device you’ve marked trusted for two-factor), and ht_admin (site operators only).

If you agree, and only then, Google Analytics additionally sets measurement cookies (_ga and _ga_*) which count you as a returning visitor for up to two years. They are used for measurement only; we do not run advertising or remarketing cookies. You can opt out for every site with Google’s browser add-on, or block cookies for this site in your browser.

The full list of every cookie and every other thing kept in your browser, what each is for and how long it lasts, is on the Cookies page, along with the switch for the optional one.

Why we’re allowed to hold it

To provide the service you asked for (your account, your reviews); to pursue our legitimate interest in keeping the site honest and usable (moderation, fraud and spam prevention, basic analytics); and to meet legal obligations where they apply.

Who else processes it

• Airtable: stores accounts, reviews, tips and votes.
• Netlify: hosting; sees requests and derives approximate location.
• Resend: sends verification and sign-in emails.
• Twilio: delivers phone-verification codes over WhatsApp or SMS when you unlock with a verified account. It processes your phone number for that delivery and nothing else.
• Anthropic: moderation classifies submitted text before publication. Content is sent for classification, not used to train models.
• Google: maps, Street View and building photos are loaded from Google; public Google reviews are summarised into the site; and Google Analytics measures how the site is used.

Some of these operate outside the UAE, so your data may be processed abroad. We don’t sell personal data, and we don’t share it for advertising targeting.

How long we keep it

Account data for as long as your account exists. Reviews and tips stay published (anonymously) unless removed under the Review Guidelines. Analytics events are kept in aggregate. Sign-in codes expire after ten minutes; trusted-device tokens after 30 days.

Your choices

You can see and change your details, and delete your account, from your account settings. That removes your personal data and unlinks it from anything you’ve posted. To request a copy of your data, or ask us to correct or erase something, write to legal@hometruths.io and we will respond within 30 days.

Deleting your account does not automatically withdraw published reviews, because other residents rely on them and they carry no identifying information. If you want a specific review taken down, ask us and we will.

Children

This site is not intended for anyone under 18 and we don’t knowingly collect their data.

Changes

If this policy changes materially we’ll say so on the site and update the effective date above.